{ "Event": { "published": true, "date": "2026-01-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-14", "timestamp": 1768435381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a6b43517-fff5-4f01-816c-d3c9ba58f723", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ba3dd9-f169-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1768409754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409754, "uuid": "52ddcceb-5b41-4062-825b-6b539875b6c6", "comment": "Malware payload (CoinMiner)", "value": "f1c747b2b0024c66226f82962a50f70f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409754, "uuid": "1ce30219-2f9d-42a4-a7f0-0e9de9d36aa7", "comment": "Malware payload (CoinMiner)", "value": "00a16089397d26dec07ba75d5ac027fba40482e0af441942d8de1475aa133aab", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409754, "uuid": "ffec1722-8f16-4a60-bf7b-7f108ca9beb2", "comment": "Malware payload (CoinMiner)", "value": "e79feea951911457bd448dee8d07aa6147f44214", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409754, "uuid": "89d5736c-98dc-44e0-8bc1-94736536137b", "comment": "Malware payload (CoinMiner)", "value": "6354420e54a9187fb8d1e8257217254ce5021d217c582bcfac14314b097981f98df6c5283802289511987a61228ac4a1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409754, "uuid": "b2b7f3a4-abb3-4856-9a57-e09f402daaa2", "value": "T1F7A7CFFFF4D62236EC1DBB66305604DED2DB947A2711E80D8A9DD02D8095F0D4AA326F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409754, "uuid": "570dca1f-49a6-494f-a9bf-2140021f265b", "value": "0fdd3d21d2193b717f076a70dfaa659c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409754, "uuid": "59daf91c-6d25-4a12-8710-39de7ca8924c", "value": "786432:TVOi1PIMD235YXZNfFqahsBXMjuOGiHiU9GBowyRst3pnspkGn:TEdY235YXZNfUcsBXMjvGiHikat3pnsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768409754, "uuid": "6eb66965-639b-463d-942b-5f008d069a75", "value": 46375936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768409754, "uuid": "a0bcde25-f1be-4aaa-a676-5d500da2a4c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409754, "uuid": "bee6135b-d18a-43de-afb6-12de3e1adc80", "value": "all.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c93063-f0f7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768360478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768360478, "uuid": "cf00d2df-c0d9-4346-b5fb-0131ce5eddde", "comment": "Malware payload (Mirai)", "value": "6dbe4830cc0c19f1244b4e23431d15e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768360478, "uuid": "66ca0872-1993-4d33-90a5-ef0f676002b1", "comment": "Malware payload (Mirai)", "value": "00e95c15e6e37aea8bfa668f75a3847054b130246d7bc7ec715abc9b849bd7f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768360478, "uuid": "44534379-58ba-42e5-9ac9-7ce7c5cf4b14", "comment": "Malware payload (Mirai)", "value": "19691bceb578560179e1aaeecd4151561f04c30a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768360478, "uuid": "6823f607-9d7d-40f6-986b-b4c34ff7599e", "comment": "Malware payload (Mirai)", "value": "804931a603f2437955826368dab709fe324b3d46c49de4e002be1a863940830e655ab0a02f4951187b588571526ec27e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768360478, "uuid": "d2de299a-6f94-41fc-8adf-c3824792deac", "value": "T15FF44B02EF891FABC46FCD30492E834715ED89EB0AD5933451FC8949BF8D66A4AE345C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768360478, "uuid": "9256f97e-01ab-4266-9b49-635bbc5186f9", "value": "12288:n3AHhWX8DCyI272NYxwssdThEzxzXzQzJhzrlIPiaubjXg4i9LvZvUZUW4+St8l1:v9i+9XDDnu3nZSm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768360478, "uuid": "7fe6e5cc-8353-4e79-bde5-adf04f24fd45", "value": 731944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768360478, "uuid": "4c07f75f-13f7-43ab-be4c-88072d0b6c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768360478, "uuid": "636cd738-dd1d-4f2a-9e3a-85a2a053397d", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74588c70-f18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768425458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425458, "uuid": "d4cdc85f-d83d-4454-bac9-a8c10785c44d", "comment": "Malware payload (Mirai)", "value": "852cbaa9800d3d2a58440c2d0e7cd208", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425458, "uuid": "9791fc07-b2b3-404a-89f0-498e46c11f20", "comment": "Malware payload (Mirai)", "value": "0182f624b9a9eaca096037e3c30cd6c4cab4c1d7f8d9d1a3b4fe2a55aa6e3d09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425458, "uuid": "f9c48dfa-b1c0-4c16-b53c-3cd20e64b689", "comment": "Malware payload (Mirai)", "value": "4e784f9ab3202dc5453b8b6e651468f95b78d293", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425458, "uuid": "594352b5-d4a5-4615-9dc9-827659542489", "comment": "Malware payload (Mirai)", "value": "557245b6006ae00d1ab2b06f9c2c21bb6b6cf22be9f19449bf3c40a3e0f20207f23d93fd02800bdbf2dc0aa0df6ac2a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425458, "uuid": "35f5f792-b523-4a36-8479-ac1ef344878b", "value": "T138A34B819B42DE73E45320BA16EB17614E33FE3A5422E542E76D7FA1DD192C0A90B37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425458, "uuid": "4de2ae9a-fa06-4ca7-a38b-c862ec68c511", "value": "1536:7kJ6CL1+oyH9vo5tbMDjNgSUio3i7Y2FHqUrR8ihXjYHuZjKqy0X9QE12i2bmhgP:7wfbcjNgSUiEi7V/rRIHMjdtf2bmOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768425458, "uuid": "007d69c0-7f8c-444b-996d-ce4052ac3956", "value": 100044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768425458, "uuid": "174b9df9-c5c8-4ddb-89d5-8284d9a113d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425458, "uuid": "f73a816b-3da9-44a3-872d-dee20e850078", "value": "2016Nwji586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f475c888-f0f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768361678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768361678, "uuid": "50a638bf-e8fb-4819-8779-5ce16c61e079", "comment": "Malware payload", "value": "3fe2756032dd2b102b5aedc719b46d10", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768361678, "uuid": "1ad773f8-1b4c-48de-9e6f-bff1cedd4a63", "comment": "Malware payload", "value": "03c2632bc7ae92e409c063e4f260b1a7199ff6cdd7ba0b0455fd1947afe79b99", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768361678, "uuid": "31e5c9b2-0e21-4993-a42f-e19cf780c704", "comment": "Malware payload", "value": "1b8d2b21350f9bfe270b12d77a9f793f5eecead2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768361678, "uuid": "7a48d01e-7f6c-41d7-97ff-8e019739c787", "comment": "Malware payload", "value": "4b9a1a49ec9bffb14219f282c4153220f6a3c3ddcbdca5d5896b216523e659ed525e221f5199c9604826faf1d8cebb17", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768361678, "uuid": "9eeed0d7-ac3e-4d41-a714-7696910add21", "value": "T10DB56D12B6550175CC2B83755B2D3A35B8AF706007758ED3A3D8CE7F1462AC2ED3A7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768361678, "uuid": "c340e512-cdb7-45c6-a899-c28406c24ee2", "value": "6a8a7bd90260c5c5d557299fe7dc678c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768361678, "uuid": "89e746db-a832-4a65-9932-1563a6a826e8", "value": "49152:wIrgsVRBhGcpAahLy5JWQJ8fp79Y+Yf9W/Klo2MgnMt7C2l1FVsrv:CmRBhGcGaw5JhJ8fp0f9OKlo2MgnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768361678, "uuid": "724ac27f-c68b-4c1b-b732-09fc082320ed", "value": 2452480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768361678, "uuid": "88313147-1819-4451-bc55-a4da5622d797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768361678, "uuid": "c40e0c71-3c4f-4413-9c62-9c5dd905180d", "value": "duilib.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07bb930-f116-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768374046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374046, "uuid": "e6bcea9a-9f70-4b97-b532-5451560f07e9", "comment": "Malware payload (Mirai)", "value": "475d3f0d856df50698b4db17b1a16c13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374046, "uuid": "77fb93e1-d6e9-49f7-9f95-54d882ab5cd7", "comment": "Malware payload (Mirai)", "value": "0503c669f4ccafdeecd118d3d533d637d2c973491f3dd9dfb71ef8e1cfde3bc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374046, "uuid": "3a0f11a6-5359-4c05-9c44-cd3a2f22820c", "comment": "Malware payload (Mirai)", "value": "88e5c6cc74eb0d48bb127a92d94896fa1a7f46cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374046, "uuid": "46bba472-7bd5-4913-ad0a-da24e1748048", "comment": "Malware payload (Mirai)", "value": "32364798dbf43fd0c77bf37fe86511f0cf4ec28209bee2d8fdd15fdd25f10ecb86292a551a966247a6167528939ae4be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374046, "uuid": "4a21e7a2-a4e0-45b8-a124-6247aef233c8", "value": "T12E632955BC829A12C6C6527BFF1F428C77266358E2EE3203CD199F2127CB86B0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374046, "uuid": "a70cc968-2c57-429c-8251-b3e1978312c4", "value": "1536:+uXsdu9tnlPmof7/YSinpjua7jOAUsqrqLOtf/n7i70KLU5Oy:9XGutlPmopinpCaHOAUs+f7idLNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768374046, "uuid": "3f8f4f89-751a-44f0-a90f-592bc5c86a7e", "value": 72160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768374046, "uuid": "d1f2c4d5-2401-4307-a106-cbc97d81dcc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374046, "uuid": "6e291a98-d7ab-451f-b60a-c1141127b373", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c2174e-f18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768425454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425454, "uuid": "18111712-4802-414a-8432-0efe4952fca9", "comment": "Malware payload (Gafgyt)", "value": "5f5380c41889dec1aeb07d201be28b12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425454, "uuid": "97dc62a6-f634-43b8-a8c7-b40bf9163ed5", "comment": "Malware payload (Gafgyt)", "value": "05286b026d4d915c7d7344717e4fdf3c7e49306e00ab01e07b085c5e7e54dcb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425454, "uuid": "509df89f-c4d6-45df-988b-15009233860e", "comment": "Malware payload (Gafgyt)", "value": "3fe071925fd7f55110f291395a2b9569eadc3dd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425454, "uuid": "29514abc-03eb-4f6d-9892-5dbc8b6edb51", "comment": "Malware payload (Gafgyt)", "value": "4ef043ecd8a8738db85fc100c3dd8d704150278e2de7d61ef6705dc0ab83555c98ed3e619051e30a285ef010582ed4be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425454, "uuid": "1c0291ce-7654-406d-9d79-244e0a586906", "value": "T17DF3F81BAB519FFBC81FDE7305F94B4128CCB45721A52B3B3270DA58B61A58B09D39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425454, "uuid": "8a07ee10-9e05-4868-bc90-33e4da8c25d6", "value": "1536:4AtdnFWEsWgHp8cpaNhEJKBPjJv9uLJ7LiTOvjeiON/FkTZknpPyzWB0DdZQCU1A:ndnVgHplsEoPsOTOLOPkTHTZQ1I2b07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768425454, "uuid": "8d7634da-a43b-4556-af8a-5743ec8722f7", "value": 160724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768425454, "uuid": "99c03f0b-2a00-401e-bda4-3ac40f0973b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425454, "uuid": "535a4efb-f76a-4dd2-ad6a-6f662c87e005", "value": "2016Nwjmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d392c9a6-f0e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352174, "uuid": "556fcaea-7cd5-418d-abab-161e5144e0b2", "comment": "Malware payload (Mirai)", "value": "5965698c99253673cb2d7d83bf1c3a01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352174, "uuid": "8dd48d97-060e-4d24-9549-c746ef4f42d5", "comment": "Malware payload (Mirai)", "value": "054006e6bf1c6a704564377f9beeec914631f6475c7c327ffe84389b4b165ff8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352174, "uuid": "5bf69c38-5df6-4c22-b60c-be4aa5d6a7e0", "comment": "Malware payload (Mirai)", "value": "9ca2bda4799f4a20ab3873b51c0bb63ae29abd22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352174, "uuid": "7675025a-b844-4f3a-9d87-3dcd641afd30", "comment": "Malware payload (Mirai)", "value": "da5c1adda969a464fc5b04a091e9ebf850ff378b9879fbe219e54670b38c5828cc3b5d0a6c8acd7dc5e3357387076354", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352174, "uuid": "6975df8e-c6cc-4cf8-b5b3-9ddc1d6bfa4e", "value": "T1B4930909BFA04EFBDC6FDD3706A91B0135CC591722A93F367534C928B54A24F1AD3968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352174, "uuid": "e01c7139-f6a6-4b7d-9fe7-c0a3bb43115c", "value": "1536:Qil7W9fcFIiRtIZGygRvAVRljEvASOQbRBPk3KfmSjGWh/Z4sIS4Y4fyNE:Qil7W9kFIStIAVEmISOF3gjGWh/tIXuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352174, "uuid": "08d79460-3fde-4a2e-a842-4da414ec6ecc", "value": 89260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352174, "uuid": "6e7c972c-1f77-4885-a74b-10d0034bf835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352174, "uuid": "6e29c77b-e323-45de-a98a-5bdc2e849181", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9cae61-f113-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768372777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372777, "uuid": "ba7db4c8-4d82-4591-93fa-5f27ca93f83b", "comment": "Malware payload", "value": "74dd8daa53aaebfd325bd78ba3066d90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372777, "uuid": "4bd87941-5030-4b4b-a142-a36bc155678d", "comment": "Malware payload", "value": "056aea1b1d23241e9dd4036241d68e4b2a9d0ed7a54982af3844ce269c20a9cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372777, "uuid": "7265faf2-cd3a-48ed-ab6e-38ccf4fc9ceb", "comment": "Malware payload", "value": "a5cfbb177a59f50d6e58c4c15d8c72ad27dfaf27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372777, "uuid": "2574bec0-1340-444b-abb3-4023630a300f", "comment": "Malware payload", "value": "f6c15b95d4e87792cb732827fd50eb1b9d4467773ef3002c663b69fd365cf0f824e7fe3198bc7e1421850c2d4b63f8e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372777, "uuid": "a097fd34-393f-4250-83bc-423cd39ad698", "value": "T117D3AFDBB38B1851C43246F007C79FCE2A637211CE4BC8F62D1E567B29B94DB1A0A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372777, "uuid": "6bd8add9-e979-4b12-a8ad-13446a05bb6b", "value": "3072:rl3CKs18NhCP8qrmQDIy2aq+OG6P7yo4goq:BSKs1BVrsaqV2Jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768372777, "uuid": "06e5a5e7-32ba-46c8-8cb3-1f4f9841860c", "value": 132476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768372777, "uuid": "e28e6a89-0d33-4526-a33b-9fe162e6981b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372777, "uuid": "53e6983d-1eb9-403c-a935-ea5463e9042d", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c11e0e-f0ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768354970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354970, "uuid": "74d144bc-f0c2-4e46-9bb1-2e91e94484c5", "comment": "Malware payload (Mirai)", "value": "b3ef81dfebc89894951778733519f713", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354970, "uuid": "6c8a184c-225d-4fde-8f94-f5a292a11ee1", "comment": "Malware payload (Mirai)", "value": "08a3a4a254b5db0030ae1a6551c9be260ad033f8403c94c2af872cf435d650e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354970, "uuid": "4172d398-9157-4eb6-aa9f-9a2fdc1af8b4", "comment": "Malware payload (Mirai)", "value": "ac6db1196cee9767e1570168dc67f4d3957c293d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354970, "uuid": "fc841fe1-3d52-495a-96d6-a1672e8f0722", "comment": "Malware payload (Mirai)", "value": "0d22256fbd4f2ecb1a13240f322c196f4d7881835e96bf25e05d05ffd382d63ad3e1dbe3fae685b810c2fec6e76e3c0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354970, "uuid": "65c4bdc3-4b0c-49ed-8af2-6b3c0a5b14b8", "value": "T17CD47E5CFE5E3C42E2D7E2789A4D83E1732771E4D32391E27982420CD5CAAD9CBE1A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354970, "uuid": "7674088f-5916-42b6-9235-b26d06aeac64", "value": "12288:PvOQ/X34JT7vMLXmb0vciV2nZ6N9JzoG5e9GyNwnw5kXFRpbL9c:PvOQf34JTVGciVYZ614biLXpbL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768354970, "uuid": "ab4eb370-741a-4fad-adae-1253f6a61d19", "value": 644240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768354970, "uuid": "bcde1cb8-af5c-4b05-bbd4-74559c6e8627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354970, "uuid": "dc62db00-fe59-4451-bc0e-59dcb581ec52", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f975c6f-f123-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768379414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768379414, "uuid": "e811f2ba-e14e-4909-9eff-f20291f3fa84", "comment": "Malware payload (Vidar)", "value": "df38dc6f2526c1a052ea9f5716f33524", "object_relation": "md5", "Tag": [ { "name": "95-217-27-33", "colour": "#94C3D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Vid", "colour": "#906B8B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768379414, "uuid": "da3d8af2-f6a8-4a2c-b973-016cc1bf2646", "comment": "Malware payload (Vidar)", "value": "08d7d5bba97c81e549e0a38844cabb4a8bd9441a60fb72ad182337f93983dbfc", "object_relation": "sha256", "Tag": [ { "name": "95-217-27-33", "colour": "#94C3D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Vid", "colour": "#906B8B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768379414, "uuid": "80b694b9-5160-4d6c-88c7-2993a48373b5", "comment": "Malware payload (Vidar)", "value": "952e07121302ff1229ed25d0dc58411bb3eb418d", "object_relation": "sha1", "Tag": [ { "name": "95-217-27-33", "colour": "#94C3D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Vid", "colour": "#906B8B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768379414, "uuid": "ca3a3246-5489-4194-a768-4a80e538169c", "comment": "Malware payload (Vidar)", "value": "51c6146098e11413a3b26df6c9b69f1f3902f2790868db255ad9ecd954b573f795b2f7f48bf79830adc698f75b9c0ff6", "object_relation": "sha3-384", "Tag": [ { "name": "95-217-27-33", "colour": "#94C3D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Vid", "colour": "#906B8B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768379414, "uuid": "bad38c7f-8bd2-4fd7-8be3-09087c2ce553", "value": "T14B866CE2FE408675D6DBF235D861215A6230B848073525D7BF754AA48C2FBC4273BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768379414, "uuid": "952be268-60db-4a50-9c23-7381050119fb", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768379414, "uuid": "8514edca-3736-463b-b482-0c0a39756d65", "value": "49152:gBvJYPGjurb/TJvO90d7HjmAFd4A64nsfJDjV5IdvwVA8i+ygCv505ZWB5xWZK1e:yjJgHhOSKmQVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768379414, "uuid": "f0ba871f-e73b-46b6-a2eb-afa8407a7097", "value": 7851136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768379414, "uuid": "06c38257-9485-4bfe-913f-13af6c831635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768379414, "uuid": "b62141f6-b09f-41b5-a600-b9f299aa11f0", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1e6f52-f181-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1768419920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768419920, "uuid": "e8999960-4ef7-4340-a04d-93de9db7ae84", "comment": "Malware payload (ValleyRAT)", "value": "1d36df07e1135357885d203669b4bf34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768419920, "uuid": "c97d2b6d-9566-40ee-a4d8-acda3bec8c07", "comment": "Malware payload (ValleyRAT)", "value": "08e9c18172518605d7d8101d06629acfdd48df2359103b8d55df7e498b79804f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768419920, "uuid": "acee2ae6-1135-4ea4-bf54-88e4e9b41ef4", "comment": "Malware payload (ValleyRAT)", "value": "605f2f4a957ad5d84f13d414bededed5d3944772", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768419920, "uuid": "19942967-ccc1-4926-b4eb-9e2f41cfe3af", "comment": "Malware payload (ValleyRAT)", "value": "9d0a15fe99002d878766f4ac192368f910c79dfb2578983b6a31e2946ec0e3c738ca2288b68dc5b7406b1023acf53dda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768419920, "uuid": "a4f17d33-d01b-40ec-8065-58baa5090739", "value": "T1CBD36C4733A460F5D4A7C378C9A25A06E7B378661731A7CF13A4866A6F137D0AD3A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768419920, "uuid": "e5c7f8a8-2306-4624-b97d-76e89d5d931b", "value": "2f4c92a36f0eb35d81a44e3422e1082b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768419920, "uuid": "1114ce6c-027d-4ee1-9ef7-ba1673345377", "value": "3072:wJvr9PP8JYCBwsioRTwQJvMB2OgtEYdZUbdFz56U1e6wN:wJv5UJYU40TwkMB2OgtEsZK9+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768419920, "uuid": "b3b7e636-b5b7-413f-beac-aca95a14da41", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768419920, "uuid": "c399f92b-bb31-4158-9494-3057df542f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768419920, "uuid": "ff1d6de9-fe6e-4d8a-9160-4630997fd2be", "value": "1d36df07e1135357885d203669b4bf34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83da8021-f18f-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1768425914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425914, "uuid": "dcec7fb9-32e9-4c9d-961e-b7e584144839", "comment": "Malware payload (ValleyRAT)", "value": "26c571d593b641dae3beddcb54da3265", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425914, "uuid": "3288eff8-c905-4d24-a3f1-26d151291b1e", "comment": "Malware payload (ValleyRAT)", "value": "0a637bc0224aaf77de7cb3e8b574a34f9c64ed16649dfb8adbc053f304745b60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425914, "uuid": "b81141d2-076d-4420-8cfa-3d09d2c0a351", "comment": "Malware payload (ValleyRAT)", "value": "165490b2d47ac4a07ef6b666575eea723b1fbb36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425914, "uuid": "62a5260b-0107-44df-9474-e1a1f751d1d5", "comment": "Malware payload (ValleyRAT)", "value": "2870ecffc7099d60c9083af7f540efbc99260d24ce7febc9343fe1c0810a637bcdc72d702fde9211fddda458479a2cd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425914, "uuid": "f7c8988c-a809-41c1-97e3-f8d92e3269c7", "value": "T197D36C4733A450F9D4A7C378C9A25A06E7B378661731A7CF13A4866A6F137D0AD3A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425914, "uuid": "45e46db1-9a75-45bf-9e7f-bae85199de3e", "value": "2f4c92a36f0eb35d81a44e3422e1082b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425914, "uuid": "9b0fd16c-e8db-4f23-8d5d-5e325bf1ea3b", "value": "3072:wJvr9PP8JYCBwsioRTwQJvMB2OgtEYdZUbdFz56U1e6wb:wJv5UJYU40TwkMB2OgtEsZK9+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768425914, "uuid": "803f3049-4b26-4a87-bc2d-6ab6799831ff", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768425914, "uuid": "d1e51147-b978-4b31-a3de-71082c15f138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425914, "uuid": "525cca31-9765-49be-a9b7-718a462ac2cc", "value": "26c571d593b641dae3beddcb54da3265.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ea6622-f140-11f0-a129-42010a9c0007", "comment": "Malware payload (BRAT)", "timestamp": 1768392073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392073, "uuid": "c9b9b0bd-7c7e-4cab-921f-e6a387b7aafa", "comment": "Malware payload (BRAT)", "value": "ade9e53c4a3eb290bc5f21dc25ca5eb5", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392073, "uuid": "70f27009-6b9a-43bf-9028-41cfc6679b46", "comment": "Malware payload (BRAT)", "value": "0ae7229c0de30264bd54cc4c8066c7461552c0033fa7375c70bdceb3aa3d0b35", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392073, "uuid": "c937441c-b845-4699-8887-7b90a0c557dd", "comment": "Malware payload (BRAT)", "value": "2bc122e692b8d608e1cfac964e454942e0dc1abd", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392073, "uuid": "4b210811-f2ea-4e04-aa5e-8ea8dacae23d", "comment": "Malware payload (BRAT)", "value": "49ee2b96c35c927c49d5108b66dc9a9cb699f1cbbb655c9b7d81eb292c85409c0f9cdcd214f4ffe84cd4c860c98fbba9", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392073, "uuid": "74de83d3-b0ef-46af-b41f-da5b27da943c", "value": "T1A176D0CAD16B40D6CC067FF598142BC39B3056324A34046836BBBE585F779FA811EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392073, "uuid": "50985c8e-02f6-4a6e-8069-a4248a50f4a8", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392073, "uuid": "df3bc096-a31f-4183-8277-ee2a70922fca", "value": "24576:oKfEkfdDL+R+QP7ytjhBjB8Mn9n1FxC47v/0SvCm8JNnc+GOyUetb/in8PZ3QKNR:QpRSHNH1Tukb25e9w/493Mo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768392073, "uuid": "7e51277b-a904-477a-8353-734a465a50d7", "value": 7228928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768392073, "uuid": "d9cbf879-bfcd-44ab-97cf-747072154774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392073, "uuid": "083479b3-d28d-436d-a950-0e305b04b0a0", "value": "6K8M59WE4ALR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0769e5a2-f0f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768359563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359563, "uuid": "cbf96c38-ba94-47ff-b661-6eec7eef94ff", "comment": "Malware payload (Mirai)", "value": "bd63e8f72b492660f90c9c405421fe49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359563, "uuid": "4b2a1319-4ffb-4f8a-8711-c79104ed1bc1", "comment": "Malware payload (Mirai)", "value": "0b36b403eff658e1b4dc8d563b449f97c0e982f416943353695d268922e320f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359563, "uuid": "84e3d99c-8998-4526-96f6-24932f9f9502", "comment": "Malware payload (Mirai)", "value": "9a50806709215328027d7b944f4488f1df3c09da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359563, "uuid": "67da4584-91a1-4368-b659-ae3d299b685a", "comment": "Malware payload (Mirai)", "value": "44dc50e63cc4cb8b0af7c8b68775e3b97c568763bffb36c4fa8192f89fc3215bd412d97f3fb80ebb9dc6b7fd11100a5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359563, "uuid": "415fca63-6dc4-47f2-8d80-0cfc850cd584", "value": "T118C44B55F8809F61CAC52976F69D829C73134B79C3EB72069D144B383BDB8AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359563, "uuid": "fc579524-ad47-4523-b14d-55493dabf568", "value": "12288:LJ6FpaYS0XY5BrtpNLYWqd4UUZKgpZ/m4k:OaT7NUmfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768359563, "uuid": "540383b8-1e4f-40d0-9516-6360dd9c2c22", "value": 570648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768359563, "uuid": "b6e676af-989a-4002-bf7a-3ae45c43afa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359563, "uuid": "51469563-9b98-4cdf-bc8a-8f3016242ea9", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76b9f3e-f0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352610, "uuid": "dd5b3ddf-a7f4-4992-90b8-c013a6571f19", "comment": "Malware payload (Mirai)", "value": "b9c5c7b9ebb6fcd376a0fbe4b19a6b0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352610, "uuid": "f044b76e-51f7-4167-93d5-a0dcc12014b4", "comment": "Malware payload (Mirai)", "value": "0bbb7ae0a2495f87a81b3d7c8a458dcf45cc568917e32f0d14a7a1335dd2d5ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352610, "uuid": "69e68a60-8507-416a-9340-982da4ec3b0a", "comment": "Malware payload (Mirai)", "value": "4559fd414785033632c06101fe606a42aa2caccc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352610, "uuid": "c7d5f7e7-c34d-4101-bd2e-3812e5f4d73a", "comment": "Malware payload (Mirai)", "value": "344f3f4ce5e70625b15a4b9e04ec96a9b3a480f4839d7c5bbe6be2512d43f703893fc8bd9f18f342e07591d1ce8e876c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352610, "uuid": "50124583-474a-4baa-a21e-48499f3a06db", "value": "T1C1337306BF654FB7D86BDC770AF91B0134CD681B25A53B397934EC58B20B28A15F38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352610, "uuid": "25ad5331-6706-47cf-bdda-0f72f7f3d609", "value": "768:oGZpAj+kDziDnB59Ho0LwkUMfeyBe9yeGNnqe8XiFlZEX/Jk:VZuj+kHiDB39LwkUgTBAytNn7vEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352610, "uuid": "ca886c05-d283-45bc-8ada-2b0e9cb0290e", "value": 52800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352610, "uuid": "89dfd96c-f60a-41f8-a78c-ef23e0250436", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352610, "uuid": "e1cc5057-fa59-4f41-8bc6-e992bbf54a44", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7615fb-f169-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1768409767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409767, "uuid": "45047f07-30e9-40f3-a651-416cc5b48007", "comment": "Malware payload (ScarfaceStealer)", "value": "40e49378b761e22aaec82675d0b3373e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409767, "uuid": "ac3e22bf-96da-43ea-b571-9bc3b9fa4b3a", "comment": "Malware payload (ScarfaceStealer)", "value": "0bdc246e702f4957cd28391c0d28d4244616fda5ff7de8533f98cad51c8b657f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409767, "uuid": "f1bb9259-9dd9-4c52-832c-14b829c44dfe", "comment": "Malware payload (ScarfaceStealer)", "value": "409ea69063e8f7c08cee2d40f1fea57bdd55c745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409767, "uuid": "227db515-2b7b-4cdd-93d0-9333ec9631e8", "comment": "Malware payload (ScarfaceStealer)", "value": "3b6d1d3fd1a12c631adaa5d213e400c3ee0cd2a7f95c1da9922eca3d9f14c3ce5b4d275cefe9c2f86c8fff4967ce2351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409767, "uuid": "162f625f-7de3-4ba3-a8d9-8aac06008410", "value": "T1E7F623D37ADAD39CD497893099C3479971E2B6C981FF591EB6CF1C022240E17824EAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409767, "uuid": "1996081d-2159-46d9-acc2-48f0c63ed48c", "value": "33184a7fc9a88c88d19cc798ba17c5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409767, "uuid": "2fa72fd4-731f-4263-8859-a9d3700ee418", "value": "393216:QgD9iyI7hr/HuDsC4SPxrgj4Iqa3laU3yC1pXAbe:D9tIFzuDsC422sTa3EU3yCLXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768409767, "uuid": "553018f9-6588-4981-a943-7e0c70827e75", "value": 15589888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768409767, "uuid": "e4831219-e657-47b5-a307-451f8870134c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409767, "uuid": "c9a38c4e-5b95-48ea-a454-a22cbc556d0d", "value": "KiddonsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6e2983-f152-11f0-a129-42010a9c0007", "comment": "Malware payload (DestinyStealer)", "timestamp": 1768399705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768399705, "uuid": "b1c84fa0-fb98-4f9c-b57d-a2a463c7e8fd", "comment": "Malware payload (DestinyStealer)", "value": "ab3ecc662732ece57ff6d35440061c1a", "object_relation": "md5", "Tag": [ { "name": "DestinyStealer", "colour": "#059BE5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768399705, "uuid": "4a4cb396-5865-4dc2-969c-88dcbe020fcc", "comment": "Malware payload (DestinyStealer)", "value": "0e7aa42d81a35200a205b426dd88c0c487b785851a081bedd9978ced12fb09de", "object_relation": "sha256", "Tag": [ { "name": "DestinyStealer", "colour": "#059BE5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768399705, "uuid": "f4a2e31f-ce54-4ffe-bf98-85eb8cb9ac2e", "comment": "Malware payload (DestinyStealer)", "value": "7f5e5e80a28d925bda4ebc6747959e261d287fd3", "object_relation": "sha1", "Tag": [ { "name": "DestinyStealer", "colour": "#059BE5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768399705, "uuid": "7f4a72fe-1380-4f9c-8626-73adb0e93a78", "comment": "Malware payload (DestinyStealer)", "value": "ba6c6a0a0a1191a4626194a92f8a56ca61383d6eb867e8876c1e0370e2e723b2e74a70ef7cda72e60e3993c4940b142c", "object_relation": "sha3-384", "Tag": [ { "name": "DestinyStealer", "colour": "#059BE5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768399705, "uuid": "b4b7ef51-268a-47e8-9f90-7fbc2d519f2f", "value": "T183963351B154EF62C38D527FC6CF942083E89D473573EB96AE8933268B423BB5C51AC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768399705, "uuid": "4d28bf9e-bae6-493d-b87b-002b25d090e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768399705, "uuid": "0e9ecbe9-e8fb-4866-86cb-b878afe259bb", "value": "196608:1hpJ6ghaKesWITQKhWlJm97IeswHgkOBI9c83L:1fIFX8TOvIswBAI913L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768399705, "uuid": "b3280f92-7ca2-445c-a519-a3e3535512b1", "value": 8787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768399705, "uuid": "2edd3b61-32a6-42ff-be68-1b79033e6f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768399705, "uuid": "b6641f70-598a-4073-927b-6e7a7c670169", "value": "imgs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01eecdb2-f0ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768354829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354829, "uuid": "bf2dec43-dad9-418e-9b7e-cc509b5ae844", "comment": "Malware payload (Mirai)", "value": "86600025c5b36d04d38bbe0bfdf15281", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354829, "uuid": "f17bc622-0129-43e4-8bf6-93d3d3ab7b17", "comment": "Malware payload (Mirai)", "value": "0f8d7d0e039dbb1dbdd62182a43f735b6adf887084ef3aaabf5ae29908a4822e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354829, "uuid": "a475760e-7e82-4435-8820-1f78780c8f58", "comment": "Malware payload (Mirai)", "value": "9793ce0af7aee2c5f2bd8b1f8e1b9443e30cd404", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354829, "uuid": "db0258d8-7efd-41f7-bcc1-9d252dbde402", "comment": "Malware payload (Mirai)", "value": "c6d37b7c42d2ca103f0fc034f59c5792684c7b20571cdf8ce25c27380982a46c0d06d7b6d0f2cad2e8fdb551a6690ce0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354829, "uuid": "4afcd3ab-8534-4cf8-b49c-090a7b234038", "value": "T1E7D35C0677180E57D5A34AB0263F1BE083FED5D121F4BA89291F9B6A4672E3B5481FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354829, "uuid": "5e832eaf-cd2d-43e1-82d0-2a0ed0bbcc75", "value": "3072:JUFczWKNZhc3JiwmS7ZHr2Um/u4SM89tkab:DvNo2kdr2Um24SM8Pkab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768354829, "uuid": "6593da93-90df-428c-8863-4279aa1a4027", "value": 134328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768354829, "uuid": "3730c1ce-7e65-4ca4-a7a5-fb7a0530aea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354829, "uuid": "e0162f91-14d1-4d7e-af5a-8c11c5a3c1ec", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76184159-f18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768425461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425461, "uuid": "2de5a6b9-bd4d-4109-b1e0-6a97ae530241", "comment": "Malware payload (Mirai)", "value": "eddb82d30209541c4a30d66f9ea4ff14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425461, "uuid": "88982473-1569-4dee-9f35-c35f93fa4f1a", "comment": "Malware payload (Mirai)", "value": "0fe8b93aee14db5377d481e50de94c1eb468e4c8590f86ea326466a21891a13b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425461, "uuid": "08394c47-9805-4ee6-aac8-ea469821321b", "comment": "Malware payload (Mirai)", "value": "a0360f0835c79cdcc4ed955241fd9573750c2d1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425461, "uuid": "26598c5f-3aa6-479c-8b6d-a1ac91b7ba33", "comment": "Malware payload (Mirai)", "value": "e848793e6b15a00a88b34ea5d677a2bd9e968f8940dfef6aea92e32d8fe366f974507b3aa651dbfc910e48b8b6e0cf34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425461, "uuid": "35715541-fbab-4872-a2b0-ca37e87eb328", "value": "T155B34B03B7094F07E0172EF02E771BE1876ABDD22AE9E184750AFE8543759B1604AFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425461, "uuid": "b2dfcd7b-f837-4c0d-8aae-c627378da3e3", "value": "1536:ucmi9/5ak3YU+W857E4TJUyGGQJ+TuYFpDeD4zzKn7sUMmXrILFyTB6aWUEoyN+D:p5LYq8CgJUKJzw7skXrEF1li", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768425461, "uuid": "bcd7ec1d-e216-48a9-8421-592309c24ab4", "value": 117608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768425461, "uuid": "1e14266a-633a-4b93-9b32-937989abe1f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425461, "uuid": "693f0d3d-28a4-41bc-b2d2-7be8481155bb", "value": "2016Nwjppc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6474ebe5-f105-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768366591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768366591, "uuid": "cc0784b8-cbaf-473f-93de-4aeab1979392", "comment": "Malware payload (Mirai)", "value": "24f4434de753db68918eb3a905c14636", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768366591, "uuid": "45a0eb6c-e7c5-4658-bfa1-dc75123ef537", "comment": "Malware payload (Mirai)", "value": "0ff2efc81fea48a9dcde900066cf3adcf2d65741d5642f96b52a653ec187d950", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768366591, "uuid": "968a1296-573c-4e3f-ae3e-13c10ebef454", "comment": "Malware payload (Mirai)", "value": "06ffe4fa091a85bb3dab4faae7788130c41be7ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768366591, "uuid": "66763851-9ff7-47a3-b267-5f2a7a44ad8c", "comment": "Malware payload (Mirai)", "value": "4fdef65fdc5be6d5d47a541f0bc10453d5ac00d1e7679c86711b89b8f7cd2c97d71ce3369bf3c9f92ff4ad916fc851af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768366591, "uuid": "00512516-ffc9-4bc7-a6d2-51571acda232", "value": "T1B3C37DE47A8F3D91E2C7D33ECF844AA2712BB5F4C66592F0BD01132DC1EADA989E0551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768366591, "uuid": "919e3ebb-204c-488b-b2b0-85e210d9d455", "value": "3072:Md3oNj8jSqlKMLWEFcf74B7T7QFllWe8C:Md3oNy/hFq4B7TEf4eL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768366591, "uuid": "05b37c2d-d13c-4b56-b78f-20e97f4bb8ba", "value": 124784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768366591, "uuid": "6e63a062-6d87-4f06-b08c-906557c85f74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768366591, "uuid": "62689832-5a86-47e8-9bf7-ac59b4f2b02d", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c562f66-f16a-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768409822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409822, "uuid": "4fc4e063-f8dd-47f4-bc1d-7c59279192fd", "comment": "Malware payload (SalatStealer)", "value": "429a46385b5a9886e29b080ce0f46f8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409822, "uuid": "5d1ca047-0cbd-45e8-8281-3a66071e974d", "comment": "Malware payload (SalatStealer)", "value": "108ea73955f776b6cebf6f22091f57e42bc2dcd7eb24b59c7d40f509d9aa8b9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409822, "uuid": "79cac265-65e6-479e-a310-c3f698b9a96f", "comment": "Malware payload (SalatStealer)", "value": "8ec205d16aee88432ef9509adea3170650b8f94e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409822, "uuid": "ba4432ca-1a95-4f92-98e3-9310fefa6c01", "comment": "Malware payload (SalatStealer)", "value": "59d6e7e76164cd73a741d9bb98998ff6b0eaea4e552b4ad7deac9fd807b2e416f20f10f7b86fff02ec0aa0830ffca4cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409822, "uuid": "d7dfa22c-300e-4c38-965b-6350ee1ea1df", "value": "T19EC65A51FA8B54F5E9031835409BB23F67355E048B28CBDBEB543F2AFC77692192B209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409822, "uuid": "f15c4ec2-2d11-4d37-92cb-575262f4c88d", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409822, "uuid": "d079264e-552e-45cc-be9e-a9c4c2c8c197", "value": "49152:wUKvrW2x7BO+A3V/mZgDZRksZ88mxpUBPfvn6JunN5cTwHVn3v0QUlvyT9j0unn6:pSrW2lBE/T7jdEM60jC7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768409822, "uuid": "1f550184-2539-4aa0-bb7b-cc1c628ec89a", "value": 11660288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768409822, "uuid": "c0278992-4b2b-4f32-ba45-2a32b12e0d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409822, "uuid": "285ddaa1-0aeb-46de-8fdb-2cee01e493a6", "value": "ExtremeIinjectorv3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9cb152-f116-11f0-a129-42010a9c0007", "comment": "Malware payload (XorDDoS)", "timestamp": 1768374045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374045, "uuid": "fdceedae-95ed-40da-b854-e8c0bfb449b8", "comment": "Malware payload (XorDDoS)", "value": "45ca9df0b72780edd2fac699e0ff0cf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374045, "uuid": "d03816b2-2625-4279-bfd7-466725fa51c2", "comment": "Malware payload (XorDDoS)", "value": "11a193c69960b31d6835de4157001608179d8b4e0dc4f9199b50cf0f5bdb87b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374045, "uuid": "cb36552c-03d7-4189-a7ff-caa1a3a7110b", "comment": "Malware payload (XorDDoS)", "value": "5271a0f1ce5f76f4321059ff98b7d098daac2bb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374045, "uuid": "965f6d80-9278-486e-8aad-8c7ae0574cae", "comment": "Malware payload (XorDDoS)", "value": "dcf9b0c037ac8cd9c4e8c4ee8c13a6bfe8512829007f489fadd7f0a1d41239a1ef93cf1aaad23c175c26515bc18e9d1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374045, "uuid": "67fc757d-e577-44f0-bb84-adfe9d50172c", "value": "T18FB45D56E243E1F7D82705B0134BF7BF4620A231D421CE86B7949E5AB9338F66A4D363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374045, "uuid": "658fa15d-9d06-401a-8b63-465b034d8def", "value": "12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzf66ySjQn36EoU:/fUywKQ7Fb1pNL/p5ffjQn36Eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768374045, "uuid": "ed801d4f-f849-48df-8bb4-0569086a262a", "value": 529654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768374045, "uuid": "2517892d-d41d-45f4-aa73-6cf4cf566344", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374045, "uuid": "0f0f84d2-b44f-40a1-9c37-b07c6dae3465", "value": "p.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9216ef-f173-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768413793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413793, "uuid": "9aa8123d-5602-4fc3-90da-d2b3569396a9", "comment": "Malware payload (AsyncRAT)", "value": "0db33c257d847bf64fa107aa79dd5e39", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413793, "uuid": "a10cfadf-dec7-4710-8790-5ec5a8c28c44", "comment": "Malware payload (AsyncRAT)", "value": "124be4ded50da810cbfd7abd3a393875639b64c7fc9103c14490800484a2b6c4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413793, "uuid": "22192e80-1574-42ff-9341-488f214cfacf", "comment": "Malware payload (AsyncRAT)", "value": "36b73b0a2482532edf5e261639ea922257b795d5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413793, "uuid": "e23cbe2d-6868-4e43-a785-8af2199c5564", "comment": "Malware payload (AsyncRAT)", "value": "076d6a3521a0081738b7b23e6d5b982f4412c8ffea6f4b3f9c1bc75e853a36a5b4db2ecdafc99c7ce98d18363f78bd04", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413793, "uuid": "62f624e7-3e91-4ced-81f3-c4c2b5ff7a3d", "value": "T1B8232B003BE9C12BF2BE5FB89DF26145467AB1633603D64E1C8411DB5713BC68A52AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413793, "uuid": "68368703-0200-4cbd-86f0-de43f4effb4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413793, "uuid": "9381e485-4bd7-4e95-a5fd-ba94408f61d6", "value": "768:/uifh9Tg4xr5WUx9tDmo2qrF9YaPqf5OPI0zjbwgX3iiTrNdQ0PxBDZOnj:/uqh9Tg+L2qaa6303b3XSiToCPdGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768413793, "uuid": "54cc992d-adec-4404-acbb-a4fdbe918bd1", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768413793, "uuid": "eb5e68f6-a817-4177-9eec-1641135b111c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413793, "uuid": "93371594-60b3-474d-8fe5-66b9969977d6", "value": "NetworkSecurity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b0ee1b-f16c-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1768410826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410826, "uuid": "78bac71d-3aec-48aa-9af9-57881337a6d1", "comment": "Malware payload (N-able)", "value": "8e88d4cec1faac1495bf2b23240488a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410826, "uuid": "221beae8-4391-4a7f-9ec7-3eba091bc22b", "comment": "Malware payload (N-able)", "value": "1283bdb918a7f33e4150ef58cb73e47ca2024dd011e62e4350a71cfbfc5fe604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410826, "uuid": "20c590fe-363b-40c7-bc4a-4ec2c8bdb3bd", "comment": "Malware payload (N-able)", "value": "dcf502864c9d79ef76889bdf895c7b09c037cec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410826, "uuid": "9d9c5b36-a4fe-42cd-a92d-17661b1bb366", "comment": "Malware payload (N-able)", "value": "20730e58e9ea5a8f641070f7e10508bcac839970498bd2ddf5d1f969c887d62a2eade195a67673ba841f7b2766fa8fac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410826, "uuid": "db422d69-ec93-4143-bb7e-44191644db77", "value": "T19CE633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410826, "uuid": "2d880db8-da15-4289-8d69-7b6dfde9767c", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410826, "uuid": "b6ca6a15-5a15-4025-bb8a-0480a6206bb4", "value": "393216:u+F/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1O:rrRxvoC/7a0jUxX7h1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768410826, "uuid": "6517840a-eddc-4094-be58-418d37281d45", "value": 14782000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768410826, "uuid": "346ba423-3884-4e24-9efe-a1f40063aa15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410826, "uuid": "03db9a33-a2ab-4fc8-933c-803db36b9075", "value": "Folha de Cotacao.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207c1856-f173-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768413721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413721, "uuid": "b2a4ea76-f89f-4efb-aa0d-d479dd3e5be6", "comment": "Malware payload (AsyncRAT)", "value": "9fc64c104c16b6c61f8ab98366fc1bff", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413721, "uuid": "da3be9f5-662c-4f84-8b85-2f1ef69d262a", "comment": "Malware payload (AsyncRAT)", "value": "1411555fa5bf570adfe7209ff70da35099e2493f5100467d7fbbbf9830856647", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413721, "uuid": "f616a26e-134e-4011-bc8b-2eaffe6d5b9a", "comment": "Malware payload (AsyncRAT)", "value": "585fef3bf3ec2657a7e20092b99ebf9e73475fe2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413721, "uuid": "1e8653d5-6eac-46d1-965b-48ffeb17d2ec", "comment": "Malware payload (AsyncRAT)", "value": "993b0a32ade57fc522fc4bc2043b85345815a5dc281e3109524331232960ed092f96015ca9d8d6f0e3de1547380cb2f0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413721, "uuid": "f6aa9e98-e7e6-4822-8f95-05c35e14a54c", "value": "T1D2233B0037E9812BF2BE4F78A9F26145467AF2633603D64E1CC4519B5713FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413721, "uuid": "3439a098-ded8-40c3-831b-6c0f66180311", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413721, "uuid": "0f225c58-f3e4-483e-899e-5368c0de69b2", "value": "768:Hu4y9TskvpDWUPlNxmo2qbHCQLOZtrfmQOPI7zjbFgW3i6KTLQU3g+g+BDZva:Hu4y9Tswb24wXT1373bCWS6KIU3g1QdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768413721, "uuid": "e8918b5d-dd4a-4424-b94e-2938b81d381c", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768413721, "uuid": "8383e8e4-3fc4-4740-9115-d3eb31dbea6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413721, "uuid": "81dbe34c-04aa-4440-81fc-413dea1ce415", "value": "AzureNetwork.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60580ba4-f16c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768410822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410822, "uuid": "4a65fd49-dc95-43c3-988b-454668bd42f9", "comment": "Malware payload", "value": "d5f9d8b7bd88dbab441f31aee1a57ab2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410822, "uuid": "17408346-08c7-4121-8b27-83a5e2609b64", "comment": "Malware payload", "value": "15f436290b8f24c62fc556771464f45068d8cf839d1c4683b0a3398e64384bc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410822, "uuid": "0943e7f4-b1b7-431f-be45-55468de966e8", "comment": "Malware payload", "value": "d5b59b04ba100f744beb0bd1c732222e3c93c1cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410822, "uuid": "9ccdffa1-010b-478e-88bd-0b0d013d16dd", "comment": "Malware payload", "value": "62b5673650a885e2bee26d3264dacc168fdb64e90979c7af17fcc9c70c1ab8d1b44810f10edee39196287bfa2cdc06b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410822, "uuid": "a0df1625-7ba0-4dfb-bbfc-1a780a8eac90", "value": "T1838423056A81A720DCA6BFBAC9DCC1C1D35928CD6093C60F787D562B36C67AACDC5C93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410822, "uuid": "f77f8d53-e7cb-4e3c-aad2-4ac405619448", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410822, "uuid": "ae4e6d6b-8de7-48d3-9323-a93b3fef7752", "value": "6144:iIFRl+3kMcFC3lly0PNzQIcGZ5YkhDOL6ERS0YSMpQM8wP16ot853OvEPpy+344:DXlMD3Dyqzv5YsEvh0H4ot8lwEpN35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768410822, "uuid": "c3562f68-61af-4d66-8583-557ee41d6ad6", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768410822, "uuid": "e90ca9ab-e43b-44d6-acbc-292ee27f31b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410822, "uuid": "7ca61c60-ec4f-4c4f-a4ce-bb749a7e5b4f", "value": "AdobeEnterprise.installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f711e179-f1a3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768434697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768434697, "uuid": "440129b6-87b6-4fb9-a8a5-ea5f9b749c66", "comment": "Malware payload", "value": "871fe1e88ab2e86a3356a8c033541cde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768434697, "uuid": "2c5913d6-f620-41ef-bc9e-db24879cd8be", "comment": "Malware payload", "value": "164421af114cb376d86e8c28d1b3749a3dbfa12328e928c22735930ff200aa28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768434697, "uuid": "ea4a2c3e-4e24-443f-bc84-814c01e5d1dd", "comment": "Malware payload", "value": "7fe1308c709f19ba39a572546461d1af840a7fc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768434697, "uuid": "9d50aee5-7227-4a8d-aa9f-7d3a5ad68ff8", "comment": "Malware payload", "value": "82d7e88713a647bb4282a1503424207b9f39b9f52ddcd540e217d07f3c586fa4a8828d9c7f3fe78004ea35f1c8c40985", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768434697, "uuid": "04b8159c-0c45-4c90-84a8-07bbc1a34562", "value": "T1DF873364FC6AF705F41859FC4FC66F0E68BE7A45B16C13CA49A03AA34BDAE1142F141E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768434697, "uuid": "a726b1c3-3bde-4aa0-90c4-dd0dd87dcb89", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768434697, "uuid": "d623cf8f-484d-406d-b1c1-87dcf68d48ed", "value": "786432:O1xR7OiT3SA+4DED1YxEFIVK7JfuyvrHML62RaxPsJUbmEm6pDtu95KCY:O1XyizRDE3IVKuyLxPsgmEm6pJu9wC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768434697, "uuid": "7a4468b8-68cc-47e0-939e-05471fc69cbf", "value": 38128536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768434697, "uuid": "da7d801f-fa5a-403f-83e7-29b3d47f1989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768434697, "uuid": "6f326b4b-5adc-4e76-99fb-acd371d970b3", "value": "windsurf-setup-8.0.582_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592c0cab-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418111, "uuid": "9b805368-7ea6-4226-a961-3901ccd24f4c", "comment": "Malware payload (Mirai)", "value": "e891d96c37b395196bab1430d453172e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418111, "uuid": "9713d3d3-5511-435a-85ac-fed9898905df", "comment": "Malware payload (Mirai)", "value": "16ab9ef817bc9ca02b1ed22b1b88018afab562a6a6d22bf35c767606d0e5d22b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418111, "uuid": "03529b25-0e07-461d-9671-74299b426e75", "comment": "Malware payload (Mirai)", "value": "765af7e2a050b1901ed322252418a5d5dc81bcfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418111, "uuid": "81260b5c-ba60-4fd1-831e-59594e070773", "comment": "Malware payload (Mirai)", "value": "997ab908581a29964b3036a724231282a51b50fcc532870f55831500f38212b897d37c67c0dcda041889620a7a6922e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418111, "uuid": "4936bec7-7f2c-4e08-91ab-63b85a5bc86e", "value": "T19433021C763A8190C9BAE1770DE572177186F6F5E09D068B3E4C18226813F333A2A1AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418111, "uuid": "17d658b3-fed0-4309-a2bc-3861eee99c96", "value": "1536:vmvIX0R4Qoxk7ichLD3hbpphD1NhpcS6UTR56NOrCKSrnouy8ryE:aIg4QI+n3hbppt1NYITmcrCNoutz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418111, "uuid": "1a90e38c-547a-4f73-9a78-68b2bcaf77b8", "value": 53868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418111, "uuid": "8ef42cc7-884e-4580-81f0-8a64d977810c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418111, "uuid": "b98881dd-27db-47e4-8f36-7c5ccf9552df", "value": "httpdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030a7df6-f117-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768374158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374158, "uuid": "b02086d8-d17f-4281-a3c1-054217c1e1c8", "comment": "Malware payload (Formbook)", "value": "aee4803f11bc0f523561fae84e2b1449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374158, "uuid": "faf1281d-7d96-47b7-aa70-d67867f46da8", "comment": "Malware payload (Formbook)", "value": "172c3076e5d6bfe9089a1e092d1286e77337bc3680db32539e3a7bf69b7d0560", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374158, "uuid": "646da505-fb9b-498f-b080-85d3ee51cc73", "comment": "Malware payload (Formbook)", "value": "c86648a79951efbfcd8074a79cde863cde0e4c6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374158, "uuid": "8e8d298b-5ae4-4c1d-851b-0c4e697276d1", "comment": "Malware payload (Formbook)", "value": "387423294babb32012989ee92dff109ebf8c05385ff677620793139e589319f0690c82b51391507d66bf6d099ac5d1b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374158, "uuid": "4d7f5381-979e-4fe7-986e-5c7f2cb42459", "value": "T1A535122FBA537E12CC5C0E7BD123545882F58463E712F39A46CD28F51DBBB848D8A693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374158, "uuid": "d53fe687-01a8-40fc-a098-9e336b704696", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374158, "uuid": "ce44efe4-63ae-4d9e-ba54-1fabb8d260c8", "value": "24576:1VtPpRtMjSqkH62Q7KJ8FbG7kMsvgCxG/SJlYiLv+:17pR2SjqiVSG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768374158, "uuid": "ba90764d-137b-4836-b6a4-b4fd85624f08", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768374158, "uuid": "e85590fa-d963-4897-99ba-8cdc58ccc76d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374158, "uuid": "e0f8022d-0eb8-4a1e-8815-905bdd7f0931", "value": "Purchase Order_#1009123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565d8fc2-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418107, "uuid": "91990148-b8bd-4221-a9cc-f564d0462b41", "comment": "Malware payload (Mirai)", "value": "d32ed74a9bcf237eeb1eafe556766fd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418107, "uuid": "1fd606be-e6fe-4e9a-8885-0d71f1e95bf3", "comment": "Malware payload (Mirai)", "value": "1a267160f248f1d9fe962667c6d2f15cfca276f8666e4f963b68e4bfe4179e2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418107, "uuid": "4d27ea45-5a08-4677-b15a-732d95d8f9d0", "comment": "Malware payload (Mirai)", "value": "3c3d4ca63985400a2fc27b4069ac95c9512b7c58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418107, "uuid": "93e734cf-9c39-4cfe-88a2-34f168677f73", "comment": "Malware payload (Mirai)", "value": "be932fd7d4a8e588d243022d97cf49d04f21e79b79e98f364afcee550ae9841a8a1bb43f35ee55ea7b3698bb8be1b947", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418107, "uuid": "680d77c5-c0f3-493e-bd60-679862b1672d", "value": "T117E37C22D960AEE8C6258874E0A5EE385B539E9681831FBE1E67C7714043DCCBE057F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418107, "uuid": "6474dfd4-703f-4270-aec1-9a4ec095b061", "value": "3072:BTNNIznee0PIq1uybXTamTisiucg6lY+mRW773f7d:BTj9myyUisi3gt+m87r7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418107, "uuid": "e768fa58-7be6-48c0-a953-a7a3e8ae39fb", "value": 150308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418107, "uuid": "328cebb6-ec90-424f-95aa-25f7208fb29f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418107, "uuid": "154dc9c6-76c2-487f-ae38-d3cfaa4668ca", "value": "migration", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cd8ecb-f118-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768374726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374726, "uuid": "95432162-b10f-44f5-ba15-61fc7cbc4716", "comment": "Malware payload (Mirai)", "value": "2970c8969a04ba8f4de2b60a84d7fa21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374726, "uuid": "c8f444e8-7f79-4afd-860e-de6477cc67d8", "comment": "Malware payload (Mirai)", "value": "1b4a795fd219f9e446dc40c87ec74b16f1d35d0357ce118195a5fbc6afe558e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374726, "uuid": "cf72db9c-57ee-4adb-a6c7-f5eb75ed0a02", "comment": "Malware payload (Mirai)", "value": "29ff036f33ca98223289c8ea31850e20d27366c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374726, "uuid": "5a96149b-cd19-4569-bce9-a82bae5060e5", "comment": "Malware payload (Mirai)", "value": "925da70f15e5fcb0dda7bcc15e3a58d674dba508bec2a1a30c8ce69a3060076899280000f2c3a6eacb5587b884e3836a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374726, "uuid": "afadbc35-d1de-4402-b5c9-b79b52839cd5", "value": "T1DFC44B59F8809FA1CAC52576F74D829C33174B79C3EBB20699145B343ADB86B0F3E642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374726, "uuid": "8467e059-1913-4b97-91e3-92412096a5e6", "value": "12288:tKhhKg0XMi9ItBiiSzDk+A6OIA9gpZ/mwQ:IXQ2tgiSzg+A7IA+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768374726, "uuid": "6cdf1c4f-424e-4f7e-8c57-f7925edc14ad", "value": 558364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768374726, "uuid": "42e35a5f-a9c1-4a05-81f2-d75fe522dc64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374726, "uuid": "ea766e59-20e4-402f-b209-fdf4e09a7e92", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd83086-f180-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768419273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768419273, "uuid": "8ba937e3-83b2-4ef1-a706-6347b9be699a", "comment": "Malware payload", "value": "d3cf42dbd05c4b313bf264ee9f8a3511", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768419273, "uuid": "0028f0e1-115b-4e26-b1a4-5652be715e03", "comment": "Malware payload", "value": "1ba7985a7e91bb3b769feca15f0b10446bd398e696b670986b87be42f6ec0fc4", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768419273, "uuid": "f83fa2f0-e613-4807-8486-f19c1cc08a67", "comment": "Malware payload", "value": "22f10054850ee070fc0c41d336394138e562c6b9", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768419273, "uuid": "acc1a80a-19b3-4215-9ca0-7820ced34051", "comment": "Malware payload", "value": "089861708ed063af4fdfad7e73c54f5786a95a65774935e5de13bd178a60f41ad7ef565596449fc5cb3d97ee5daabbe0", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768419273, "uuid": "692a5213-16ca-4374-a6b8-d8b08eb170dd", "value": "T12D074BE2ED50077AD69BA33ADCA2524A1230F145133514D7BAA417968C6BFC8173FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768419273, "uuid": "713af77e-5d1e-4533-b6ea-bbbef3a6df74", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768419273, "uuid": "f4a32c42-f64d-4560-a2bf-cf3bb2367bbd", "value": "49152:gZQ+GaiOn6VzxIh5lcWB39rDaW+iMaI6f2OLzIGOX3uuICw3D7jarEdufoRycyLz:gCy1h5eGbr/CB5df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768419273, "uuid": "d1e5a8ae-3128-4103-baf1-1d427a613ae1", "value": 16922240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768419273, "uuid": "6f3cbff1-1e65-4cc0-a5bd-da83c816a61b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768419273, "uuid": "5c8d8790-aeab-4161-8d8d-776759c2331c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cb37c0-f135-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768387236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768387236, "uuid": "4752baf0-92b4-4285-a2bd-0e5f0ed203c6", "comment": "Malware payload", "value": "bbe03bc19bbe029915820dc581394967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768387236, "uuid": "ee7bedab-b41c-435c-908a-345e7960605b", "comment": "Malware payload", "value": "1bd48dfe1fc161809443d4ecbc7801ffd2ee55da1709f14194390981819013e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768387236, "uuid": "fd9a4332-7c28-47ca-ad79-14defeb581c9", "comment": "Malware payload", "value": "5841074068a9684dd0777b14f61569320558d441", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768387236, "uuid": "1d0d770c-6ff8-44da-942b-b195b3d46186", "comment": "Malware payload", "value": "7a188cb94f5ef9312614d35a2fa5f68c3a6689cee817d6a1989284782d10fc8141e888681717beceecb242740d25856c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768387236, "uuid": "d3ac1c9f-fce4-428b-9426-296e8727dbc2", "value": "T19B7733C9ABE8142FC8240073CCF6E77426202FAAAB77561A9F99719530DFD5ED5AC00D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768387236, "uuid": "bc005f06-f3db-4219-9ecb-cd63c4d31f59", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768387236, "uuid": "318f0bd3-96d9-402a-acbe-5f36c3c11abf", "value": "786432:sndETNQLqskf7BmvVgMopLl4UMzI2IIj2dQYgs7EOaZYn7sr:sdEpQLqsQB0o1OU+ucSPgyaYn7sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768387236, "uuid": "c305d264-86de-4df5-89eb-12083839942b", "value": 33541413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768387236, "uuid": "4350d3aa-5673-43c0-879a-f90a96546fa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768387236, "uuid": "137c9b42-f64f-484c-8106-4db19b9632cf", "value": "1bd48dfe1fc161809443d4ecbc7801ffd2ee55da1709f14194390981819013e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e63d46-f186-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768422084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768422084, "uuid": "ba8b33b9-24ab-4a4e-a053-bd81a156281d", "comment": "Malware payload (Mirai)", "value": "27ff49cc4ea2e495c7f7692d89bc12e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768422084, "uuid": "5dc8896e-9518-4bc3-979e-0e140ad23644", "comment": "Malware payload (Mirai)", "value": "1c5e17e3545fd2b0c65b4c4fc95377008b53df77238f1f3a2d0619151d2aaedf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768422084, "uuid": "403f41e3-b615-4c7b-badd-def7c3adcfa4", "comment": "Malware payload (Mirai)", "value": "021c32b5ee8a7d6ac174837dae1671118af2f735", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768422084, "uuid": "d97fc630-9030-4044-8720-b7cb690a2196", "comment": "Malware payload (Mirai)", "value": "fadb63217fe5e808cf2777b60d63501935d39d09693cab403459ff285c0bc9816ef4af2806a417f427dc91b5661d4221", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768422084, "uuid": "24d15e61-349a-4dc2-bf61-377f70ea6857", "value": "T181040905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768422084, "uuid": "842e3dba-63a8-4161-9685-79eab8b43e2b", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2woAKFLYV0fCtZ1SD39rsJzjM9fx49SY2l:t3nEr5dfHPq7UTo7FsvR9X0l6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768422084, "uuid": "6b5b04ca-00e2-4697-ada7-558355f31ab8", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768422084, "uuid": "3be376af-0a20-4379-a64c-8a4e235c679d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768422084, "uuid": "ca6bb800-e0e8-46b4-8bc0-7fc5aef2241a", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914b0c5d-f0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352922, "uuid": "0253cc89-2933-4373-866f-fe23b723a7e1", "comment": "Malware payload (Mirai)", "value": "7dfb6deb52fb18389e62015bcf4af24d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352922, "uuid": "c513a04a-197c-4437-bd36-7d7033c4cd38", "comment": "Malware payload (Mirai)", "value": "1d2bb74b8c6ef5c7615d279489799ade26d9f6ea17a2fed1d915846f1c140a80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352922, "uuid": "984b6e36-7c71-4069-a00a-8f5806c2f2b1", "comment": "Malware payload (Mirai)", "value": "5cc44547f8dd82e056ad18cf38f9679db1909ee8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352922, "uuid": "6cd9c12a-8ee7-467b-9cfc-cf9fc0bd598d", "comment": "Malware payload (Mirai)", "value": "d59bd0dc1a62e2f14e35e2b6248a33321cdd713600348da74760e65a5c628af86f432bb942874e3f7a49f1f1ea794a6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352922, "uuid": "70414ee0-3e62-4385-b270-51f027d30d6a", "value": "T154634A85BC919A12CAC552B6FB1E02CC372717A8D2DF7207CD265F2137CA92B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352922, "uuid": "254429b8-1179-4de5-b066-3e2e995d0c79", "value": "1536:m5rTFf4AKUKfKv5SeBY5CnmSWcLRHsDEEWI9jm7vfF:wVAAKvfUa5JSWcLRHwWUmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352922, "uuid": "80c057de-8a52-41c9-9700-8a6c6cd994f5", "value": 66956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352922, "uuid": "3f2f7fdd-f643-4742-9d90-ab5dc39c88bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352922, "uuid": "63851696-548b-4c41-a209-4d7f1743bf3e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd46ec7-f0f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1768359630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359630, "uuid": "9059ee2b-fb12-400d-9230-b5699764b70e", "comment": "Malware payload (Joker)", "value": "98b9d10493c391f2e48915c19b43d2db", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359630, "uuid": "a4c95225-31f7-4a08-9891-8e9829d7e81a", "comment": "Malware payload (Joker)", "value": "1e04d52ae714a4f0def9c961ab06cf6a1ce4020bef177231c8fe4c9a68ce8a22", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359630, "uuid": "eb325897-ed6a-4563-9cd5-0c1b74566272", "comment": "Malware payload (Joker)", "value": "e950cf87a3bebf8784a03644fdeff36f4699dbf5", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359630, "uuid": "a5d4d37a-5eb2-4701-813c-3273619da60c", "comment": "Malware payload (Joker)", "value": "e9aa5dd0393b69a3f643c1f694da3f20079abcd59222be04123b3d758e6ac061836dbb69c7724d3e5a6c38ba21708f88", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359630, "uuid": "9faaa40c-b010-444e-a05c-f16462b22d06", "value": "T1E2271206FB0CDD2FC8E3743499AB035161166C9EA65197979A11F128BFF76C88F1ABC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359630, "uuid": "d25589f4-e6a1-49ef-b622-ce9cde641bfb", "value": "393216:z6ss0u9be+8d+5b7BH55ViGBTffwkm6rDH1Jm4CnNlto+4/F1:z5svKwNN7ffwkm6ljqNDo+C3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768359630, "uuid": "d5b9535b-153d-4f9e-b27c-b2db01cfaccd", "value": 21515784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768359630, "uuid": "5eba5e25-fbc7-417e-afb2-1fd9c4f3eefd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359630, "uuid": "babae892-c9da-4d37-8262-03a4de61c43a", "value": "Cool+Clean_1.1.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4e93ab-f113-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768372778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372778, "uuid": "0b67bdb5-61b5-49d3-a837-0aafd56d21fd", "comment": "Malware payload (Mirai)", "value": "0a62767ec89f313a96c1ef8de418571d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372778, "uuid": "b2efa356-5658-4831-87b7-fc4a33817a26", "comment": "Malware payload (Mirai)", "value": "20a2c6aee19cae23f4bcd2a1995c3a05a22d7030ba76c2369af866468d9365f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372778, "uuid": "909d13d5-72d6-4643-89e7-e91be122b709", "comment": "Malware payload (Mirai)", "value": "63f51b1d0e216da245c882cd578a1619f2251e14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372778, "uuid": "e16d8ca9-73c9-4617-868b-b5880f8c9827", "comment": "Malware payload (Mirai)", "value": "4b0f2e120be1b1ea5a446fe551a53bed6cd938e48d679c0beb2ed1d1637d5f1dda56726ef6fd76d118e2390c9b28019b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372778, "uuid": "8bf1077e-d95e-4438-9396-73ee913e8adb", "value": "T199E3B51E6E718F7DF668C33487B74E31E75923E622E1C685D2ACD5011E6034EA81FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372778, "uuid": "227ea7e4-d039-4838-8d27-957af878e0f3", "value": "3072:23jaDlqDeQzNn1i3dSFA8AJ9EsqzZ73aLFJwuxPda3:23jaDlqDeQx1mS2Esqlq7wgFa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768372778, "uuid": "c02d40c9-cb1c-4bac-aeca-1f32a0d65a79", "value": 143372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768372778, "uuid": "67380b23-bd80-4e25-be10-b15d4fa44875", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372778, "uuid": "ab5808c9-4804-42e5-b11b-daf301aa88f2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6269e50a-f0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768358856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358856, "uuid": "8efd86c1-910d-4aa9-b865-16340d18ae2c", "comment": "Malware payload (Mirai)", "value": "b0ad9c5a766861e570b1324b55b98bb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358856, "uuid": "6b81e5e4-fa22-4bf7-aa72-5cdf745b5af6", "comment": "Malware payload (Mirai)", "value": "22482b7fbf6dab523956888b0844cd25b065921885c59aba052e967195d3e4c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358856, "uuid": "7e0c2ed0-01a0-41a0-bf6b-9eb77b5dbd5a", "comment": "Malware payload (Mirai)", "value": "3af49c4bbcb607314bdf3752db40ef5d186e0d2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358856, "uuid": "e3ac85c7-f0f9-4ade-bf81-56947c68bade", "comment": "Malware payload (Mirai)", "value": "59cb922e4b7b6b349148223d992ea738be0cc9f674529c648b4fa17579ad8bf424dda3cfcfee8ea63baefb1933ac8ad1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358856, "uuid": "c19954d7-33e8-4c96-8b37-44ce119480b9", "value": "T157C33912F98584FCC0CAC1340B6FB63AA935F1DD1238B2EB6BD4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358856, "uuid": "3f8b500d-e572-4bd2-80ba-76635a47975e", "value": "3072:iY83TgBMfVw+Z7cHIzO8SoMFAIRHp9hApD7bhLiFkazQBV8IattG/:in3TgBMfVw+Z7cHIzrSoMFAIRHp9hAJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768358856, "uuid": "9892723f-e826-4fdf-ba12-e0deabef77fa", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768358856, "uuid": "d7a82fb3-d6cc-4eb0-9eba-cf9407e1f3df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358856, "uuid": "baa7a6b0-e116-4ee6-890b-257434693761", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ace6fe4-f17a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768416718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768416718, "uuid": "0820fe23-cbff-4045-9170-4fa9954ad006", "comment": "Malware payload", "value": "2fcb902e47ebd00200de978c86cd5636", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768416718, "uuid": "78ffc608-4594-4c6e-90c0-5c7f7c7a85b1", "comment": "Malware payload", "value": "2673bc17ecf702204556a1cd048b88d81849c81f1b5005c780b2c3a83aa1a020", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768416718, "uuid": "83d994ef-fc1f-4c5e-ab9a-76e6e54420ab", "comment": "Malware payload", "value": "ea43643f6f8607959fb7c4f387e1182205bb237a", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768416718, "uuid": "0efd480d-db71-4f3b-89b4-4b645163445c", "comment": "Malware payload", "value": "bf21ea8a3d91a5c2324b2e1e5b45e2133e083ec109b13e9aa4b06c8309f43b8bba63df7da14f437235bd1f47553afcb8", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768416718, "uuid": "2b13e74e-e9d6-4121-a851-e02400e7290d", "value": "T11E279D7F22558136C12DC83AC1219A4CA4F3BB6CDF72E2E355215379DA62EC84D7AF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768416718, "uuid": "76537d42-f4c8-4931-ac7b-da1c5e2614a9", "value": "b57bea7b5421874a35f4643d58669085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768416718, "uuid": "b724f497-2004-4f9e-99ac-6720067f5923", "value": "196608:s5oeoCugrFEs40dEwgI2Dxpaxx77VHnV3d1QC5V1YPuiv2TuN5C:WoeoarF4YYxpa/7pHnV3LQaxu3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768416718, "uuid": "3259cec8-55ee-4cc2-9c88-c0e0300b7f30", "value": 21885952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768416718, "uuid": "7694cb04-bc8a-4c10-a789-b3495e032aad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768416718, "uuid": "1b8583ac-a709-4af6-9f69-7307a078d42c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561ec700-f0e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768354541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354541, "uuid": "2cf43ffa-6230-4f89-9965-b45706bca480", "comment": "Malware payload (Mirai)", "value": "f2efaaaf9c7616aef49a993ecb2024ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354541, "uuid": "38334d11-297d-4a07-b57f-32f84fe363e9", "comment": "Malware payload (Mirai)", "value": "27fe5bc4522c12b8bb62e916fcbc21de3e252621a06b1ca01c5ff04fb542cc9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354541, "uuid": "41b7723b-0e01-4233-b4d5-f4bfcceddabc", "comment": "Malware payload (Mirai)", "value": "751c32ff884bcaa7280786f2de5d1cae7dc30195", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354541, "uuid": "783475ba-e5aa-4379-b623-1fedd1c01de0", "comment": "Malware payload (Mirai)", "value": "0c98954dc81e9bc49bd4a555309700e60158d2022b917296e86abf2e3bfe4fc54df367353bdbb41dacf8967c8a5fab84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354541, "uuid": "35ab2a9c-e17f-4dcc-9835-712bcf75e9cf", "value": "T196231B47B9928E03C5C512BAFAAE014D33137B78D3EE7212D9206FA077464EB0D77916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354541, "uuid": "23663679-bef4-449e-9cab-cd2b34d7df86", "value": "1536:kWn1iMYuWPxzEEjU2uPrIdi2BUXwqTom:ndPyxzXjBUXwqTom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768354541, "uuid": "6a16cf4a-169f-431e-8cea-3499558c872e", "value": 50088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768354541, "uuid": "1b74c213-a084-4d8e-8e4f-5f0c7bfa74e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354541, "uuid": "893b8a27-1c2b-4f25-819e-434887bca47e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53912a32-f0ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768354966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354966, "uuid": "523cbb23-9c16-41e0-a28d-439a1f31c8fe", "comment": "Malware payload (Mirai)", "value": "d09d93936eb1577eee24ca5220caaf7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354966, "uuid": "55857a7b-5b41-45c8-971e-490341610a9a", "comment": "Malware payload (Mirai)", "value": "28e9a3fee5786f96a02170a4959f7250101feaed551e27b146cd5f27a6b70f2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354966, "uuid": "7bbf7a05-6fca-4ca4-9bba-21acc0650a7e", "comment": "Malware payload (Mirai)", "value": "8d8e16372a48378f05a0a6f93d6dec7526b618f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354966, "uuid": "fea90345-11dc-4388-9328-2fbd11063402", "comment": "Malware payload (Mirai)", "value": "848c292a52a3f910ab3c2c2ec0a4f29bbcb004f0ec30513920dfe58e06f4146f3727fd0ed3b234489b414e0c2fe57864", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354966, "uuid": "0ad8e92b-265a-4eef-9020-75a15e65f390", "value": "T18003C645B94B8AF6D40744B041E3F63F8A31EC394972C69EEF29BE75DB236C1A103259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354966, "uuid": "d82decb4-4e1e-41c8-a7be-d3a6b75ff66e", "value": "768:sMHQv22/Jb65IPTAv2Nt93s6l7ZUGDqobk6:sMHf2/UIPTAvgt9c6nUIqof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768354966, "uuid": "e15be623-6aba-47e1-a410-f700c6021003", "value": 39456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768354966, "uuid": "5286070f-a5af-4269-a765-64905d1836a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354966, "uuid": "17f049bf-a4a4-4c8f-86e4-e5e30af3d80c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d339cc63-f14f-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768398559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398559, "uuid": "cbd5f498-7216-4169-8e2e-1bad1467b397", "comment": "Malware payload (Formbook)", "value": "94051f3c56b78853370495cb845dc98d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398559, "uuid": "08bce6f1-faec-4b92-a58f-bc7d22a3c6d1", "comment": "Malware payload (Formbook)", "value": "2a15aa16bf0979e5d292bea28d2671ab1a3841ca326d4e7f023bb9d5df50ce56", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398559, "uuid": "0af06d44-0b11-4b94-aa69-1ac7619190f6", "comment": "Malware payload (Formbook)", "value": "2bfdbe1ccdc8e1c20c2328cb4951697c7d0a3527", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398559, "uuid": "42b0a91e-00d5-4cfd-859c-de3ba0a04ee1", "comment": "Malware payload (Formbook)", "value": "d79cb5467ce54d5ff94a9ff679a1888f8cf8089358dbac19e6f3b803b6e45ff8b329720a477bf81d3cf0ffd4be42b78f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398559, "uuid": "b0405680-29fc-4e06-a26c-494c94e79ab5", "value": "T1FA6394CD7FE6B671276160732D1FA09EF62E5C88790C8095E3A7A8D0F92C318E27565C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398559, "uuid": "a9bc0b24-73ce-4d87-8f58-b79a976e2dd9", "value": "1536:fSH13sjI0M94B+4ipYyri6r+jXGGoFQ9OXV8V4sq2ZxnmFe:c13WF+4ipYyrifwl2/m4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768398559, "uuid": "f110aee8-a3c8-4df0-8435-04709c864503", "value": 68732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768398559, "uuid": "8e227141-5ced-48af-8942-798230637408", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398559, "uuid": "682a9d6d-4d76-4fe0-a240-36333216ec8b", "value": "PO213203311.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ea85cb-f0ef-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768357386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768357386, "uuid": "7232a16d-7bf0-4efc-98db-a12852c184ec", "comment": "Malware payload (Mirai)", "value": "8e26a5a461ce698405b2ca8e79bf3f1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768357386, "uuid": "75f448ca-4b67-422d-8c4f-d0b47cbdd923", "comment": "Malware payload (Mirai)", "value": "2beaf13e5bc6678b22cf23407999b1bdee27ada1b5219bf6227279cd97c833ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768357386, "uuid": "70a0cc7b-36ce-4ac1-b90e-96638a4c3379", "comment": "Malware payload (Mirai)", "value": "6e6275a5a6e0781d90581db51c2a7cd392636b81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768357386, "uuid": "610d423a-1201-4913-89bc-413ee0b88d10", "comment": "Malware payload (Mirai)", "value": "69ab6870facd619c2a1658666a58ca872392515c31c1c8ddafd707fb65dd879d8f2eebee6bfe581f7133f997f0b6e99a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768357386, "uuid": "fcc5a591-ff50-4476-b4e3-d146d38afc5b", "value": "T15803E896B802DE3EF40BF6FE44A70D04B560BB5A4893072A77A7FDD39D321D51922E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768357386, "uuid": "528e07a9-cfa1-4951-b943-7c3f678c0d94", "value": "768:4W084iBBe1+t4jMc7y6krqcw2V57PDu4dA0r7AYql/v7lU82Oad:4H8Xq+t4jMc7y6kre2V5Da4Pr7AN/vCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768357386, "uuid": "2a7ba1a2-680a-44bd-8fde-3d6420adbef3", "value": 40440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768357386, "uuid": "92456096-60b5-41f7-b065-d1eb67412699", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768357386, "uuid": "b6ad81be-84a5-4065-baf0-5853755834e3", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae833bc-f167-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768408665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768408665, "uuid": "a5619962-d175-4b8c-8914-ea3bd3d0f8c2", "comment": "Malware payload", "value": "e6191a49c69a63130c32a67e7cb5b1a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768408665, "uuid": "b5f706ab-c0e0-4fd6-9fed-9c741797473e", "comment": "Malware payload", "value": "2c466d146630bc34ed98d11533fe0628a0c1a3a7790cc876d4a87231e93b577b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768408665, "uuid": "3e3ca099-99aa-4c15-bc9e-585a9dd3da15", "comment": "Malware payload", "value": "8819e5f9ae18bfc3edec316bcb7d24b49a724c33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768408665, "uuid": "78fb87a6-3743-425d-8d96-ea7d19a4facf", "comment": "Malware payload", "value": "b30f04700a68479ca6ccd303401e39bdabaca10b9c346017c0b87e68909e034d2dc5238c58a7abe243ff63cafefbd391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768408665, "uuid": "8106dfa3-fc2a-48d9-b930-fa58a5f22b0d", "value": "T13E855B86BC849076C6E9933589B60192BB30FC591F3237E32A4873B82E767D46F79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768408665, "uuid": "2a13fe03-38d6-4309-9825-b3e0479bda7a", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768408665, "uuid": "9858f40b-181c-48e3-b31f-4a8d9e447e58", "value": "49152:jVHOs1gLNKcrb/TnvO90d7HjmAFd4A64nsfJPvCUPnYgMqFmK1:hDWK1vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768408665, "uuid": "11f5fb23-4914-456f-8747-334d5cd8831b", "value": 1859072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768408665, "uuid": "b2c66b60-dd31-4c18-9312-d8d692e8eda6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768408665, "uuid": "9ae6e8a4-bed4-4bd4-8258-ef813532beaa", "value": "Qui-Consistent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e40e0e-f110-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768371443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371443, "uuid": "7302ade3-19b2-487d-9f25-c463e5d6415c", "comment": "Malware payload", "value": "71d0ab9c59ced73aac60be9e21d6b22e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371443, "uuid": "921a0a68-025a-44db-9d00-29c00de313ae", "comment": "Malware payload", "value": "2d1da768ed7b6ebc145b68b34370ce9bd31c35e864455a0214202c355a41483f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371443, "uuid": "1dc5779f-b8ea-40c9-bc3f-79a10030a8c5", "comment": "Malware payload", "value": "f31dbef88887bfeeb3ea476c9318b5fab4fff498", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371443, "uuid": "a468b258-5da6-4bc4-8b30-355236a7f609", "comment": "Malware payload", "value": "5b195d6dbd73d078c96116caff6be4df436d3495bbadead6c05619913d849e0103514cb52d44ea46bc7e4aabfc67739e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371443, "uuid": "b8003e97-1d76-480a-a38b-ec2e4fc240b2", "value": "T124554C57F27298E9C31FC130C7928777AA70F07602256D6E2E96D7316F24D609F2AA34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371443, "uuid": "fd7e679d-584d-4c3c-83f7-84483672b3b4", "value": "04219ec748756cb84c9ea9e770e666fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371443, "uuid": "64572b0d-23f5-48b3-a18b-559d714dc1b6", "value": "24576:BKdN+K0mRSiDboE40b8swWm/KG7RVLyc:BKdN+yDboE/3wWwLRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768371443, "uuid": "45d9af1b-351b-47c7-8a54-5e31c733a474", "value": 1285120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768371443, "uuid": "28cd1f5e-b174-41db-a923-810d44639d40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371443, "uuid": "a1ffce2e-f05d-4402-bc95-37a45a4c328c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c60737-f177-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768415478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768415478, "uuid": "d1247be4-4fb6-4e81-ba1c-76444263ebcd", "comment": "Malware payload", "value": "a7288e77942adf4bbb03900478f67b65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768415478, "uuid": "7e821b21-ab2c-4270-a3f0-8e4d04a7c2aa", "comment": "Malware payload", "value": "2da6bbe3aea374d7ca4f82e5fb8791ecf055a85b9de351eef05283fcf4e072d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768415478, "uuid": "0aeb9300-040b-4e5c-91c1-e73037e76d58", "comment": "Malware payload", "value": "a4aa96d677c27581d2cbccec379005d51be80b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768415478, "uuid": "3d03f93f-f442-4951-827f-75fc0c00ee80", "comment": "Malware payload", "value": "518a2c9d5c5a6a827c5ebd00642420ad4e0e1b9e4a3a9c2f627ef31dfa66c85c4b8ab39aad708853022dc15f53fada50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768415478, "uuid": "4bbcac8d-ca77-40cd-a3da-cde3001da911", "value": "T1EEF733487CD8FB13C01AF3366973668849E429F9052D66590D43CADCC963B609FACB7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768415478, "uuid": "e3c8a582-fda2-45a3-ad6a-d952793e2dcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768415478, "uuid": "6dd7d1ee-826c-494d-8f40-f701bddb2139", "value": "1572864:r0M2VZDB/5ics+V6UGNorEI6TjnJahLlUVhoFW/DI:gM2ftivvNQyyZUXos8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768415478, "uuid": "8b8c000e-278a-499c-a1ef-889d89af0032", "value": 71368192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768415478, "uuid": "03cc9a5e-15b1-47ae-a560-d281e12b88c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768415478, "uuid": "e2487ae2-c51a-4cbe-9b7a-104c5e4135a7", "value": "masonloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba74c4c-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418196, "uuid": "d15dd3e7-df9e-466e-820c-a6007babd515", "comment": "Malware payload (Mirai)", "value": "8fef9d535a725f2c7e32fe0b925411f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418196, "uuid": "1f05dae2-9ca0-4f4d-a236-a82ae32ad6d1", "comment": "Malware payload (Mirai)", "value": "2e2ce2bc4edaf06800ba836b7206231b4cc7d67d8e656df56b9aad251069d615", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418196, "uuid": "e9c6f8e5-a8fc-45a1-93a6-87c1303ce8c8", "comment": "Malware payload (Mirai)", "value": "c409c0d2afef3bac4efa272d264ad49565074016", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418196, "uuid": "890e8b20-6c0a-45f1-8221-bc8f3d717cb6", "comment": "Malware payload (Mirai)", "value": "9cd7e504b14eb49aa8d7ddc5c7625a1fcfbf0338916fb7771347fbc762d915538e30b650db288b0ca6cb472e5956d928", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418196, "uuid": "9aa43ebe-29fd-4278-8cd8-b125cd4bce1a", "value": "T17B040946F8C18B11D5C111BEFA1E518E33235BB8E2DE7212AD256F20778B9BB0F3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418196, "uuid": "8e67f215-77c4-4c57-9a7e-fdb3e6f90580", "value": "3072:FqJwTFZ1pBhRD7ZvzZQlDtq0sX7+JfEaoFkxC8mLbduZ:MJwTFZXtZlyDt8X7+J8aLmLbduZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418196, "uuid": "d498d9d3-9b3d-4736-88b9-821640068a41", "value": 180924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418196, "uuid": "e89ad3bf-1e07-4f44-a667-09bb94fb0ffe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418196, "uuid": "d621b8d6-9ab9-4251-a991-2ef9c0112fb5", "value": "systemd-timesyncd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b748446-f0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352456, "uuid": "0829e6cf-a2b2-46cf-afbf-523eba1ca1ad", "comment": "Malware payload (Mirai)", "value": "eae3f49535c26abaa6207540e537782f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352456, "uuid": "a248269a-2d13-41c9-9157-da3dad4b8342", "comment": "Malware payload (Mirai)", "value": "2e3e7be8d40ee0b3614553d271ae3570c91e28e1c92a4cc87cfad2d74916f8c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352456, "uuid": "ea13b509-8185-4a29-9c92-3edd7c1b792d", "comment": "Malware payload (Mirai)", "value": "0e91db773e0156d024f76ff1eeb39221c437429f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352456, "uuid": "84ffadac-1de2-45e0-8621-ee852ccbffab", "comment": "Malware payload (Mirai)", "value": "3a6adf9925c148080b7e16cd0facd25564311043dee3cba6d1a0b1a239c64d575c7b586be22ccb4e493634e6099df9bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352456, "uuid": "cd336d1b-1232-4cf8-aa98-c65e3cd78614", "value": "T14223960A2E12CFEDF759867447F34E20974C37A62AE1D185E15CEE405E6038D781FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352456, "uuid": "1e17da8a-4ff8-4909-8d18-7f691c4a0b04", "value": "768:yoD5a0IYnxUtpnR9Cr4A3GWTzb0hBh3p/0E26CJNWuJEXt1NuA:yyn+tpnnCNVPb0hD3pNkL+tjuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352456, "uuid": "5d3176d7-e89b-4979-b70a-f30b49514655", "value": 49600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352456, "uuid": "832b2e99-853f-4cec-b202-262e3f3813f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352456, "uuid": "6e3270cb-8b1f-4ab4-ad16-22301a3580ab", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d02139-f111-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1768371958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371958, "uuid": "9247cb75-c271-4d1f-bd73-5af9f7079904", "comment": "Malware payload (Sliver)", "value": "4d0043cc0298c697dcc0750dcb6e60f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371958, "uuid": "45f52124-6ce9-46da-9848-c5188b0337d7", "comment": "Malware payload (Sliver)", "value": "30038924ea6014377d6e6c0626620bb1c87bbe98eabd1664bb7e10be38580cc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371958, "uuid": "fd33501b-bd06-44da-a49e-08fba9eaf7fb", "comment": "Malware payload (Sliver)", "value": "29e69f15f2e99a70e0f1a0508389d4695a43b6c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371958, "uuid": "1c33843f-f622-4dcf-8f8b-0cccbea775da", "comment": "Malware payload (Sliver)", "value": "451b638c3aa6495e35e02e150a06b404fefd5385a78f63bd5288f2b751481ec718c156cb5177472f7118537c95b60af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371958, "uuid": "9b18ffb7-5beb-4c95-8825-3b253f6fb133", "value": "T12CC6335E024526B7C5DFFA7AE4709A073EEC674E00D8B261B92DA5CC13393B43A35E94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371958, "uuid": "7d26cfed-d3ab-474c-94fd-94c513425e80", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371958, "uuid": "91665f3f-6c51-4691-8a3b-2e09f5e5d79c", "value": "196608:2krJyn/YrRZ5LLG5JMZD20/dBWrhzn7Lcl1I/GNIVRXzcO4hA1NeRd+PQur:H9TG5GZD26venPclmfVOA1eE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768371958, "uuid": "a79fcbd8-499b-4b5f-93a0-7297d951f7eb", "value": 12367872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768371958, "uuid": "d9f76968-50d3-403f-85e6-be70acb4a796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371958, "uuid": "058d99d7-751f-449f-a82b-3f1f32da5b8b", "value": "SecuriteInfo.com.Win64.MalwareX-gen.15867681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7eb9b9a-f17b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768417411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417411, "uuid": "db002a09-2515-4cf9-96ed-e44b3b1e6821", "comment": "Malware payload (Mirai)", "value": "b728ad2b74090af369b27f75a127af3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417411, "uuid": "86bf1666-4252-423e-9bda-bde3b0fb8b2c", "comment": "Malware payload (Mirai)", "value": "3035c5c7d28ac1a2959651e48595129ed26f56171949a6da7b893b16bc44d900", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417411, "uuid": "eb3ac8c8-3432-41f9-a45c-a358af845877", "comment": "Malware payload (Mirai)", "value": "926474e8a6ab62042f17d57970647e68819b49f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417411, "uuid": "6ff9d9b8-4d3b-49ac-b12e-fe59fd455464", "comment": "Malware payload (Mirai)", "value": "ff1c3d24bc1dee201a666eed60e43d4eed75238d46d6ebcc5d91a446f7eb6a201badbbf59f031e1477a03d135557989a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768417411, "uuid": "01883366-8c0f-4af7-8a23-dac374841857", "value": "T1DF93E551BC82562BC6E423BAF6BE668D336577E4C2CF722BC8214B117B8551F0D63B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768417411, "uuid": "8eb14cef-056b-4543-a690-714ce8ff44a8", "value": "1536:pd+dGSq/lv/d7rMbIG4WetuLadxi0cbrT9KM5cZiw+bY4d:f+dY/lub6Y0WcZi9dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768417411, "uuid": "6e928631-d0cf-4103-8480-d53352b4420f", "value": 93792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768417411, "uuid": "fe118e95-41be-4ee7-9834-3b9989eb83ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768417411, "uuid": "544b555a-44eb-4ce3-9043-3d2d249e11d2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ab5f3a-f169-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768409760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409760, "uuid": "fb17f121-e68a-47cb-870b-add1771843fb", "comment": "Malware payload (SalatStealer)", "value": "fe8330f22b79021f2829e6733123945e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409760, "uuid": "65455e40-1426-4146-b52c-34dbf21bf51e", "comment": "Malware payload (SalatStealer)", "value": "310f0d458d8150953a6fc27fee276c9db0363f6ac230d0a27c24680560c0c114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409760, "uuid": "0c699fcd-9f72-4071-85c6-825d1b8255ca", "comment": "Malware payload (SalatStealer)", "value": "f04b73ccc090c0dd3d14a929f2d575effbd4914e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409760, "uuid": "5820257f-e585-4219-91aa-15d0507f797b", "comment": "Malware payload (SalatStealer)", "value": "b319c1aeb8b478ad2ea0f7059bdcc6916c758b6abdb7edcebe058ec415b611be0fac693c614543a68a99621d04a92c2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409760, "uuid": "b71ed726-e4ba-49a8-88fb-a37a35c420a8", "value": "T1253733E32EB9B389DF631FF3D655428BE808B9A81A951982F4D3DF5F8F603572412109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409760, "uuid": "9d0fba94-09a4-4336-8850-cd6d5cd5c63a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409760, "uuid": "0da6a926-fcfe-4c95-8250-235100ab0f10", "value": "393216:R3skUMm6eEs/q9pFgZDBAhMKl0lqLl+yDsJQfuv2/4yoyj6PYfxNzkO8kXFoXbzF:R3skbmF5uMZ1A6QLlbsJQc2wyH6PENwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768409760, "uuid": "5a1d52bd-9af2-4af7-98c8-116aa3639b6b", "value": 23716864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768409760, "uuid": "d655bd68-c053-47b2-aded-d125e5516b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409760, "uuid": "d22b24ab-4415-4806-893c-2545f22c0335", "value": "e1dfb60920.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec0b741-f140-11f0-a129-42010a9c0007", "comment": "Malware payload (BRAT)", "timestamp": 1768392082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392082, "uuid": "dd174d4f-e953-48f5-8a7a-804f31aa109a", "comment": "Malware payload (BRAT)", "value": "828f2b30f7d5a30df76e63b168ab9011", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392082, "uuid": "696d6171-a201-4227-8a1e-bfab81c7c89f", "comment": "Malware payload (BRAT)", "value": "3237cae549a7bb71a86b555f95bfee6661352437874b055e7712a815bd147dad", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392082, "uuid": "803ec3e6-6bf4-4ec7-acde-379768100b99", "comment": "Malware payload (BRAT)", "value": "1d46ab7937d4fdd7a780a4ccc33447049fb7a5eb", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392082, "uuid": "1b2c0554-b808-4f36-a6d1-122fbd7950b5", "comment": "Malware payload (BRAT)", "value": "833d919b4fe47dec8a2707c2df15ee371b13ceca7fe89781d9c1f9c4d487aa26daf20481b806aa1e4338871b973b25d0", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392082, "uuid": "13b1d4c0-2f3f-4115-8221-3dd99cf51bd5", "value": "T1B566C0CAD16B40D6CC067FF598142BC39F3056324A34046836ABBE595F739FA811EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392082, "uuid": "bb022352-7549-4fcc-ad42-b477366d21ad", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392082, "uuid": "ac0fba14-906a-43dd-8830-856a40c15426", "value": "24576:Vbc/+FoWbNkLG9F2kVEHHnNkqFrfNTEs0NFTGfFj/iMLMos7XssnYPgQoKM78LA+:oKovbNx4tDPbBcnPE2tr6o8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768392082, "uuid": "9d570f36-94a6-481c-8457-f66a8dd4df43", "value": 7059968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768392082, "uuid": "29e75fe7-db95-466f-9ec7-854341c68336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392082, "uuid": "2acb8688-38b7-44bb-92d7-1e2dbebe97ad", "value": "start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712a3869-f174-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768414286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768414286, "uuid": "174f3857-b536-4b64-8798-419419b24c23", "comment": "Malware payload", "value": "7c2b9a4bae9fdc7b0f7ab790c064c60b", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768414286, "uuid": "4e784475-a867-43c4-a1f7-aa2bf7655970", "comment": "Malware payload", "value": "32a5d357c7a44f567613ec2a47df7bdc5a78b89d8ebb364b568d0e30083a6e61", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768414286, "uuid": "9c6cfb61-48ed-4da7-a1ec-26de9bd43478", "comment": "Malware payload", "value": "a66ec9ce49a593b8ce8c74491a864bbf93561370", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768414286, "uuid": "f342bb07-78de-4d4f-b922-c78dd76a0e6a", "comment": "Malware payload", "value": "7e74c6f9972d166c9605f69ff647d6eeec28caa434629443cc2ddfe64840751f98f8b2078391f547230ca563aafacf41", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768414286, "uuid": "8341b4bb-c3b3-4cf2-ae34-f87963b2860d", "value": "T104C7334AAE6C3595FC2AE93DE6D41220D7B0010B5A73EBE26A2D31912CC37C557E532F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768414286, "uuid": "0207a6f2-7a03-423c-9e1d-6668dcace5a8", "value": "1572864:qYxdEx9dKgQt8OeMQhWWJo/DgFcdDpF2evfssq:qKdERKL5BQh9O/ca9pFxhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768414286, "uuid": "bb519129-a4be-42a3-bcf0-00765eb51006", "value": 53445262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768414286, "uuid": "2734417f-8502-4ed0-b903-852cce9b6e12", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768414286, "uuid": "7cc64827-722f-4e27-b038-fe15f9d65c18", "value": "auth", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a50e60-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418181, "uuid": "ee981662-8fd9-400f-a865-1775128b8c65", "comment": "Malware payload (Mirai)", "value": "0adf22bd024b73b9815b3695a29b056e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418181, "uuid": "0d73ac77-c6d7-4072-ac35-a7147c2c8299", "comment": "Malware payload (Mirai)", "value": "3413826d9a1b462e8569ad9ef37d312c488be8f7cab6f532104ca5b121ffc058", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418181, "uuid": "2a5e0153-5237-428a-a714-0f509e4a9754", "comment": "Malware payload (Mirai)", "value": "ecfdeee0c66852af45dbd7d5b4a4d58e199b423e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418181, "uuid": "286adbef-db3d-4868-add9-09e66e6499df", "comment": "Malware payload (Mirai)", "value": "ce7018ed6277c5c1c377755613102d85cf5d33b23e123898b3766d087f3bf1a7416db830fbce1714d92e0303b13dcb0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418181, "uuid": "7d65f239-70fb-4ae7-ab1e-7bc54e80cfc5", "value": "T1ABD33A8CFA8BC1F5E9074870A066F3FFCB31A4694176C65DDF88AF35CA279419216398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418181, "uuid": "ff95ab3b-9a17-4758-a25f-fd9b93c4350e", "value": "3072:FPQu526fJo0LgqAyq5ND/dtWr6JI95tVa:FPg6fJjLgqAlCPVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418181, "uuid": "87f53763-3f85-4ab7-910d-0492787281a2", "value": 135208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418181, "uuid": "5299aa66-44f1-47cd-9aa1-c320aba237e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418181, "uuid": "74209cf2-321d-4fb7-b90e-2644ad8c3b6d", "value": "httpdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e76d93-f0e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768351297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768351297, "uuid": "b60d0daa-5dd4-458f-a446-457673995ffc", "comment": "Malware payload (Mirai)", "value": "5d1677ed2cb79ef1f3cb5b9217583e6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768351297, "uuid": "f6ccb5b5-dbda-4ecf-828c-e2e4f344b9e7", "comment": "Malware payload (Mirai)", "value": "354bac86d50cf576c6d554b2aafd6f728e032821010ec59741c9f00ebf6a89ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768351297, "uuid": "7ebb5f3a-2add-4a86-b678-ccb6ade03e18", "comment": "Malware payload (Mirai)", "value": "0111410e2792f55a84115975a387c302f93c0490", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768351297, "uuid": "45023b3b-d4cc-4f20-a210-08802e447f08", "comment": "Malware payload (Mirai)", "value": "459346cd62a51cd5dabfc0dfbb2c7ddd1bb54b6eba3da21575e679b6e77de92703d8a24d236ebee69aeb1132e6e66798", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768351297, "uuid": "df1dbf63-12ec-4805-9ec2-47d26ce4ca82", "value": "T141F218639D2B9F95D14752F8AAB24E741B13FC1A9E270DFA6A25DDE14003CE8F5087B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768351297, "uuid": "82ab0ea0-70a8-4dac-987e-bb1dc5914567", "value": "768:Cz2PgUC85NNe5UFtBBwtYn0ojPoV6CJSk:Cz2oU9gWbBwtYjkV6CJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768351297, "uuid": "04edd684-3522-408f-a38e-7d4965fbbdea", "value": 35440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768351297, "uuid": "8826a182-d956-43f5-a099-5a12fd95abd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768351297, "uuid": "91b022d7-62b7-40fe-8c39-776f15c80ede", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33b7c04-f119-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1768375420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375420, "uuid": "800eaac5-1cc5-410b-a1d2-9832b09724ce", "comment": "Malware payload (Sliver)", "value": "3c730a01e7a5939a70658d3b3c5fac13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375420, "uuid": "ff2c9724-e2b6-4d5a-a088-acd1858aba23", "comment": "Malware payload (Sliver)", "value": "3633dddcaf46a323cbcad2d7dbc8e4a5a3405d0346eda8c916b1298d905fbbc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375420, "uuid": "c07b8eb4-d165-4ca2-ae27-dd3dffff6f39", "comment": "Malware payload (Sliver)", "value": "a111ce7562b46dc1fe5bf03b12282be0cbf96b7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375420, "uuid": "cc587382-f055-46a4-88bc-c321ca4618a2", "comment": "Malware payload (Sliver)", "value": "fbf812cb106c41726d75805e1f8de486299d6f5e822191246c9f25d75409954a4f091507a51e44d5e4f6d55803710239", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375420, "uuid": "61c2963f-0b52-4a5c-ae21-3d01040cd280", "value": "T1B1B633B825DC556BB993F33B80B0744A050C3D7E4E4CF0E355A6DA9D07BCAE9473A688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375420, "uuid": "05f28470-bd45-48af-aaf6-19a8f9fe78f2", "value": "196608:ZDnr7MF4q8tsZoAuVPcZkZAzH11eQ3ROYOJ6nJBGc5ErK+afd:ZDEbU0WZcZ/1T3ROYEggK+2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768375420, "uuid": "dc6538a9-b3b6-409b-a62c-7264d62a9146", "value": 11217856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768375420, "uuid": "d6b18bbb-d7ba-44f3-b1bf-a870b84c3960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375420, "uuid": "55a65490-c143-4317-8fbc-a5f6a50d705e", "value": "update", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed097e07-f169-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768409769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409769, "uuid": "922fb30f-b90b-4b05-8cbc-d0acfae14933", "comment": "Malware payload", "value": "e3827a2bc70fa7858fc31d83d3198be7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409769, "uuid": "01a5380e-875d-4841-a70e-04c11bcf5234", "comment": "Malware payload", "value": "378373a79980257a636fb8825f4a38b23e328481fa52f14faecef450b421fa4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409769, "uuid": "be48302b-49ab-463f-97f5-23d19f4e8b3c", "comment": "Malware payload", "value": "1cb58e28b7e2cd2d73293de8ce98693f99d4f330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409769, "uuid": "a318875b-b9e0-4ed7-bb78-770f85452e57", "comment": "Malware payload", "value": "b9749734b472b68c5e7fa209da3b304e88f27517940c855a99913d7f540125e6663d013af02facffadcfbffbb1b92ed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409769, "uuid": "7fb52983-54e6-4b1a-b92e-a93725fc3522", "value": "T1CE07336270C5D5E1C483657323D883B09DBF7D3121B08ED3A7B99ACC99153C0AE7AAE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409769, "uuid": "815a5b87-ae3c-4e65-b777-5f73b4a7d1e7", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409769, "uuid": "c8d2c4eb-b410-496b-92eb-2b61d44eb96b", "value": "393216:ncrJ7bGVqRjLjpFSSmN+7NfMe7lkRZZEgOLHIljNBp3m:caqRHSS2+l7WRaHQhBZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768409769, "uuid": "6eebab2b-e82b-4463-a58f-a52e46b9e748", "value": 17475482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768409769, "uuid": "785af4f2-d7ef-4526-b8fe-ff83b9720946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409769, "uuid": "6a4d058b-2416-49e1-ba2d-6b65c70b0d82", "value": "RustHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82abc5d4-f0de-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768349891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768349891, "uuid": "8ab065a6-232a-4d64-a496-c058cc453ab0", "comment": "Malware payload (Mirai)", "value": "bae2c10e169d23bd918c220984403476", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768349891, "uuid": "2a1d713c-f709-4856-a70c-88d02fcb8586", "comment": "Malware payload (Mirai)", "value": "37bc4aae0bd9393c08597d04af5e2f289a10c44fa8f0f08260e0e51fa6910dc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768349891, "uuid": "1107404f-c48a-4f75-b7a1-44146ad4e9ef", "comment": "Malware payload (Mirai)", "value": "1173038a4f20c00c1e059906991c4dd8cf20f408", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768349891, "uuid": "b3f02118-b6ed-4376-96de-fb27cc0c0f55", "comment": "Malware payload (Mirai)", "value": "c2b7f8f0202d88e33111ffa2f7226639109af7b06c6c03579fb1ec63d0e527eeaa03b0fa9f31de9c7f78fe1d5e4fd713", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768349891, "uuid": "3e95e931-e424-4f60-b325-b59ed2b4f8cc", "value": "T1D1D3C55E7E314F6DF3A8C23447B78F31975923D626E1C681E26CE5052EA034D681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768349891, "uuid": "0f821403-d38b-40e0-9989-3939942f6241", "value": "3072:jBauqtiqTN4T1bnac0x0cQErjnW+KnyLtSByodrL:jQh3iarLW+Kn+Gy2rL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768349891, "uuid": "1b635dbb-a15b-4a0d-bb33-d2cced7c7f45", "value": 137696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768349891, "uuid": "3fa27cc2-2ccc-4e46-835e-16e3f36f8d3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768349891, "uuid": "be478bec-008a-4df8-81a3-6f3067a9329d", "value": "mips.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7376bad4-f18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768425457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425457, "uuid": "4eb8d108-bb4c-4d0d-a5a4-94baa4cda9f9", "comment": "Malware payload (Mirai)", "value": "c3263776beeda0c90cfccd369fa05b42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425457, "uuid": "8baa2115-ca03-4dbe-8fe0-19eecbfffd53", "comment": "Malware payload (Mirai)", "value": "38fd1f25c6c6e4ed56340392ef7bc6e0060054de4571f4d14be130d3875ef2f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425457, "uuid": "00ab802e-a040-47b6-9319-b7406b725ec3", "comment": "Malware payload (Mirai)", "value": "ca601f53a356f0c5c6246ab5b96b565b21beeeff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425457, "uuid": "61b44fe5-47a8-4735-b14b-15b5db7078bd", "comment": "Malware payload (Mirai)", "value": "504bcc946b1e86bacf64eb05aa2b517026c2aaf67a41512a5a226a2015e6dfca8ead97d54e4bdf84868d75d880cbed6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425457, "uuid": "4a65c464-35c4-4eb6-b512-ff08b8f443e9", "value": "T1AEB34B03B7090F07D1272EF02E771BE1976BBDD22AA5E184750EFE8142719B16189FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425457, "uuid": "97de2470-ccf4-43f7-a7c5-97af6af8c035", "value": "1536:Ybme3AohIofZKfW2WNs/Egvy7lSoKjukVdfAwrTzVbv76xOy4TDYUEjbtj:qWeIcZyWC/TyKzNvOxOyHHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768425457, "uuid": "0ba3387f-767e-4d61-b30a-91f2c5adb254", "value": 117608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768425457, "uuid": "ae673f31-05fa-4868-8665-8dc2cbcf0dfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425457, "uuid": "aba0960b-535b-46a4-976b-c3baf95dd85d", "value": "2016Nwjppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8febd3-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418122, "uuid": "d721bd38-ada6-458a-889a-2c374fbb1bec", "comment": "Malware payload (Mirai)", "value": "f7e9aad038d368547a636290d62606fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418122, "uuid": "5e59467e-5bdd-4aef-bffb-4cc4d6300ac8", "comment": "Malware payload (Mirai)", "value": "39cd41e0e918c53ef478a55b4f1a8950825feabc6f0ae562fa7275d04e1cb828", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418122, "uuid": "42225f45-f647-44bb-8425-d989d1de501c", "comment": "Malware payload (Mirai)", "value": "e59eb0f2fbec4d591244b92d531a9c32d13bef63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418122, "uuid": "9d53bfd8-410d-4187-a111-be0226491f68", "comment": "Malware payload (Mirai)", "value": "a1fc10dc6b81bac67641813a24fb3fbb97b81e37f632c7e9c6b0b6fffe529f56b77e06c13ad145bce726684205589732", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418122, "uuid": "af48426e-860b-4205-8620-c7346281c862", "value": "T1675302A9F18E8D82CF2FCD704BB090A53CEADD9F3705CD611BE7AE2394154205B118EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418122, "uuid": "39db8722-e422-4f3f-9968-4c8a4233b477", "value": "1536:hEGi/hXpziWfvutauxJajEhzWDC/OdQlFH4u+qgw09+:heHiWfvrMajEhCDCmdQlZ4u+qgwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418122, "uuid": "e305a463-b877-446f-bf69-2fd7dcf21bac", "value": 61412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418122, "uuid": "5c43b5ae-27f9-4376-a68f-ab50a4734d4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418122, "uuid": "e27021c9-5931-4ff8-a448-9d3b28135f12", "value": "kworker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bac77b-f163-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768407155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407155, "uuid": "ae305fd0-3679-4f54-b20d-c06b8a4867ac", "comment": "Malware payload (ConnectWise)", "value": "32ef00303a9cab03fd1d1f5b28462683", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407155, "uuid": "f80fe962-06c3-43ae-b6ab-d6c3931c23c0", "comment": "Malware payload (ConnectWise)", "value": "3b4161e8a40a64f7b156b4ca8db6de0d66b3bb61b281db7b575d0208f3abce72", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407155, "uuid": "e0ff01a3-e3bf-437b-87ce-18a5f1bf01db", "comment": "Malware payload (ConnectWise)", "value": "8654723f9befea748a669ff60057f8537c3a4e0e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407155, "uuid": "5250dd41-5274-4bfd-82bf-f2d6ad91b78b", "comment": "Malware payload (ConnectWise)", "value": "b0cf8322016d666df9e95139b8d3daef9dbcb249118f2f9068c77500c1ec778a605db17f25b163fe7d11cb3f31d7df76", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407155, "uuid": "4fcd9126-a33f-4fcc-a732-758d6ce000fb", "value": "T111A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407155, "uuid": "578c2964-5f66-4bf9-8ea2-990f9bd6ace5", "value": "196608:yKaLNkbg1i4Q0KaLNkbgRKaLNkbgXKaLNkbg:EWg1iHqWg1WgvWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768407155, "uuid": "9925853f-6b03-453f-bd3c-289913f73337", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768407155, "uuid": "86895e58-a5f3-4618-ba7e-e079c32f8076", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407155, "uuid": "044c201c-66d6-471c-a8cd-e79035c14e8f", "value": "partyinvie.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd16e86a-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418279, "uuid": "4f1b389b-1c68-4b15-9f11-a4f502c3fe3b", "comment": "Malware payload (Mirai)", "value": "f87717aedb017b774056083ab2ee4e6c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418279, "uuid": "cdcc0b73-54a6-46fa-88f6-dcd6d4f8d583", "comment": "Malware payload (Mirai)", "value": "3cfe855904e7de53b26131ce9ba990333f0e19b36f85767164d0178f49f75fa8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418279, "uuid": "367fe3eb-008c-4d4d-8e99-c1b57f3b7be8", "comment": "Malware payload (Mirai)", "value": "4c2d7e495fa6d1f26e3f5f0527acf36f2db8b7a3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418279, "uuid": "77a07076-3703-4de0-9a48-c3423add8127", "comment": "Malware payload (Mirai)", "value": "c9378c24fea2d30780039b43c360d3b4ed6285e304a92c84967335b03b910fa1376375b9ae23811c996915709473ac95", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418279, "uuid": "6ee72c1b-0117-4919-869e-c5ab90d6908c", "value": "T1CE51E3C61111C7307DA6DAA3B3BA9608F1B8B086A5C7CF5CDCDE39F9D48CE087165A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418279, "uuid": "fa1f980d-137d-4e36-bf96-da5b2698855e", "value": "48:iJGW32JaaWJ+O5J2mNJbvfPTJbzUJ4P4oeJ4/zEJkNIJDf7J/UsJHdJa8JY7:iz321WL5lN1rmt1ZF+sLjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418279, "uuid": "5430e6f2-59b1-46ea-b96e-f36c56c25197", "value": 2772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418279, "uuid": "933e1335-ddc0-4a9b-a09d-1a3bbc87f887", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418279, "uuid": "de35a226-60e3-48b3-ae87-f00ba30b4838", "value": "shit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77831563-f0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352449, "uuid": "04d3279b-9e49-4703-b40b-2f4baa7526fb", "comment": "Malware payload (Mirai)", "value": "cd5d96faea4e3cc2d7b61cf96e27bbc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352449, "uuid": "c9cccabc-a6cb-4d3d-827b-ed1ab866d357", "comment": "Malware payload (Mirai)", "value": "3de2d9d0ff56920b832795c0fae341afe56ba2e23c769217b7712045c3e0bc6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352449, "uuid": "28487495-28a6-4e82-89dc-1d1443afbf03", "comment": "Malware payload (Mirai)", "value": "4f36a112531feb5bc841d89fabc7e0fdd4ab0368", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352449, "uuid": "0c629d54-2235-4b6a-9163-71283d770924", "comment": "Malware payload (Mirai)", "value": "444ce430d8e36c6581a6e283c123c642e2d999bdbf2cca0ec15de01da5bc83cc52ef7bca9e54c803abb9a0748553c36c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352449, "uuid": "6f6f1168-dee0-4c97-9ae6-270f2ffb0664", "value": "T111435BC5DA83D4F7FC5601B11133BB3B97B2E9390174DA42C798E537EC62A01AA1639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352449, "uuid": "3206e04f-e622-41a7-9d0a-e33408cccc79", "value": "1536:YuRDiyrknO/l1oNMPBmc1x88wF4KJhW/COFUrrKi:YuRwCl1OMPEc1x5g46hW6oUqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352449, "uuid": "dbc1107b-6baa-4ed3-adfa-1760a9ad9677", "value": 58544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352449, "uuid": "e353978d-ad54-4da0-bfd2-50279f991697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352449, "uuid": "c71ce404-fc87-40f3-aae4-bd0747dc16ed", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6920b148-f0ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768355861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768355861, "uuid": "d0cde0c2-9b28-4741-a5d6-a2b6c2b4a039", "comment": "Malware payload (Mirai)", "value": "ae50146ba662a992022d790387771d7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768355861, "uuid": "6c29abf4-76c0-4954-8114-ef389fa54778", "comment": "Malware payload (Mirai)", "value": "3e96982bfb873576513d8fa107ca433003b86c8cf901120f20237cf38cf485e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768355861, "uuid": "8c480497-e8ff-4450-858f-17d3b1737843", "comment": "Malware payload (Mirai)", "value": "7bc3fbfe3bd5207e4aaa00c9c4e8a87622255e51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768355861, "uuid": "a8ae6833-bcb4-4f34-805d-803f54498539", "comment": "Malware payload (Mirai)", "value": "f1034f6da86bd415889eac24a8927137326dd5028525f37a73332761ed96f35ff7d97e74013d8d0d9d8ddf436dd53537", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768355861, "uuid": "f0a698f4-b87c-416c-81fb-3ddbfc82b24a", "value": "T1DB03E603361D4F17C4536AF4267F0AA087BABD6228F4B5C4B42EAEC58635EF62041F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768355861, "uuid": "235963f0-1059-44a1-a703-cf7c8313a751", "value": "768:qnf0l2DxbPvKdx/R/leHnWuQ98qkJp/S6G+AHxB:qf01xyWJ9RkJp/S6Gj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768355861, "uuid": "4157a6d5-fd95-47e2-977d-9d3d6cf51934", "value": 37768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768355861, "uuid": "547eb359-4b3a-49e8-b75c-dc6211ed09bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768355861, "uuid": "da73ad6e-3c36-440a-8e63-adbae4caa7e8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50bf59e-f116-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768374135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374135, "uuid": "e9278dae-bc37-4295-b2b8-f58c951f3feb", "comment": "Malware payload (RemcosRAT)", "value": "b74ef70920a9c1ce39b938fa795878ad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374135, "uuid": "f5eb3951-0a4e-4c51-8624-caa88ef08b2c", "comment": "Malware payload (RemcosRAT)", "value": "3f65823efbd33390ac15d25e08c1ddd0eb064de8e35a7d8bf07035910c6846c8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374135, "uuid": "8340b5f3-f935-41fe-bbaf-87d841e3524f", "comment": "Malware payload (RemcosRAT)", "value": "f05d8cd36e04a3d83b2f82188fdfe84eda038166", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374135, "uuid": "69a80b11-8fdd-4d3e-86fa-18f05b085262", "comment": "Malware payload (RemcosRAT)", "value": "aec0f06f4c767b79556ec6d1933d46c3715ef5501b0b4c11283ea4d15f24b86a8b7e464096effb552ac4cb2a9ceb9a40", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374135, "uuid": "c07aed73-ba89-4e9c-9ac9-f90dcf077694", "value": "T160564B58FF2491707F9B4F5E29F658D0AD1931E264D5C334B02D6EA23931CCAEB606B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374135, "uuid": "12f5555f-f9f4-4ad4-88e1-5fe070f6c157", "value": "98304:pZVuEZKueP39o3LWdh0YoRtiYgDvdawLs7Kt94S0Rahi36tfd8Z4aXftY8rkEO3h:HVkPFb0YojKEr2t94ditfDaX+EK9maYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768374135, "uuid": "c78eb95d-8af2-4ad6-91cf-67eb0de162e2", "value": 6143885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768374135, "uuid": "cf96d95d-89ca-4dfb-a3d0-394654bde158", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374135, "uuid": "b062c59b-5afd-4a51-811e-16a44e703f35", "value": "RE PO.NO.4500145559 & PO.NO.4500146597.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0a1335-f162-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768406711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406711, "uuid": "7515ef21-fc58-43fb-a5fc-806c3b9ed8b4", "comment": "Malware payload (SalatStealer)", "value": "3acd9536d1a9225a91aed9b0b2df47cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406711, "uuid": "538e2f89-5ca3-4c58-8ef8-17ace1ec8812", "comment": "Malware payload (SalatStealer)", "value": "40f4875737d25ee360e70137fb77a4fd1bea9afa959fa94d1174a1a4504d273d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406711, "uuid": "e2667eeb-072a-404b-b828-d1ca6059f750", "comment": "Malware payload (SalatStealer)", "value": "956f365a71286c2bfd38c538e5131ce4a04523e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406711, "uuid": "1b291a49-6009-4efc-ba77-34f778df9153", "comment": "Malware payload (SalatStealer)", "value": "b7c580d015791061b8e121318879ff1890a102d9b0e71ba6c0cfcc12fcdab5367f853057b49a2213613e9e91ee59fc11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406711, "uuid": "a223f834-9935-4b9a-b11e-19e37d51334a", "value": "T149E5335EA4637439FF4F63B73399C72A409004329B9CCF992FDA7E618E517822C3A951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406711, "uuid": "b9343746-5420-45c0-9c7b-5630f9afe932", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406711, "uuid": "7bd31975-77f5-487b-ac56-cdde37a3c575", "value": "49152:4J70laYh/L1lRvfM/zawYmId6rH0rpTvg8Yk1tGwCfmeE43mwcVHj7ggyxXCENvd:4Jeh/L1oLawZIZVTJmrmGRAjUrNCEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768406711, "uuid": "027133c1-dd80-4b3f-9c5d-1ea9e89c020c", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768406711, "uuid": "29e7791b-0522-48a9-baf4-d31215e6db80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406711, "uuid": "428b838f-a301-408a-b35f-0b0c4bd02888", "value": "0x001900000002b30a-31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a2bc5f-f16c-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1768410831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410831, "uuid": "a9998e72-a788-4ad5-98df-1b42e5309998", "comment": "Malware payload (N-able)", "value": "0da481e776f589505583563e395ffd0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410831, "uuid": "a98e1202-5b0a-4a8d-bcae-d7a5345c0abe", "comment": "Malware payload (N-able)", "value": "44c3796d72e2ee0273b6e463da9f78ada6928837d73b4a7af028bb2e3383949d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410831, "uuid": "1d55f3c9-dcd3-43a8-9e19-7c96c0b8c33d", "comment": "Malware payload (N-able)", "value": "18ac7b8de43a8458307e033765b6c8937e95a213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410831, "uuid": "70ab3af0-370d-4e76-a7c6-ee682a25ace3", "comment": "Malware payload (N-able)", "value": "4e2807846746073c336ea6c4fd973ba78997fdb54e62186cbb406da4478abf239d02016d338b0bb19af8f407a323e93f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410831, "uuid": "99994ccf-54ea-4301-9c86-1b13d36da652", "value": "T1DEE633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410831, "uuid": "10c37552-80aa-420f-a12b-84dd01069558", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410831, "uuid": "d468f0ae-a888-42e5-ae2c-5494dad1208a", "value": "393216:01F/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1k:krRxvoC/7a0jUxX7h1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768410831, "uuid": "e60beba2-32ec-466d-994a-56ab57d575ac", "value": 14781992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768410831, "uuid": "7d5b38e1-3164-424f-ac62-83fdf402eade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410831, "uuid": "673df5ad-2141-46d6-9e7f-a0c34646bae5", "value": "Or\u00e7amento02.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23522450-f148-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1768395258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768395258, "uuid": "b86e01da-7dc4-40da-b0b1-20149be47a1a", "comment": "Malware payload (QuasarRAT)", "value": "c53c130822639392810531249fad76bb", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768395258, "uuid": "15468178-c90a-487b-96f7-c296ead9db92", "comment": "Malware payload (QuasarRAT)", "value": "4775be5e37b615fddfe7cb40f78b3fd395bc2d299132f9645da1fecea53e9acb", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768395258, "uuid": "1e867568-efd2-4011-8b82-72b778795c1e", "comment": "Malware payload (QuasarRAT)", "value": "14588032fac1f4c154d2250b26af64dfa0f4ab61", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768395258, "uuid": "c0b192a1-6cc3-48ae-b5c3-69726eaf8ade", "comment": "Malware payload (QuasarRAT)", "value": "9698a535df446ecaf96bee60b24d875b26b40b88a53a5066e3a4c4dda29d29c2f5d71fa394f69995504ace3791d4e086", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768395258, "uuid": "1a16c1bd-d0e3-41e3-aca4-305126415ead", "value": "T178E733544FD1BE7BA515F67B98DE23211C334399CB2058BA39B8981673871F86C2F09E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768395258, "uuid": "5c40ef72-1501-4b40-9a74-f3798844dcb6", "value": "1572864:hSY+UrHy3+E5AYm542g1wERWKbkLUXMSqaf+OG3J:hSf53Al54287LcSptKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768395258, "uuid": "b2365f99-6f95-4a6b-8020-78979b807f14", "value": 69010211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768395258, "uuid": "701eff5f-c856-448c-aedb-8923d2e8fea4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768395258, "uuid": "f10229dc-af73-4c3e-affd-b6badf6fd76a", "value": "ravexcoin-qt-win64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2fbec7d-f12f-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1768384842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768384842, "uuid": "fac1d4bc-7a3d-43fe-95e3-aa51439e3375", "comment": "Malware payload (PureLogsStealer)", "value": "4acaa5c61f54ab32e7b9ed8151e2f862", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768384842, "uuid": "6347cda4-a546-40d3-a2f3-84f66f39d881", "comment": "Malware payload (PureLogsStealer)", "value": "4874129d7ddd57a2e2382bbec05536947ae90e6cc27906be63e1b740e424d571", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768384842, "uuid": "8c0d2fe0-0354-42c0-ac26-6fe6901c215e", "comment": "Malware payload (PureLogsStealer)", "value": "4065a21622cb69ca40d976e9b779cde5904cb3f1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768384842, "uuid": "e9d7ff1d-162f-457a-b963-c6cb5718c081", "comment": "Malware payload (PureLogsStealer)", "value": "8890ad126ec54160da2d09d15a066165d270c72d6eee696536512cf63491ac266acd6a7b837c41ecf88d8a1f9d0a76f7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768384842, "uuid": "25605fb1-4caa-41f8-9e2a-4e9d7ca28617", "value": "T186D58240858E69C04D77396D922DA5EBEE0059FFFD5E580F782E89C5CE30B488D8AC76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768384842, "uuid": "95c3c211-4f8b-4228-b7e0-74e55f0ed2ce", "value": "96:vlFgjKXjSb1mQ9bmZfPQftkQlN4lZ3GnAhxhiDNkoYVmsz5/Yndmch4ch3eXRDMe:NOB8w1NaE2vqmLEGNC4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768384842, "uuid": "ed982b85-2ae7-457f-b2ea-693468197b17", "value": 2887398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768384842, "uuid": "85fccb56-c848-4675-8077-5bdf96c5a380", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768384842, "uuid": "e9a12b42-775a-43ac-90e5-45be79eb7bd9", "value": "Invoice_DocuSign-161963.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a40d0a-f0eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768355271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768355271, "uuid": "086cf669-8ed4-45df-b5cb-438d0224d036", "comment": "Malware payload (Mirai)", "value": "ff4abb1ee1801ad5b9e23ccdca7ef671", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768355271, "uuid": "f18cef6d-a1b8-4996-bb40-e12e3cc2d5a8", "comment": "Malware payload (Mirai)", "value": "491dc178d7e42e3ffd98a9977664b9a79be08dbefc9efe4531311a432d9eb70e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768355271, "uuid": "913e1b0e-b853-415c-a90a-26107e61647f", "comment": "Malware payload (Mirai)", "value": "c393581b5d089cf4d7f00d5b58f4f49e86815ac4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768355271, "uuid": "d3164d9f-2be6-4584-9c1c-31a9efe7c676", "comment": "Malware payload (Mirai)", "value": "b1f7c3d70efc9a72089faa7aa7653b5e31d340b01f523210359dd171d660877fb69f078613186de32494379c362a3048", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768355271, "uuid": "e2f2357e-1d22-4886-b428-4dec238659d8", "value": "T14EE34B55B8828A22C9D513BEF92D018E331327A8E2DF7213DD105F2577C7A6B0DB7A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768355271, "uuid": "12e11aa5-98f8-439f-82af-68458a8e1c89", "value": "3072:ENcMOvrpToDzK7rMeQzlue1k6aU9zL6EiueCo2km:AOhoDzKnMereS6a4Iueckm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768355271, "uuid": "19251d9a-6e55-4c83-afa3-90fd0fd9aa65", "value": 145536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768355271, "uuid": "009aad39-e6d8-4d57-8e58-67859b7ff177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768355271, "uuid": "c53b5b3d-fa13-46b9-a810-31030fab7bab", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c9fc94-f164-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768407454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407454, "uuid": "2ca49a08-b050-4574-af8a-18572cd83647", "comment": "Malware payload (SalatStealer)", "value": "05dd1739d128bf3a22083c26a176d2e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407454, "uuid": "3fb953d0-9368-4d55-bd6e-d5639ca097bb", "comment": "Malware payload (SalatStealer)", "value": "4a4c88ec711e46f3cd8ede539bf5366514c82e076dd52f58248a75adb5c6e144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407454, "uuid": "ee9b6494-f577-4530-9662-f005c530a665", "comment": "Malware payload (SalatStealer)", "value": "91a3594d76e092eb35ca68cdba3ac5a812821e0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407454, "uuid": "e73a88a0-2942-41cc-ba66-b6ae9aafa9be", "comment": "Malware payload (SalatStealer)", "value": "60c95c6ef29373e52138389e37b214f7fad83b5dadaac060a568a4cc048f5309bd3355efcb2abfcdfd85755939306959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407454, "uuid": "fa17b3b8-e616-41ef-9131-4c18342fcb03", "value": "T146E5335933A00ADEC61BCFF3E118DA13A0B76571B3665B73B3D4E14A9B001E15E9CAB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407454, "uuid": "19bd6257-ad78-4622-ab9f-40e6ddefd43e", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407454, "uuid": "9d471bf6-528d-45e0-8dcb-c3952d2cfc1a", "value": "98304:mWDj2gP6RExqDr2nXx5FvEsjiEA3/UcXw2aOW:r+J2qD6hLvN/AsWSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768407454, "uuid": "1aa5598e-5389-435e-92c5-b25d611b3660", "value": 3292160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768407454, "uuid": "9f7e0878-0221-48b1-a677-e340114cc324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407454, "uuid": "5011c45e-347f-4545-8b8c-fbef15e85bef", "value": "0x0008000000024346-139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a75e596-f111-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768371620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371620, "uuid": "619b8227-37d4-434a-af40-e5ef17804b4f", "comment": "Malware payload (AsyncRAT)", "value": "da7b3c55753863efdeda68434162f25e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371620, "uuid": "f328bc49-4002-43bf-b001-c49f0a48d465", "comment": "Malware payload (AsyncRAT)", "value": "4abde89dcac86c0f5a4f106dc9e98bd8140b7d196f154ef8901983c7ce4410a3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371620, "uuid": "28a25872-137c-4184-be71-fe042c34d41e", "comment": "Malware payload (AsyncRAT)", "value": "9d4e05d58f5278e644b5b0da7f6df231cbcc06f6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371620, "uuid": "8226cf97-5207-4f28-ad9d-cf290c48ba4c", "comment": "Malware payload (AsyncRAT)", "value": "20e78829bf54b6da83fd9822a43a95c56388be0941c706506814b909e6809d4352ea48ef914e679e79ad9be6b0caec65", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371620, "uuid": "02f593bf-48c1-4128-8cdd-3aa31ec47537", "value": "T12CC21A0473F48261D1ED4BBE48339200D375E68B5D13DB9F5EC495AD2A33BC98A25BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371620, "uuid": "7c3805bc-4a2e-4c7b-a4d3-167154062557", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371620, "uuid": "8f090f5f-2ebb-4520-a10c-9893c6c5d4e8", "value": "384:ou048twEHJ5zgeHQQkFMMymrJhxpHqqbuUsJQxnCJf+BWfXWh/mu+:oF4ZqJ5EJQkiMyCJhxJFbHBFBwu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768371620, "uuid": "2b5669b9-bd23-4e48-8ea5-4aeb11f60b6d", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768371620, "uuid": "e618f1aa-baeb-47c2-a924-7d3fb70def9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371620, "uuid": "201ccc44-ad5d-4881-a5ba-c7f1d734ad74", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db42b033-f120-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768378386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768378386, "uuid": "c694d931-88fe-457c-8fbb-58d17a878ceb", "comment": "Malware payload", "value": "d8888d8152ee5b75c0b53ac02048ad1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768378386, "uuid": "7ff5d062-a64e-4ddc-80bd-4ce9ae8ba0cf", "comment": "Malware payload", "value": "4b2239d31278b71aa14d865f8f5665a6943955aa5635d5c0a844ea9e6950b269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768378386, "uuid": "2cc21b1f-b982-4f2e-9245-c439cc96b335", "comment": "Malware payload", "value": "284872b4201de9df8686684b471d78beb54a6645", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768378386, "uuid": "45ce6cce-8b2e-450c-ac8a-bf8c4109055d", "comment": "Malware payload", "value": "2dc7baa9e8c57681a458b083cc4540ec200797c677c1ae5103f35813b161901d30584b6daa732b4bd9cdc877cc263723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768378386, "uuid": "e86334d0-e21d-41f4-b309-d554c9a8a7d4", "value": "T13C23086C336709B7C122C977C2C219A6F65CB60847328ABF1393432ADE45DB4BA75E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768378386, "uuid": "14ddaa3e-1d5f-4592-8423-4219b8b73f58", "value": "6d88df9019f9dc608892f3e5f30ffbbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768378386, "uuid": "74fb789f-765a-425a-9308-b45e64397dd7", "value": "768:vOJW42lNVlNu4uQ4szWE51vQxm4o1sOSUX3vCZHaoxyB1bQ8iicEFf33vLMtQ1l:MW40NVXh4+qm1NiZToQfinFfHDMCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768378386, "uuid": "9b7f79d6-eadd-421f-b2f3-b2e81168a02e", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768378386, "uuid": "d482e5f4-5e4d-4569-a973-3bc523e4741b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768378386, "uuid": "09713cd2-23e5-4841-9524-57042856d965", "value": "profapi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de60264-f150-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768398792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398792, "uuid": "286ac2ef-38d5-4b80-89d9-7b1710918d6d", "comment": "Malware payload", "value": "7c2387e3860c685086be44c6acb9e621", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398792, "uuid": "c8c7fa54-ae1f-4612-bbc4-c4198829f931", "comment": "Malware payload", "value": "4c8d73003514cbc68154a98fe8700bd7a248d6b655bef29516c547c6e86ebadf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398792, "uuid": "fff2ce32-774d-43b3-a16f-b148c599598d", "comment": "Malware payload", "value": "7161ff7e23962c6bc0a1440a82f41a172e349005", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398792, "uuid": "756a0fc1-a19e-4544-9a8f-9982cc358dac", "comment": "Malware payload", "value": "365fc0a75d47b1725cd5ebb687910d755f44648c14bf6b40312a95f516c826005082cdd7af51f47d47d9a62c590dd444", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398792, "uuid": "d90ba496-e5fd-4dfd-b72a-bfa4e2c7dbef", "value": "T162460787B9924943C4E4367BB9BE81C433631EBA9B8752576D15FE383ABE1D90E34304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398792, "uuid": "8fe0641d-bedb-44f4-9d3f-22a354f38ec4", "value": "49152:5OPPRNvKF4Pbh46zORHkU/BNo0R/bJlN8dfyNDCABOvIGiKK5EI:5OPPRNvvPbh4LKmt7NayGvIG2EI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768398792, "uuid": "9aa29389-3ba4-4a9f-9e2f-2d1f277d1cc3", "value": 5767352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768398792, "uuid": "ebe81458-aff8-422c-87e0-703ea762f296", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398792, "uuid": "bf2c3ca7-56bb-488d-9d78-79c825372a79", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92f8f35-f15a-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1768403347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768403347, "uuid": "ed6412b3-6a8b-4cae-b301-d256884a5f3d", "comment": "Malware payload (Gh0stRAT)", "value": "58f0763a955ca7e0e4e5f2ed368299a0", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768403347, "uuid": "8638d402-7dc8-4082-82f2-7fed97862219", "comment": "Malware payload (Gh0stRAT)", "value": "4d3c21b0b02ad7664be9df6ed3a85c08be4af8ca7a7ac31dc373a8c09971feca", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768403347, "uuid": "17b46cb4-1a7c-4961-8e0f-74e4bd243901", "comment": "Malware payload (Gh0stRAT)", "value": "636b5db3533b1b4465774e29a1a1ed0b4bb66444", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768403347, "uuid": "d22cccf8-43bd-4a34-9a35-30031e94f023", "comment": "Malware payload (Gh0stRAT)", "value": "880b37341403882b3931f72201b9544b3a81d43d8b208ea7692fc98e340d255de783f7352a159c56733db15bf1b9ad5a", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768403347, "uuid": "3b5fc829-128c-4d3f-b10c-fbf2228ad4c8", "value": "T108873326B2CBC132D56E517A9869FE5D0879BEA3473000D7F7E87DAE9978CC08274742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768403347, "uuid": "a1df5d4b-f119-49d5-aa60-023480f8dbb2", "value": "786432:KMgJ5lQDxNu+DCY+7kiNw+2s1PQstrgRz0LZKNrWqDU6I/KQ:KxJ/QDjJDd+mZ4PBgRYLENVDUx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768403347, "uuid": "6856d2bd-1324-4ac4-8302-c4f793f9c9f1", "value": 36411392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768403347, "uuid": "c6696460-a6de-4006-8fa8-9564566a5e4f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768403347, "uuid": "112f58a5-d114-46c1-89f9-c613d4d67344", "value": "Setup12.2-5267.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51268e7-f134-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768387020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768387020, "uuid": "c949182f-1284-4d44-b4e1-df7faeb38804", "comment": "Malware payload (Formbook)", "value": "19ee7c1c75bfd372abf0aa5474812e22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768387020, "uuid": "30b29591-6246-4595-a821-150e24bd07b9", "comment": "Malware payload (Formbook)", "value": "4eef5964d4be888f65a3410d0f60fd3559021aff06bf1448c919e294b7ecb72e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768387020, "uuid": "f2987252-5be8-4997-9ce9-f8723b0170a7", "comment": "Malware payload (Formbook)", "value": "834b76a6210e1793b9717b59b120e5d538aefddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768387020, "uuid": "1d94bf8b-bdea-43fd-a346-dc322fb9da8d", "comment": "Malware payload (Formbook)", "value": "95f176e1d0aeeb2db49c4e1620e9f60ed7753d32436aae92010a99b9d6f305b4a60e61e0ac66565602d9700f18727f60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768387020, "uuid": "728fb3cc-e4f7-4e88-81cf-166848cca243", "value": "T11C35121FBB95B6A1CE090F73C643115881F0C426E661F7DA08DE58FA0D9AF90C84FA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768387020, "uuid": "1cd5204f-0412-4583-a2e4-51a676e5d98a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768387020, "uuid": "65eecd96-e9e6-44a0-9f74-ff1744843638", "value": "24576:xQTNuCfQGCkxhYPiuDv9PtSX9Ump0iu5gSj68oKgf4:aTQCf9sPi2h4X9Uqd6rjyKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768387020, "uuid": "4eef5314-ddf6-4bd9-8205-2a60741bcb5b", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768387020, "uuid": "3eeaf3d2-9bd5-4cf3-93b6-fd534d28807f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768387020, "uuid": "a39b9cbe-e9df-4304-a06d-c49a4aba9210", "value": "PurchaseOrder00038959739.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46170b92-f199-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768430105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768430105, "uuid": "d89d540b-9d3d-43ce-8b61-a014feff127f", "comment": "Malware payload", "value": "bfbff786749d63f14523da299ff25237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768430105, "uuid": "2b2d56b9-db89-4682-aaba-0a86d2cdbd07", "comment": "Malware payload", "value": "52ad5eab557738df3755f4a609bd2f554a1cf4f6707a55e01f29178f5131161f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768430105, "uuid": "ca723853-0ed3-404f-8804-2b2d0e3deee4", "comment": "Malware payload", "value": "9ede7115b91bd8b1e0890100ad585f362d006937", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768430105, "uuid": "29779a75-06ef-4cf4-8262-6971ca43bb02", "comment": "Malware payload", "value": "63df9b4528d48a634585acad5c4e7f99eabc547e2304b7757ce8903ac8d78d92c4921b51bc93e4110e2ed8b370dbf863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768430105, "uuid": "659e78ba-baa8-4026-b568-7cb8ef29a440", "value": "T130747C94EE61409AF70B8131B4A3C703D5A7F878A6D05A9F9328C21B6F566837CFDE11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768430105, "uuid": "5a6e8ee6-d3ea-49a0-9949-224af25b06be", "value": "029b13331f3ed1cfab08baa09c768975", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768430105, "uuid": "3fb739b6-825e-484d-b072-5f40560922db", "value": "6144:NS1QfYFItFHsz2o2k5Nq97O4XTQxxfKOLJ+HHTNilWn9lc1XC42qewORqPuPtJm:hfYKTHO2o55Nq97O4XcxVvLJ+nJiIn3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768430105, "uuid": "3f03ee5f-b05c-4719-a235-c54a9ba5c704", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768430105, "uuid": "fa666272-0533-4499-89a4-7b8beb6e3fca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768430105, "uuid": "af6058a8-80f4-4057-bfc5-3825762f55a0", "value": "Ai2Soft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e1aae8-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418104, "uuid": "5be1306d-7e46-48bd-a8a7-70c5b53dc7b6", "comment": "Malware payload (Mirai)", "value": "462383adef5f4dd37101b964882d3a93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418104, "uuid": "c66da3a8-68f0-4005-910b-b7cb2e3239db", "comment": "Malware payload (Mirai)", "value": "52b8f6f38a358d86956ce2d85260ca20a6e944bfd1b4df6564c3d21a4b3c0d24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418104, "uuid": "48d289e2-1eca-4f2e-be8b-a3c0a0e69d59", "comment": "Malware payload (Mirai)", "value": "668d8d3ff5a9791eece820025522649f9522fb23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418104, "uuid": "c588732b-e3ce-4411-bcae-26f5d0c5a6f2", "comment": "Malware payload (Mirai)", "value": "e9a1ae34fb7464043f5d5ad9d7a8754b83ea3562398e8f37db357c2723f0a8907d1f224ed97028f2ae07b9934406ea88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418104, "uuid": "86b4399b-afde-422b-8430-f77889a4e436", "value": "T10BE2E13207DA98B2CFA08874C164D9561F5F8ABC57ED71221829A2B4631DB931EFDD07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418104, "uuid": "dbf2d5a9-7007-4645-bb0e-34a52b29d6a8", "value": "768:YL5WCnQKxJGCdTkPyiWhGvW4xVRUGay68Y+GDCsZpqfrJs3UozU:AoCnQ2JTdwPyH4jRUtYG+6qjUzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418104, "uuid": "9ecddad3-13df-4357-a5f3-0779ae5f75ee", "value": 31676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418104, "uuid": "2ad975cc-498a-45d2-8ef0-61ca83ceb6a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418104, "uuid": "cd3e352b-6336-4e3c-9fe0-9dcfc7b2a025", "value": "systemd-resolved", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c03c8f-f14e-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768398188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398188, "uuid": "487b5a8f-1c52-4bf6-bbff-8cefd1b8f262", "comment": "Malware payload (ConnectWise)", "value": "58bdbb3754f8bf42ff8e1619ee2622f8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398188, "uuid": "e979e382-b725-47c0-adee-60fb97eb7ec4", "comment": "Malware payload (ConnectWise)", "value": "52e06bce4ce3fc33626f892f989f776b8e3edded3608596fb397704fb53572b1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398188, "uuid": "277bd6da-fbb3-438f-8d2b-75d408bd5c10", "comment": "Malware payload (ConnectWise)", "value": "6997e081d93f7479098336fd4cc616acdba3c124", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398188, "uuid": "b3bb16f6-c1df-4e01-8c2c-ee98f2a5cb10", "comment": "Malware payload (ConnectWise)", "value": "775bc8df1bdbdcfdf3b68d0613a14df57cc9dfc50ac95dea5268a36b0e069ea724340f8f644a9a97ed4bf6485a2f23d5", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398188, "uuid": "03282125-4afa-4158-8700-34ee8edcf6e6", "value": "T17FA623116BF8D278F1F22A39D876A0B1A5367D119E23D12E2324791E2C75EC0CA63777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398188, "uuid": "5340b48b-3abc-4d3e-b7f7-0bcf42472aa8", "value": "196608:5Hxcp9ym3nltDUJVaHxcp9ym3MHxcp9ym3qHxcp9ym3LHxcp9ym3:LGplpBGpqGp4GpVGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768398188, "uuid": "e05a1659-4887-4f55-9e04-81ef59d862aa", "value": 9957376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768398188, "uuid": "505a8c56-d36f-42c5-9705-9092c73b2da1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398188, "uuid": "dd94b252-6d3d-40b1-8dc1-c081c0a10fde", "value": "Windowsetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8636ea72-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418187, "uuid": "c863fef3-7a6b-429e-bb63-3e4e07634a32", "comment": "Malware payload (Mirai)", "value": "1fafd5ea686faaf52848a68b23bb6692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418187, "uuid": "73304268-b1f5-429b-a3dc-fb2973028ed7", "comment": "Malware payload (Mirai)", "value": "5596b31d49da26c31f90aee4be6de33c033001a8bac546501c42daf138958615", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418187, "uuid": "6dfaf361-2c37-4dfc-ab90-85e4c3ca4951", "comment": "Malware payload (Mirai)", "value": "57bfb51e142aa54d688abee5a4bd289fb838752c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418187, "uuid": "35e75b60-8ea2-4b52-a71f-71b523c5a72f", "comment": "Malware payload (Mirai)", "value": "9be6d2152db29f88b3d0d57bed22b8fa651e528b3ca67e08a04b764f6079daec7ead644b6f13c2b581c9d353372387dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418187, "uuid": "7bb48408-9878-40b3-89de-defebd42640b", "value": "T14724E70AAB910FBBE8AFCD3746ED0B0128CC641721A87F7A3274D518F54A64B59E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418187, "uuid": "9172b91a-256a-4ea1-858e-28edd0d54f6e", "value": "3072:IzHebzdvQykRH8Fk+T1Q70WP79hNklFKkZbYX4PBic:Iz+bzdvQykB1+T12FjLNkHKI44PB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418187, "uuid": "1c71859b-f745-4c8b-b2b5-af5d338dd95d", "value": 220852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418187, "uuid": "6d4985f9-2b5e-4721-8a06-789deb6b51d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418187, "uuid": "503625c5-6ca1-4522-94b4-c3cd7e546b97", "value": "kerneld", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9605b4b-f160-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768405898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405898, "uuid": "988b976a-2667-4770-95d1-227d9f89f28b", "comment": "Malware payload (ConnectWise)", "value": "abeb8b745a429d5a1fd1c6faf8d01627", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405898, "uuid": "1d417555-8d01-4bc9-813a-2e71a494440c", "comment": "Malware payload (ConnectWise)", "value": "55f74a95682556359a63f4bd046bb3a8553c8c5d22e523c0cc2fb74ae0f8c7a4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405898, "uuid": "81374339-7a3c-4e38-b7bb-d797fb477d85", "comment": "Malware payload (ConnectWise)", "value": "ba7281c6f3b95d10a898c17c9cedf29c98789b9e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405898, "uuid": "995a4cf2-b109-46f5-a018-8c36bbbcd245", "comment": "Malware payload (ConnectWise)", "value": "d1e381b8987a5040ebbf4f9f8ba68425d9434489318e4037d015e06274f65a117ca174df6e8695405f79e0ae0a4cb065", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405898, "uuid": "1885800b-d496-4d43-9339-8d4236c217c1", "value": "T10FA6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405898, "uuid": "f85da8d5-732a-4152-a931-3e14b7285c83", "value": "196608:LKaLNkbgmi4Q6KaLNkbgRKaLNkbgpKaLNkbg:DWgmiHMWg1WgNWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768405898, "uuid": "6c389d82-aadf-4ed8-8288-d69b0e2bda7d", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768405898, "uuid": "bb595ac2-82ee-4a97-9865-50ea25bcfead", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405898, "uuid": "3f274ece-43d2-461b-a301-ff2a97299e30", "value": "EveningGathering_PreviewRSVP.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2914692-f16b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768410611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410611, "uuid": "53dc557c-dcfb-415d-8946-aa81edeaa454", "comment": "Malware payload", "value": "280808b0851de963fc923ab4ccbe106c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410611, "uuid": "2a3d625e-3a0b-4236-90aa-7a3d9cbf922b", "comment": "Malware payload", "value": "5634866ac60f3b563188dddc853eccfd33e0b6483b146041f8634dd866f03a4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410611, "uuid": "69a80a1e-b064-4005-8fd0-482b600e3893", "comment": "Malware payload", "value": "b2d9d14de946f68dc633ac4beebe9411f305a6d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410611, "uuid": "a3433105-3b52-4360-90f4-fa217246a12d", "comment": "Malware payload", "value": "4aef1199e54e6d62894e9d43d50beba4ace8f8f89250e5b5d48ff1162c463e36d47a2f7efdd29600a402f11b198e9198", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410611, "uuid": "91f12754-1b3e-4d1d-bfc7-71a1f1f8013e", "value": "T14B25395A789248A3D8870FB402F216F827CCFEC70F3540179956B2ADD47D2632DDAA76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410611, "uuid": "afadd871-2068-45ef-8850-1b4c8513a0b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410611, "uuid": "7c0d39e3-cab7-4f26-8c32-7358ed0f2abd", "value": "12288:okbTiQE3/H8PiBwAB07lWTu5sTV9qJQusvJpXx/zT4473DtaEI6B:oUiQW/Huw/aM9V9qJJA5zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768410611, "uuid": "d9519b38-6501-4f0f-810d-6f169421d9bc", "value": 1000664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768410611, "uuid": "feba0768-2bed-4bae-8dc0-ed9f65b4f0c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410611, "uuid": "91fb6ef8-0610-48a6-8809-e626ad0c3b83", "value": "0x0009000000024198-15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7862618e-f0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352451, "uuid": "7783b8d7-3d24-425c-92ac-a9b4b07ce290", "comment": "Malware payload (Mirai)", "value": "cdf96c20b5125af5a232391b0199a010", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352451, "uuid": "74f4e007-9020-4a2b-a57d-d93aed2fc327", "comment": "Malware payload (Mirai)", "value": "56e767ebfba30891da28d6e43c705af1c050edb65eea0843364f5766cb5d8bae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352451, "uuid": "11a3ef1a-b4cd-4d1b-8488-c2f2031462a0", "comment": "Malware payload (Mirai)", "value": "6ad38ba550006c0334a172d6a6fbdb739c0555b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352451, "uuid": "1def869c-5069-4c36-bb63-6ebf73c0b042", "comment": "Malware payload (Mirai)", "value": "8349352ca6702623f457873ef6b7884e8ec08e244513c7e26de22f1f64996ff8128469997c82a989b956d186c698dbc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352451, "uuid": "b722258f-5738-4d61-b2d2-89ae66d480dc", "value": "T19A438DA7C82AAE4CC14945B0B0748FB91763E445924B2FBF5159C6BA9083DECF6493F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352451, "uuid": "d3efa87e-7099-4532-a8a5-eeba6cbc49c6", "value": "1536:cwAZw4i4VMLG9kIPvgXo+nlnKfaUJD1pPNCfsVU:ME4VOG9kIXgXo+lKfx1p1nU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352451, "uuid": "91a59468-8507-45f1-80cf-909a9d1f4834", "value": 58980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352451, "uuid": "7a0a1d0f-d8fe-4568-a666-2ffbe41dd35b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352451, "uuid": "879c3843-0f34-43ae-9a3e-303f61204a4f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630210fd-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418128, "uuid": "7eb1fc4b-8538-41b1-93c5-83b5c403ef03", "comment": "Malware payload (Mirai)", "value": "d9a5757a27161621db7f3c611f315da6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418128, "uuid": "c45dc438-6924-4ae9-a95a-b1992357f4dc", "comment": "Malware payload (Mirai)", "value": "578b49c78c0f112584ab67fa82dffef3dfeb87737e7ceefb3127fddc376687bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418128, "uuid": "c9418232-3046-4d61-8e92-df4f2a11ca68", "comment": "Malware payload (Mirai)", "value": "437a92a96febfdc28ad4f2afdbf8a4f647d32819", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418128, "uuid": "5d8480f6-15d1-4d7a-ac1d-3c0eebf76a73", "comment": "Malware payload (Mirai)", "value": "c05cbe2aaa265462f7f0f5b85d0af7ecefc1a9d6b52ae2caf5fb68503c68b767fc7f49205382df8a88c60e81b248236a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418128, "uuid": "7f1462bb-63e6-4c23-961a-0328361f8677", "value": "T1E0530285729B6C23DCB02A39FB5DCC60633F8A5AF2B0F8A70F62069D560B55177B5243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418128, "uuid": "60f78eed-4888-4945-b062-f372c7baeafb", "value": "768:qaaLJTqYLjHzCKeDa14VuZVXb2IGa/qVIs7clsTIgFgXgqhdZA9a9KyZRJYfNBqB:g3TKVorAmqDEEIbA9awIOlC+22zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418128, "uuid": "b492c635-b951-4c4a-9b8d-88d86180fb67", "value": 61748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418128, "uuid": "1d8eabac-ebf2-486d-8150-97a86e77866e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418128, "uuid": "fb687aef-2705-4b04-84a8-61b871d50233", "value": "systemd-networkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d204c2-f14e-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768398194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398194, "uuid": "30e73d96-228a-4502-a78c-de43651d4934", "comment": "Malware payload (ConnectWise)", "value": "6b6fa91b991bb7b0a2383b90994bf907", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398194, "uuid": "b8ee9a0b-4cbd-4872-9390-3b0a123ae09a", "comment": "Malware payload (ConnectWise)", "value": "59121de3a37e878deff67f7a9b67b12ed582a082c05901ff54ed77dce289200b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398194, "uuid": "8f2481c7-1a35-4235-8f7b-6fe63759cd64", "comment": "Malware payload (ConnectWise)", "value": "8dd11ddcb405a7cf595130a30e353247a8aa8c93", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398194, "uuid": "c1e104eb-1e68-41cc-8870-d6d2b81f2ca4", "comment": "Malware payload (ConnectWise)", "value": "aba0fbde9b36c87e8b19750f1191d898751762e8a4943dfb7ed8feb707f76da0ac1d30da36ae96b8407dc5e72a80393a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398194, "uuid": "80ebd0cb-43da-41ea-868e-e5a8f2345d6f", "value": "T187A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398194, "uuid": "756197b2-5e6d-4b54-8b1e-d6f82ef7caa3", "value": "196608:4KaLNkbgzi4QaKaLNkbgRKaLNkbg1KaLNkbg:eWgziHsWg1WgpWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768398194, "uuid": "eba30092-ab08-4ae9-b667-0d56549ee804", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768398194, "uuid": "1a60f4d3-c3ac-404a-8c93-4341c7828e9b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398194, "uuid": "408cc2eb-9b82-4bd9-9411-121f1a640c8d", "value": "TransferPaymentEnclosed.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf167a1-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418118, "uuid": "070a2654-069a-4112-9415-9bfc84f076b8", "comment": "Malware payload (Mirai)", "value": "5d9013f4ba6aafe7115e014d98341344", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418118, "uuid": "9663d008-fd98-401f-9026-214a352fe596", "comment": "Malware payload (Mirai)", "value": "597f2799478a431819083b42ef6a07029a05c0a219e9fd8a7c4dbbc8e35a1d2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418118, "uuid": "c7b580d8-869a-433d-9d8f-e557d0f22683", "comment": "Malware payload (Mirai)", "value": "d6438d95355b13d8f2118f7b2fa36d84a09f3fbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418118, "uuid": "8f88c464-0764-4bf7-abe9-761fc55f4021", "comment": "Malware payload (Mirai)", "value": "bb84d0689fa2c92b029bbc3f117bfdcbd82e5f9fa6d09660cf8f498fae08cf39222d9ac86b5a240594e4ef344a546964", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418118, "uuid": "fd1e3e72-9b30-452d-8425-7926de4f6c65", "value": "T1B76302F67966A112CF0118B5A958C5CB48997EFDD2EB7A72930C56E8A1000A3B4FC5CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418118, "uuid": "cade5d3c-8ebc-48c6-91bf-4bf4054b9b3c", "value": "1536:cRVBYXJoqa8K/Lh+opTgdARuGYdueuOzqdjuJ+dWfhFl7a4KPoG5b/7Lv:czBYXJokKlcaMdx0juBfhju4shb/7Lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418118, "uuid": "5429cd11-b048-46ea-815c-429f29335938", "value": 67928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418118, "uuid": "808c9933-5d45-49e7-a5db-52f8c23d3b44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418118, "uuid": "6f617b80-9963-45d8-a2be-116e5ac7d50d", "value": "systemd-timesyncd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e409ff5-f0fa-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1768361909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768361909, "uuid": "0f76ff34-039e-4a92-9601-03e9658de499", "comment": "Malware payload (PureLogsStealer)", "value": "fd9b3817e94c08286b6a5708579fe30c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768361909, "uuid": "60550ea8-9654-41b5-bdfb-195b36737931", "comment": "Malware payload (PureLogsStealer)", "value": "5ac6244e4e561e0db75d436f895369ac7b8927b3726ad7f89e795c8aea4ba017", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768361909, "uuid": "de0babfc-01d7-4e88-8678-1c6427691f2f", "comment": "Malware payload (PureLogsStealer)", "value": "be65f07769ff7c35091c91ec7d5aa5bafa009168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768361909, "uuid": "1db451a3-7908-41c9-9b6b-4a68ea00cb73", "comment": "Malware payload (PureLogsStealer)", "value": "957d7290da9099313f9ec7c0587c2649e2d2e7f9a9dc67884c41200d4a54f33bf09470e336daf88a9afffab65f9885c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768361909, "uuid": "7f5916c2-8f6e-4823-a5da-46c8e862d35b", "value": "T10135121DBE92BC52C99D2FB7D813804442A2C452D5A2F3E28ECA58F30FE6B19CD4E557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768361909, "uuid": "a958e259-92ce-43e9-bd51-b687d025d886", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768361909, "uuid": "bd3aff3d-d119-43c6-a495-6224e3cc0d49", "value": "12288:EgkpqDorhq9g8AGftvaeq8BdNA25nqmM6jfNGbyhKJiZRYPdAwYbtR3ekZFy0/9s:8pprssyX5nqj6jf0bRgZRA6xf1RX8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768361909, "uuid": "b1b13c05-3341-4bec-b065-dda4b588a25b", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768361909, "uuid": "4243ad01-b509-469f-9a8c-43bc889968cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768361909, "uuid": "d6a33846-0074-45a7-80b7-602a89b281ae", "value": "SecuriteInfo.com.Win32.MalwareX-gen.9289.20729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86faa896-f0f8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1768361065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768361065, "uuid": "b82f5a94-8964-4d3f-a0cf-305e53b6c83f", "comment": "Malware payload (Gh0stRAT)", "value": "09dad715c448f54a488cfef3f0581154", "object_relation": "md5", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Egairtigado!rfn", "colour": "#A24468", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768361065, "uuid": "e506ca36-a97b-42e3-8966-4291630cfb75", "comment": "Malware payload (Gh0stRAT)", "value": "5b2c762d82cd1a07170719fdd5c5c9a00592ea6164513d9d0642bce84c1221b7", "object_relation": "sha256", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Egairtigado!rfn", "colour": "#A24468", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768361065, "uuid": "533f718d-6533-427a-89b6-7813e2632c8f", "comment": "Malware payload (Gh0stRAT)", "value": "3727dfca4252f66d3d695219fc6ee822b05c0149", "object_relation": "sha1", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Egairtigado!rfn", "colour": "#A24468", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768361065, "uuid": "913919b4-a31a-4535-983d-180b8d10b967", "comment": "Malware payload (Gh0stRAT)", "value": "ec57fa701a99cac13ac78536f84b22e78125e8764d0cad66fee1276d0f1b704af00f6e48d3cc5c521034fe85e0e61586", "object_relation": "sha3-384", "Tag": [ { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Egairtigado!rfn", "colour": "#A24468", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768361065, "uuid": "4a592042-7ea6-4996-808c-ba05758cc8f9", "value": "T17075018AB95180FBD7E104341D96677A9F3E9208132BB687E390CE7D5D304169A3B37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768361065, "uuid": "3f1df148-0bdd-4005-a8aa-6198c21d3fe0", "value": "f1efba17f27b421c291a66a2fea12c91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768361065, "uuid": "d6e20287-98ce-406a-9457-52e5c8530a26", "value": "49152:2lG4zr1hb7tSuwGFjmMd/n6MnkrWBJO6JHb1qYOl:2lG4zrvtnjmMF6MkrcJPJ71qll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768361065, "uuid": "def13a5b-3e31-44d7-accf-2016ac685b58", "value": 1599056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768361065, "uuid": "1b03733c-9367-4501-b89f-391e6181c055", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768361065, "uuid": "3da478e0-361c-4aac-b101-7bd665f861c9", "value": "\u7cbe\u804a\u601d\u8def\u5fc5\u770b\uff1a.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037ccbbb-f112-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768372011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372011, "uuid": "fc790dea-ce12-4e8d-a83b-25a31ca797fb", "comment": "Malware payload (Gafgyt)", "value": "61014783c2f20481793f152188746641", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372011, "uuid": "0b215ea2-2e63-4de5-8c99-15f98023ecb4", "comment": "Malware payload (Gafgyt)", "value": "5b75b8f1791bd430a78382bbbc92af940ec96aebaf879848fae65fabe8002ecb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372011, "uuid": "451dfbcf-9f1c-485f-9fce-f4a9b2ecf446", "comment": "Malware payload (Gafgyt)", "value": "71a82f73e444695b68c289d22b37ae952cf3a87f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372011, "uuid": "dc045df9-462d-4075-98c8-46b7956d345e", "comment": "Malware payload (Gafgyt)", "value": "764c18e5b98fd92530d09374dc41597d68ec9af33d31595f87bcb9754f7fe1edda04851cd651b59c66e4d854a4f8a47d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372011, "uuid": "64842010-4bf4-4fa8-9d9c-60ee8d92dd50", "value": "T15CA3B71E6E618FBDF668C73447F74E21E75923D623E1C685D29CD6001E6034EA42FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372011, "uuid": "b499a7e5-fdb5-4a9c-8b61-b7e015d7e878", "value": "1536:UJMheAr+DQUDWnIKjew4sKTJmXGRBjHRbXS0L1JHKwIkpJse7JtiE1SpeTc:sAjew4sKTJmXGZTlKwIkpJ2E1c4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768372011, "uuid": "43875d7b-068b-461f-9c56-f9ab0ebbb186", "value": 101352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768372011, "uuid": "ef23b2cc-c52a-489c-93df-b4f12402d893", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372011, "uuid": "6f0b33e3-78b2-4216-93ea-4d9c84dc4931", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d920f1-f11a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768375772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375772, "uuid": "68726508-f9d3-4661-8b58-5baa02d1ae97", "comment": "Malware payload (Mirai)", "value": "7d3c2ccb2e0ba59df1c81089524d612c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375772, "uuid": "44614d1f-d74b-485c-807a-6bc492a8dbc0", "comment": "Malware payload (Mirai)", "value": "5bd461c406516998a763704f0bc7992f79aab37fafeee8bc8ee4f0562493c4fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375772, "uuid": "6f23731b-0e34-4ce8-b8e2-b027327bc9af", "comment": "Malware payload (Mirai)", "value": "d473e6dfc03a2bde1f2edc032262b87a66200105", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375772, "uuid": "515dcdb5-d35c-48d4-aea3-7fce68c9496d", "comment": "Malware payload (Mirai)", "value": "c6a866c05e00ce4ebb5410fa52202add482e50e290ccaddb5829e44ff5fd33f7c5ace708387f6980e1b7d280095b4606", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375772, "uuid": "b3d05d33-8545-47ca-9b6f-c64544b23f4f", "value": "T15AC30696BC819E16C6D116BBFE1E52CD33132BB8E3DE3203DD146F2477DA95A0E2A441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375772, "uuid": "af8777a8-305a-4da9-a724-8fe6391cad59", "value": "3072:YFAuWftcXDrq2m95DW18M2NTmVF+w0dr5Wa1/9:YWuWtcXDrq285DWCGVFd0dj1/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768375772, "uuid": "ccc9f917-8e8b-44a1-9b1b-438b78a14de9", "value": 128144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768375772, "uuid": "97a268aa-04ac-4735-8986-fb99746635c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375772, "uuid": "748b0d33-d3f8-4311-ab95-5820337ccb9c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f1ca71-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418126, "uuid": "a08b5ab6-5b41-47e1-8083-d49c9396b8f4", "comment": "Malware payload (Mirai)", "value": "06ec0681c342afbc02bce17e8b6eaeb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418126, "uuid": "cf6b7645-6d4d-4335-977b-bdacbd326f49", "comment": "Malware payload (Mirai)", "value": "5c8d98cd2804722c5f879eb145dc5b9b0e35591c023778195f62d7f5c93d63e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418126, "uuid": "4a8f0042-1cae-4823-aa37-053ea5110a51", "comment": "Malware payload (Mirai)", "value": "1f36357877a98b382a2cdd2893f81397524413d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418126, "uuid": "635f8941-307d-4c62-b736-8563212fc7b6", "comment": "Malware payload (Mirai)", "value": "923c4e69f19f46075c9bb46fa8fe333396035c7e4991efe3fc57f6b610e768a8ff55df09bb61871c5c283b8d1a216f4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418126, "uuid": "1f82aab0-e7f2-4653-b98e-c11b79f0431e", "value": "T1BD630208B642B5CFD7CA08B07D640FB53F290F9510910885671AE9D98EDDAF2F7425C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418126, "uuid": "22355b9b-92a7-4330-9e2c-cd259e1021ef", "value": "1536:NV48mx4j+ulWM6f1YW8n9U92U+eFkAilAI5NfP3VJuv:Poxy+ul6dYbn9U92UdFleb5NfP3VQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418126, "uuid": "5763d5a6-e0f2-49ff-bb68-a77085cb1997", "value": 67116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418126, "uuid": "7e11949c-3ab7-49f1-9616-b8e08b28a4bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418126, "uuid": "d9cba956-a116-4c88-ab74-fef0603f79d9", "value": "telnetdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f212d51a-f179-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768416650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768416650, "uuid": "79e177c2-a9d0-4fae-aa07-eea68e905e8b", "comment": "Malware payload", "value": "396d640957647def44e2312b40c54f4f", "object_relation": "md5", "Tag": [ { "name": "kndon-speednationssenceqa-net", "colour": "#45A723", "exportable": true, "hide_tag": false }, { "name": "speednationssenceqa-net", "colour": "#624649", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768416650, "uuid": "f95875c0-a936-4e1d-bc74-be282f553383", "comment": "Malware payload", "value": "5ce7f0df57cd5671a28c355e849eec0ca7d9aac8e098a3ac322068acfc95bdcb", "object_relation": "sha256", "Tag": [ { "name": "kndon-speednationssenceqa-net", "colour": "#45A723", "exportable": true, "hide_tag": false }, { "name": "speednationssenceqa-net", "colour": "#624649", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768416650, "uuid": "65b1dc76-bcea-409b-8f9f-b8f1289ae18f", "comment": "Malware payload", "value": "108a0ec4000eeeec45e25ec30932a4b34f04906b", "object_relation": "sha1", "Tag": [ { "name": "kndon-speednationssenceqa-net", "colour": "#45A723", "exportable": true, "hide_tag": false }, { "name": "speednationssenceqa-net", "colour": "#624649", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768416650, "uuid": "63820754-93d7-4233-a350-36d3eb7bb0dc", "comment": "Malware payload", "value": "788de449b19d553e0503e76c9dbd965cae839d500847eec70089538d3c048046f4a97537913e036408a0ccfae438224a", "object_relation": "sha3-384", "Tag": [ { "name": "kndon-speednationssenceqa-net", "colour": "#45A723", "exportable": true, "hide_tag": false }, { "name": "speednationssenceqa-net", "colour": "#624649", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768416650, "uuid": "7cc1fa15-1ef6-4e79-b16e-2c68220d8e90", "value": "T1AE01653560BB1162FE1DE53F3302870E246CD41064696AD27C0D98D1D8537816E88128", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768416650, "uuid": "6889c308-72fe-4dc2-9fdb-6830de809025", "value": "12:5jU3lHHChGtUkaZlNH+Xb8Jtt3llPUrAdVOJdTDuzc2XdWmjQ/lHEtblA5:9UI9V2bEr/PUUkJdTDuzc2XdfjQkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768416650, "uuid": "a688b7e8-bcd0-4c5d-ad2e-68be7926e451", "value": 780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768416650, "uuid": "e0eea665-8a49-4b61-b213-f323e337cd15", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768416650, "uuid": "295ee573-242b-47d7-be3c-6da03129ff19", "value": "5ce7f0df57cd5671a28c355e849eec0ca7d9aac8e098a3ac322068acfc95bdcb.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d60df9b-f18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768424641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768424641, "uuid": "5d877f9d-0433-4371-a4a4-ada7751f5431", "comment": "Malware payload (Mirai)", "value": "91780577420b4053198367bbc8cf9b43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768424641, "uuid": "4cfb0862-19fb-4194-91c8-ec1f97c1849a", "comment": "Malware payload (Mirai)", "value": "5f1ef4f5a0cd53b27bfadddb55646b62c8c4b6a75da16e36ff984fae97d518c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768424641, "uuid": "a2052a1b-e2d3-4aec-8816-ba5b1181b1d1", "comment": "Malware payload (Mirai)", "value": "5766669ee9b3a807c4d49335554cc9ffa188ea56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768424641, "uuid": "f74f14cf-7aa2-4ada-9add-77904b21d77a", "comment": "Malware payload (Mirai)", "value": "8ded84719f334f7d2c49b908e579998ef831e470ffbffe07963603cdf634dd85d483ef6172e81e8b51af0ad17f14a165", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768424641, "uuid": "447f1fc2-ed7f-4792-ae68-6d931bda7804", "value": "T152E34D99F402DD7EFC0BE5BE44670E15F93093A13143172E529BFDA3AC321A61D26E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768424641, "uuid": "f7a1f903-7476-472f-b514-e2b7eaef311c", "value": "3072:RmmyBVk2SJgv+EdV0+owYl10cvjvF9JrT7vybs1:8S2SJgW+owXIvF9Fabs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768424641, "uuid": "c7e9ed79-36cc-466b-b073-23bfac963881", "value": 146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768424641, "uuid": "be37bb91-a0a4-4f2d-81a2-283499130e2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768424641, "uuid": "7e8097de-1302-4caf-a719-b5bd8eb4b0c7", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2936449b-f149-11f0-a129-42010a9c0007", "comment": "Malware payload (DDoSAgent)", "timestamp": 1768395697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768395697, "uuid": "a26bb0f3-271b-44f0-82e8-41433887c40c", "comment": "Malware payload (DDoSAgent)", "value": "c2698864a7e5d55798d3cd11d747b0fa", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768395697, "uuid": "f48f5a86-be1f-4c9f-a5a5-f7ef1efdd285", "comment": "Malware payload (DDoSAgent)", "value": "5f7bf5a001d110a03fcc9c974a3e126438a287b0c6ece5528b1b76ac59c9bdbc", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768395697, "uuid": "c1b89943-22ba-4bf5-ba3a-e73f0078e7e8", "comment": "Malware payload (DDoSAgent)", "value": "928f7ca4fb7fc3972d3157660ee24324d81875d8", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768395697, "uuid": "c36f82f6-d20b-4a05-9c1b-dc8501d6bbc3", "comment": "Malware payload (DDoSAgent)", "value": "37ea150cb671a812b9fe4a407d32e400c77e3f4b2cfa136d1f512ef64db814227624d54b65251b8d537373c227f346dc", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768395697, "uuid": "10b961f3-92e9-44db-b14e-2d41b358ce6a", "value": "T1475608C2ED91D24AC63D6D31EFD6EFD8E2272E315D885A4AD9C8F33E18B214580B55A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768395697, "uuid": "b241d937-cb04-47e8-b365-ea6874548340", "value": "49152:7siSMdlj/pggvvfWo8256ZjXwSPUSgOiFPxzuxTQ/rVY40/EiMDhHHDt5Ea:7siSMDlv+f8qXDbERnDjEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768395697, "uuid": "f5fdd726-b28e-45bb-bbc3-d70e33a48d05", "value": 6095032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768395697, "uuid": "469ca742-4558-4b45-8da9-aace8c9e427a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768395697, "uuid": "634ef26e-c3a1-4a70-bd61-8bf96fc43d8c", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d821b3b5-f0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352611, "uuid": "6bb14504-5fad-428f-ad7d-06aade0d0438", "comment": "Malware payload (Mirai)", "value": "663a1fa6680209606651630f5a7e3c55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352611, "uuid": "77be55c4-993b-4e7d-9a8d-21f2dfd08ced", "comment": "Malware payload (Mirai)", "value": "5f8ccc6b882d55c40b26050343d2b4254bf799d40c0a796ef243bf10d5fba137", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352611, "uuid": "a70f939e-b46d-4ee0-a83f-5f7753d42432", "comment": "Malware payload (Mirai)", "value": "eded96566021a2c1858e00145b3622595de30202", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352611, "uuid": "ea5ca842-dd38-47ac-9f60-d3eb3effd11a", "comment": "Malware payload (Mirai)", "value": "6e43f71dda1a9cb291de2ce74c8c185d8981fd2eac6896d18817c745a4c20c82923f9c4172c87b91cd3004f7dd674792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352611, "uuid": "a1d6f95d-78c9-43e7-addf-db71bc98b944", "value": "T116536B17A6C090FDC48AC27817ABB23AD133757D0239B17A67D8FF362D4AE616E5C601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352611, "uuid": "9945d0f6-5983-4079-8e05-a323e9f3a5f9", "value": "768:jikIYNEKOZfeosVNjDm9V4ibWEnR/3vMyxhx7cAucUQi9toqfqYmSuQwoTHn38kb:+Z2TatFnR3vM23cZl+8q63woTvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352611, "uuid": "d3037f93-a7fb-42f2-a61d-c71b07e62983", "value": 63424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352611, "uuid": "5933c28c-91f6-49a5-b966-629b7dae67a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352611, "uuid": "0447d5b1-b980-4c08-a6d0-4e2c707abf82", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27feb51-f160-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768405779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405779, "uuid": "d867e940-e60c-412d-a30e-12c12771bf25", "comment": "Malware payload", "value": "ddc85ee9692023568e1d71aefa8b58f0", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405779, "uuid": "50f2e538-6ab7-4e72-ac02-e346a57e42ba", "comment": "Malware payload", "value": "5f939131f5855338f3591ef369e1aa849f273e233a3d46d36906c43ebfd6ccb6", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405779, "uuid": "bd89cd0b-336f-4ecd-9a77-7126797c9dfd", "comment": "Malware payload", "value": "ef0463158ba00f9a95bf9b81d202834c57fecd4a", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405779, "uuid": "c1af79a3-4d46-4588-ad69-94022fcd1bc7", "comment": "Malware payload", "value": "d68ceea823fa6fb301c90241cf148ee3b98576351872aa15490e68bc3f14947ff49aa0238d246b0a7fbb4bdab8ad248f", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405779, "uuid": "7e94106f-2cd8-44ac-921a-86070a4addf2", "value": "T16966D0CAD16B40D6CC067FF598152BC39F3056324A34042836ABBE585F779FA811EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405779, "uuid": "eb681a29-d757-4116-b517-3a0e02182ab5", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405779, "uuid": "0652d771-e2bd-49e2-8d08-96972b819308", "value": "24576:CKs7Z/mpWkfzh7a5Z20HBtv8PB0UFXVffMNWU888YB+CPtHwRiVZ6odxg8mS+vm/:o7SvaNyPVWyUj8UVdZxko8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768405779, "uuid": "925f06a4-c48e-41bd-a834-28fcc3079468", "value": 6873600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768405779, "uuid": "7534923c-bf32-4ccf-83ad-a3f434eb19f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405779, "uuid": "eb8c70db-4da9-4898-a1f5-0f5a26f1ba08", "value": "kizar-soft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef8ac0f-f186-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768422255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768422255, "uuid": "4451caa3-1a0c-4773-8c96-dac2b927f3a2", "comment": "Malware payload (Mirai)", "value": "9b048825ef840fde391692a8d8961317", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768422255, "uuid": "8e2881fa-0f42-49e9-a971-2764a64e73c1", "comment": "Malware payload (Mirai)", "value": "5fd341ce2bd3f4785a83f07001f1a59b7bcd286b3d0915abf9dd8d973f290f62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768422255, "uuid": "34b493d4-1fee-4703-ab94-5a2f2f29eb9a", "comment": "Malware payload (Mirai)", "value": "4071da922f2b9ec518c968909a7805efaa000ca5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768422255, "uuid": "d91399d2-dfd4-45e3-8b4c-afeb917effca", "comment": "Malware payload (Mirai)", "value": "efc1b5b558da8d6ba0afd70077bdc1fd404a7aa97368c76d46e52312ae6a109e9d77ee021fb499ad16e73a2a8997e11c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768422255, "uuid": "af89f9b7-8c97-469e-9925-b4e641c144b9", "value": "T132D34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768422255, "uuid": "bd7fc8ee-7b46-4705-ad39-9157c9ddc31e", "value": "3072:1CldeCsOs9kzj2vV44qURgyPykV30Qm9Jlsb3jc4:wPeCK9kzivVjqAymymbTc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768422255, "uuid": "80005b0b-b10a-4586-bd1a-cf49f74bfb79", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768422255, "uuid": "c4f73f4c-5e43-4b35-9bb6-62d57d3b72ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768422255, "uuid": "18abf865-a380-47eb-9f60-471d34dea3a2", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bdaec3-f0f4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768359395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359395, "uuid": "b601ae72-0608-4146-8a3d-daac42e4bdf1", "comment": "Malware payload (Mirai)", "value": "3df1e207e881b076c3cc3d64cf603a44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359395, "uuid": "edbe1250-1019-40f4-a712-f3047dae5849", "comment": "Malware payload (Mirai)", "value": "5ff3c45bba93b2c297d9644a93a751a7be92ab99699964b871f28edbc3c09404", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359395, "uuid": "d8bd2d0f-fea6-4869-af52-dd41e52ffe9c", "comment": "Malware payload (Mirai)", "value": "aa071cfe745c3a79fbde69e3787357b1c3eea749", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359395, "uuid": "101968b3-7739-4527-a572-8c12a0504ecf", "comment": "Malware payload (Mirai)", "value": "1419a7d218b4ca5f84f8b179cd17b9d8a1cee5bc39a871ef778701e84486330bfa26edaee1a04b1cdf9fda04c120864e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359395, "uuid": "01af4c83-42e5-4461-bc9d-2bf85b489cb3", "value": "T1C5030949E757D8F0D80309B042FBFB3A9A35BC721660D86BC794FF9399716C6904A368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359395, "uuid": "e73976a6-2858-406f-be11-cce758dca136", "value": "768:HGqGMpTkPuGcpFYO9WB0lZZfuXXTdRjSgk64zXRK4+rVztI:mqppTkPuGcpFYuMiZZfuXXTdxkD+BZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768359395, "uuid": "3acc05d3-d7ef-42e9-9862-7e996a409c22", "value": 40848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768359395, "uuid": "839b31da-6851-4684-b188-35db6f614e4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359395, "uuid": "d9f675ff-768f-4d95-a41a-bbbef4dd6bb0", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6ccab1-f146-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768394739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768394739, "uuid": "be60f3f0-4bdb-4b15-bd77-0b8965009389", "comment": "Malware payload (AsyncRAT)", "value": "ad42415087fa7a4e1077596d2d09a297", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768394739, "uuid": "6ae89b2a-4ba9-4869-b4da-6729d4ade042", "comment": "Malware payload (AsyncRAT)", "value": "602918d5d39aef596679e79d576ffc2e845a219468391ffab7ee0556de9ef6ae", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768394739, "uuid": "3e74da9d-7fd0-461c-b764-9523a2b28a6d", "comment": "Malware payload (AsyncRAT)", "value": "64c438c57258ce64d9fdd22b0f1cbbd488d6fabf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768394739, "uuid": "0c65f76a-5d46-4fa4-b19e-9d325469db12", "comment": "Malware payload (AsyncRAT)", "value": "b2465c534712389685e958131d1ce0878a565c7f4bf2f459e813661e95253d4c0043a73f13a254bef6e7deaae65a4fe3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768394739, "uuid": "c365d5e5-3c18-496d-b26b-01098e2bc8ec", "value": "T1B0C21B0473F58266D1ED47BE48329200D375E68B5D13DB9F6EC494AD2A337CD8A21BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768394739, "uuid": "5ae37e44-4876-4ce3-9ee9-a5f318dceb56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768394739, "uuid": "97397100-aa6b-45e7-a8b4-cd4ba2c475db", "value": "384:NYGNEWFn/zgeFOQkDkMymrJhxYHqqbuUsJQxnCJf+BWfXWr/Wu+:NYMESn/EtQkwMyCJhx+FbHBFBWu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768394739, "uuid": "570911ac-0e46-4c9c-b274-5265c6b2ae35", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768394739, "uuid": "47fb1490-2426-4922-8de2-92f4a504247a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768394739, "uuid": "9c28175c-781c-4bf8-8950-f7554a8cf1cb", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792ff0ee-f18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768425466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425466, "uuid": "e4a2e49f-8f74-4e9a-a89c-ab6585882bf5", "comment": "Malware payload (Mirai)", "value": "373da4f1680809369994c10d57194bdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425466, "uuid": "bc0a3446-6239-4653-ae04-b83e9b9d9108", "comment": "Malware payload (Mirai)", "value": "60eb0eb9d769c569c246d41d4d1996407509311a8f37166e0d2f359d09692a37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425466, "uuid": "db81ccf8-1f70-4c17-86b3-b6fba6cd2148", "comment": "Malware payload (Mirai)", "value": "6cb521aa66ca0b81f594ea8babacfefcfd56d121", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425466, "uuid": "0ca2a3c3-6cd1-4804-bd2b-4359c590ce15", "comment": "Malware payload (Mirai)", "value": "9cabea6ce1f14bcce24282f89eb75faa70f74b77a2a1c0356c747383c45feeabd9870e4c2ee998b6748c21a08e91a708", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425466, "uuid": "cb806b53-f539-4473-bade-2000b9186dae", "value": "T136B32B95FD429F13C6C266B7FF9F4648371657ACD2EB3202E929AFA033874C60D16225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425466, "uuid": "74fa7d7a-9154-4028-b959-a9675e027db9", "value": "1536:OFQrbsKTYWNmc+kRqdGFxwW/QjVN+M3gVSMihOI69dwgtNfxmtwsfUBE2bpF+/:2QrbzTTUcCIBmN+M3MTDhtBMiE2bpk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768425466, "uuid": "94b77a1c-e936-4c85-9774-ba0342b101bf", "value": 117496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768425466, "uuid": "441304bb-300d-4b61-824e-3f5aaa2049be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425466, "uuid": "9b08e618-229a-42b7-b473-c2b26875a7f0", "value": "2016Nwjarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7858380-f162-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768406754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406754, "uuid": "e608c1dd-bb8e-435d-ac0c-4fe0fe2df121", "comment": "Malware payload (SalatStealer)", "value": "e8305b0583d810c1f785c75c145378bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406754, "uuid": "2e6869b7-8db1-4825-9f55-3dbc27e72da7", "comment": "Malware payload (SalatStealer)", "value": "6103dc73ba0dc1c9c55d618a706ee99842e94fc2f81afa749b2ff72c462d7980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406754, "uuid": "53f726bd-035c-4546-a5e2-eb5dc86e4aa7", "comment": "Malware payload (SalatStealer)", "value": "3c6da3108101c8201ae7ffe6d477c60967f0d2bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406754, "uuid": "68da63ed-7f81-47be-90dc-ddb08459c302", "comment": "Malware payload (SalatStealer)", "value": "6e75b377aa60ad33b2914f4fa2e27b8bd96a28567acefab9f70d6638bbd536cf890b5a908d9b45fa24e0392247961512", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406754, "uuid": "611fb19f-b4b1-4c8b-b12a-bca72603bdf6", "value": "T1E4C65A51FA8B54F6E9031831415BB23F23305E048B28DBDBFB547B6EFC77682196A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406754, "uuid": "2ffe08e5-66f4-4a22-a425-8ce4c4f7eeb9", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406754, "uuid": "3a8db550-4e69-4a37-8430-07a6eed2eebb", "value": "49152:tnjjswoeYuIjkw8eP+upayoE35X6b14lmp49WyazcyFNCO2y5ZrwW6vl1suEb6bK:RPsV198XPgiwld1kvfd9stKIOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768406754, "uuid": "40aba42e-d27d-47d2-9cfe-b838db741fe9", "value": 11656192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768406754, "uuid": "b884a3a6-3e6f-4aa6-a0d1-a88f1c93d165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406754, "uuid": "69858c31-306e-4906-a744-395972347a50", "value": "0x001900000002b30a-31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3810e55a-f0f4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768359215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359215, "uuid": "39663fc9-a712-4422-9f92-8b4a4f0b7084", "comment": "Malware payload (Mirai)", "value": "f6c2ed64db63c335bca0952586c422a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359215, "uuid": "3f55b137-f37d-4a84-9ab9-a24f1b752259", "comment": "Malware payload (Mirai)", "value": "61a4b0868ce06046999e76536bbf94a07336ec3ed3d0a8edc935d57c674fb187", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359215, "uuid": "9b96dd10-50ba-4a46-a18b-607f0070ba5c", "comment": "Malware payload (Mirai)", "value": "4a1b94e9fd19e6e2744474feef02d124d34ec1a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359215, "uuid": "fe5da3b2-a1b8-4b8e-93ca-071d2492d4ef", "comment": "Malware payload (Mirai)", "value": "b3ad53b11d9c34bada3bd684ac80f60c847dad6c2a4aa1e90c10d55256d4988b0c46e92300fb76cd24aaf94799ab6713", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359215, "uuid": "6f8afce6-c44f-4ad2-bc8a-2bd209116271", "value": "T1C7D33845B9829A27C5E523BBFA6E018D332563E4D2DF72178C215F217BC681F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359215, "uuid": "d4c76837-8ae2-4942-b9b2-78a2354363d0", "value": "3072:8nFif7apx6XS+kUgpjWX60yMgcWOgc6ZzyQS+:8n8ZS+dQWX60ydsgr+QS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768359215, "uuid": "21f45ebe-8bc1-4369-bb5a-1da8410c9fdf", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768359215, "uuid": "cfd6cdc7-e2a3-4bd3-b474-888182159743", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359215, "uuid": "00c4b41a-cf47-4dd2-8c86-6714f44b9d91", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550cac5d-f0ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768354968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354968, "uuid": "7ba4887f-acb1-4e08-8ead-6138ff7578ab", "comment": "Malware payload (Mirai)", "value": "220b93835f034db29ccf80d59cee2085", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354968, "uuid": "88be7d20-d0c5-4b06-b7f4-c76a714892cd", "comment": "Malware payload (Mirai)", "value": "64f5f2374b543302a981c2618ef3768458272ad1a347e56f3b3b11a2c29e3052", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354968, "uuid": "85286301-2804-4feb-b6e7-c75378f316a2", "comment": "Malware payload (Mirai)", "value": "55d88f133e62243c9bbc66721ec87bdf8ecb8dd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354968, "uuid": "fbd88f97-a5ce-45b7-8939-6903fceb18e3", "comment": "Malware payload (Mirai)", "value": "46e45795a07ef58f526ad8a4ebad215d975fa729ad2180b50e5c510272ff7cb15de99edf961ecb0a28f47889c44cae3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354968, "uuid": "52f7a051-e449-4e33-ade7-1d7962c53462", "value": "T173057B9DE786E0E1F63340F1025FDBF64634A12A5023F6F6EE46266374327616F1A21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354968, "uuid": "c4063912-94ad-403a-a765-5f0398e51b45", "value": "12288:17/JvqHhYjhZ3XsaqXn23vh3I6MQbV8NKrmiTOLC2NPyMDDw8E8AlBzDLuw:17/JmhYjh6aomvebYVkKru22Vk8E8Al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768354968, "uuid": "64a2482e-0a66-4df5-b928-21fdc0ccc688", "value": 865848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768354968, "uuid": "64eefdce-6abe-4a4b-9b7a-0f5a36b52b6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354968, "uuid": "2849ea57-6d48-4adf-807d-e7f3434f188b", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e20c99-f18c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768424523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768424523, "uuid": "da373392-972d-4e08-b0c2-7c7bdecefd0a", "comment": "Malware payload", "value": "62a5d0c97ae8cd86326b3343c6f17b28", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768424523, "uuid": "324eaa88-1a85-47cc-af9d-5751a87613d7", "comment": "Malware payload", "value": "66bd199d4ffcf1792b46c400a6eed9f71a88321f3057776e1a428f112cf7086c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768424523, "uuid": "fd43341c-e4f9-4a2e-8eeb-782aa0670be5", "comment": "Malware payload", "value": "40b336a074b9eb8229f33e8c7e81c66df6655070", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768424523, "uuid": "9d06ec5d-ee37-432a-a4a2-a373f24e7d28", "comment": "Malware payload", "value": "b9fb57f4544db40b5a346c131a76802fe3d06f6507202984fca2a7e45d563d67413031847376c79d24f7db8e14a2c387", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768424523, "uuid": "042e7a08-dee1-4eee-84c0-ebb9e332e0dd", "value": "T1F12633C0B8C4CCFDE3C11E7F266865A1287BEE5A5B1159C3C2649B377BB51B2612438E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768424523, "uuid": "ba8912b9-5859-420f-9185-106980977e0e", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768424523, "uuid": "275661b3-4fc1-499b-ae32-a9cff4307f54", "value": "98304:TW5dpUx3VaUDt8JZa2cyhlgko6QYaw3eyD4sdRmzkMf6ZdsA:TWDPUD63CknaPyDbdWkDdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768424523, "uuid": "aef8a606-47ec-4a7c-84d5-c91dc9e3c52e", "value": 4837032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768424523, "uuid": "bb0a09bc-0d19-47f3-a8ed-c66afc1f0139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768424523, "uuid": "4145b2a5-e8d4-48c1-a0f4-e43197ea72a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384ed064-f0e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768353632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768353632, "uuid": "4c5b72d6-3c0e-4cf0-9673-8463defd273b", "comment": "Malware payload (Mirai)", "value": "6f6c34fa7787ef383c05f92dc072ebf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768353632, "uuid": "2db49993-300d-4adb-bd70-da740e703cf1", "comment": "Malware payload (Mirai)", "value": "671cfdd83d66fbdb1f3683d7fd18b1bf15a535d72a6f2fc920f5165b8d46ddb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768353632, "uuid": "376a64e6-6907-4063-9b9e-ccb0f43150da", "comment": "Malware payload (Mirai)", "value": "c46304984a9a0c078345f2b0b6a8f5adec04c35c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768353632, "uuid": "bee1fd6c-d340-4af4-a40a-675bd41f5ee6", "comment": "Malware payload (Mirai)", "value": "502b0382a596c3a4cafa31e2adee3daac3f330aded4bc61e054400d9422ec30fb7f87815e0703e560f46a8243086f665", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768353632, "uuid": "c2342ee4-7ecd-43dd-b9c9-cda67bf8245e", "value": "T199D30709FF610EFBE86FCD3746E9070525CC661622B93BB67534D928F14A24B0AE3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768353632, "uuid": "a3f62d77-5306-430c-8d43-baf53606bb02", "value": "3072:gKbr6D9lmJWEy4zKU2N5aBNH/jKYIO2OFR4:h6RlmAEy4eU2mBNfj3/r4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768353632, "uuid": "64f390de-6484-44ea-b77b-03a4bd224e27", "value": 140256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768353632, "uuid": "a9f4dd6a-3635-47cf-bb1c-ed94094cd71b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768353632, "uuid": "923b44e4-f727-4727-93b0-092904ecb245", "value": "mipsel.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24772404-f147-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768394830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768394830, "uuid": "1fcc4ef0-8e67-4166-8a48-9768dcf865cf", "comment": "Malware payload (AsyncRAT)", "value": "a100a501a299aa0de69eaf6250893278", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768394830, "uuid": "2a9f4e76-fffe-457c-b100-0054fe39cea9", "comment": "Malware payload (AsyncRAT)", "value": "6730dbd99152470ad35cbb056f176c7bf09c235ea9e13c6cf103963ca31e66bd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768394830, "uuid": "a6c8c399-a8a4-4e23-988d-96ab43dcec02", "comment": "Malware payload (AsyncRAT)", "value": "1f213ba1d124d6343a877354ffba1a759230f063", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768394830, "uuid": "7c7db2fb-a0ee-4fe6-8053-4b98fc785ce1", "comment": "Malware payload (AsyncRAT)", "value": "b70342440f99666b16a6f96d82dea9fcb0c00b837c04163580a02871f8b004f5dbb92abccf609d3b9d7bc566b80780b7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768394830, "uuid": "a8059298-0fc3-4f20-adfe-ab9548623fac", "value": "T1D7C21A0473F48262D1ED47BE48339200D376E58B5D13DB9F5EC494AE2A33BC98A25BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768394830, "uuid": "c375f86f-76df-4662-8878-1c60a2091f47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768394830, "uuid": "b34d9ac1-b813-4a12-9697-40ce59f097b2", "value": "384:XaFcDYn2cHfzgeld4QkjUMymrJhxBHqqbuUsJQxnCJf+BWfXWK/eSu+:qmcnbHfEI4QkAMyCJhxRFbHBFBEu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768394830, "uuid": "13b3d601-62d5-476a-a2a2-1d6806b8ac17", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768394830, "uuid": "cfc03b27-ca86-4f0f-a57c-8dbfec881dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768394830, "uuid": "ac095e50-dba7-4a5a-adb3-5f149965b0ff", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65e69da-f17b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768417409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417409, "uuid": "c1ef4b7d-65ca-461d-9215-5447606d1e67", "comment": "Malware payload (Mirai)", "value": "8a1a1d4febb26b5ae0d84613ad829aca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417409, "uuid": "58774ea5-9d3e-40c8-878f-a0bdd8b4ec3e", "comment": "Malware payload (Mirai)", "value": "69e7a96169dcae32afe3a950334a2674f9ff30efa63de39b9da0ea4d18f5f222", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417409, "uuid": "d8f8c63c-60fd-4d27-99d8-51ac9b78317a", "comment": "Malware payload (Mirai)", "value": "30b131ea4fa8b9167091a4ea2d8bb08241f2a29c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417409, "uuid": "ace57eaa-c19a-4aef-907a-abb28689f208", "comment": "Malware payload (Mirai)", "value": "8d35571cbaf865e19928b73cf1ad828836c8dc2916f80d180c191f98cee1ef9315cda02381c1b7656b768db4987a8a0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768417409, "uuid": "c0b2321f-e533-4f5f-8582-6d9ad9ff51e8", "value": "T1E0343B45EA418A13C4D117BAF5AF418A3332A794D3DF730699286FB43B877AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768417409, "uuid": "ee8cb1d4-d36f-4bd4-8309-9c97feefd408", "value": "6144:LYoHI9SHOBzabKacEK1dAnJd7oHf9ihM/9hAU:LbESuBzabKacE62JSYG/rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768417409, "uuid": "f7e318c2-d393-4531-8c46-852a64387a29", "value": 230960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768417409, "uuid": "3fe474cc-dd75-464b-b82b-f58cedeb9188", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768417409, "uuid": "008c59e8-fade-40d3-afd8-a03a2d4639ae", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bfff1d-f0f0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768357711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768357711, "uuid": "8a6a26e4-252e-4574-bdb8-7a4b250c2ab3", "comment": "Malware payload (Mirai)", "value": "5988293f22927d08b5809ca43af33e9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768357711, "uuid": "f6af7e0a-8ff8-437a-b2e2-ac15c8f43ef6", "comment": "Malware payload (Mirai)", "value": "6b210fa96c3e226f8e73888fa32e0072e3565837fb90211ef2c2c95bfb9386de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768357711, "uuid": "56afdf93-47f1-4f7a-af6e-2a7005fbc9f3", "comment": "Malware payload (Mirai)", "value": "30c0a9bf7b973861f2aeba5098ad32e84e0eda2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768357711, "uuid": "726921d5-4e69-4151-812d-871a8d1215ef", "comment": "Malware payload (Mirai)", "value": "505254ebfd446855668ef4e9630f52ee3207faac5c6a4b9e57944b97feb45b4acff4617f62e183ed419e437e6318186b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768357711, "uuid": "af2917d5-a313-4d4d-a5bc-380e4854b180", "value": "T123C45B55F8409F91CAD529B6F65D929C33070BB9C3EB720799245B343BC78AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768357711, "uuid": "44fc611c-419f-4dec-8990-01746d6866bb", "value": "6144:q2NaWFu6OIn1/Fyz2IzIyYXVi5yffv7SMuoPPR3tEuJRn3bMDdgvgpZ/mzf:qGnOI2A/+KNRn342gpZ/mzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768357711, "uuid": "dad52c74-8633-4508-b478-661c3d97d6da", "value": 558468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768357711, "uuid": "0ee26a29-4a11-45fe-ad10-bbcc40d3cf23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768357711, "uuid": "c400a837-26dd-47be-a977-6fa14ed4e123", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd207af-f16c-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1768410814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410814, "uuid": "fcb33c3c-d4c6-42ba-9e77-c3e2390abfcb", "comment": "Malware payload (N-able)", "value": "b0c9a90845c7b0315d3ed9c6c8786057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410814, "uuid": "2fbb09ec-8d4e-4602-bb3f-6baca83061f1", "comment": "Malware payload (N-able)", "value": "6ecc44506cc0e7e717107aad2c0f6bf609510819af34e1172086af80e135fce7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410814, "uuid": "28bec57f-a305-45f7-ac09-931d885aca59", "comment": "Malware payload (N-able)", "value": "3417bcd553332a27f47777b93956474029b886bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410814, "uuid": "276ddd28-22b8-48e4-a97c-efcfb92d429d", "comment": "Malware payload (N-able)", "value": "d95acff77cbe1c1d991ef5da93dc041c4f7e280e7606fa83deb054cefefd165d1e42b05097e0fd3687c43d1532c516f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410814, "uuid": "6d2abacf-f4e6-46e7-9804-40a0c198a40e", "value": "T1A6E633527C88DBBFD4212770C6419BB7539B7A74481018AB6F0C1CB66FB28CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410814, "uuid": "1d081cc1-4361-45d5-9971-88f32cb45727", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410814, "uuid": "6d097379-33fa-42f3-845b-4213eab793c9", "value": "393216:rBF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1a:vrRxvoC/7a0jUxX7h1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768410814, "uuid": "d2bc2345-5c0f-418a-90c0-b3ed23beb198", "value": 14781992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768410814, "uuid": "295df376-508e-45df-ab79-babe35fec8ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410814, "uuid": "85f1b6fd-71b1-408b-9c10-47cb83159019", "value": "FicheiroOr\u00e7amento.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75356931-f18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768425460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425460, "uuid": "764b1580-0f68-4f0b-af6d-85dad8eac5cb", "comment": "Malware payload (Mirai)", "value": "729e52696af62531a4821d4a062db673", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425460, "uuid": "262cce9f-987b-4a49-9438-6e323150881d", "comment": "Malware payload (Mirai)", "value": "6ef2ac8fa897be21d88b5df3e0c5bfc260f67d2adb0870d3b830e30d8be77579", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425460, "uuid": "72cc18b4-73d5-43fa-8582-dc1cae39dcf1", "comment": "Malware payload (Mirai)", "value": "fe424abeda99db796dcd4f315487b7b15c2d3563", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425460, "uuid": "9645fae0-c78b-41a4-9f21-6570cfc51511", "comment": "Malware payload (Mirai)", "value": "5206ced4120aec936b0b85d2a16d7c2ca95f2234c06adf714e42c871fda738715936853c8d41ecae41a09cd2cfeb62e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425460, "uuid": "67b3e529-ab13-49ef-bc56-031cf07781cb", "value": "T1C9B3290375818DFEC4D6E2F80EDF55619922F86A2632755B33D4BFA52A0CED03A5A334", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425460, "uuid": "9ed6e342-b6c9-4b4b-96c0-8272ddd1505b", "value": "3072:G9B8CqC98Qk5tFdPKCgD3fKWdRzW2bjMN:AuCq4OKRfhLfXMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768425460, "uuid": "2d3cd2e3-fb6a-4023-80db-18b2894c0ccc", "value": 111120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768425460, "uuid": "64299804-bb67-470b-9741-f29f7a072cfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425460, "uuid": "d59c1c6d-fdef-439c-8473-ceb6bdb598b5", "value": "2016Nwjx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34d3dac-f164-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768407525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407525, "uuid": "afab3e0c-c09d-4cec-8863-8b9d1ccac624", "comment": "Malware payload (SalatStealer)", "value": "3d66f51ee0cb0d57b7aa48ab85d8d7da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407525, "uuid": "13b2dc3c-4aa1-49d1-a1cb-a91ab8525433", "comment": "Malware payload (SalatStealer)", "value": "7126f11ab47db1f6730d5ab765b4dc60a3d50c66c563876dd99323e89d809b29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407525, "uuid": "5e491862-0e55-4262-9873-62e96d592e64", "comment": "Malware payload (SalatStealer)", "value": "f420f6495e740fd10a6b6392dbcaad592872e168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407525, "uuid": "c7f40edb-2453-428f-8e3c-ead18710b932", "comment": "Malware payload (SalatStealer)", "value": "b6b732cea589926d56d2e30b40d606fb0938fa7f146303695ef3ccab4e44671eb00c117b512b28cce14be3ad6e42f977", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407525, "uuid": "bee73639-ae5f-4200-84a7-e592e4d86507", "value": "T1CDC65B51FA8B54F6E9031831405BB23F63305E048B28DBDBFB547BAEFC77681196A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407525, "uuid": "84b6756d-a6f7-41f0-9704-c24f396e17cd", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407525, "uuid": "00672569-401e-4264-8d44-e5c0c8109095", "value": "49152:J3sUKJbAeXy5muUDzayRI9tUREDrGApTKtzxtYBVhUrNzttgJCH4FbOXrpqt3Fd2:pHKRpUUaeggywxrMcALVa5YUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768407525, "uuid": "b70ae906-e619-410f-8198-ed8d88a6ce42", "value": 11657728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768407525, "uuid": "d3d3cb31-287f-4e0c-965a-16f7eb457c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407525, "uuid": "2e873784-d45a-4725-8de0-bf2c975446fa", "value": "0x0008000000024346-139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010c402d-f112-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1768372007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372007, "uuid": "c98f6826-1ce7-4e34-88d5-8ba3cba777bb", "comment": "Malware payload (Sliver)", "value": "4a1f2630678e97a52aefb5fda5148e9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372007, "uuid": "e8ff5a19-201e-4004-8e39-efbb715b7299", "comment": "Malware payload (Sliver)", "value": "712bbc0595edbd2357dade83f557e2dac1f39f26251b2e6bd667ca14baeadc7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372007, "uuid": "d8def396-47b3-4c57-af65-598ba2cd2f20", "comment": "Malware payload (Sliver)", "value": "1bff8e454d2749918a9fbd7b916f900a76fa3bb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372007, "uuid": "1c445e6f-5e59-4711-bdfe-d8654394f928", "comment": "Malware payload (Sliver)", "value": "383ffc3bfba52ba49bf085560d5a342e1c5124708c14e1e453b4d7ff7afbf33922aff5c9f38045f762f55bd085c98471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372007, "uuid": "2dc84d0d-5e14-4c4d-a391-49c5578a372f", "value": "T16B874C87F8E21DE4D4EAC570D526815BBAB23C291B3C23DB1690F7201F3ABD06A76751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372007, "uuid": "4a4aa401-1361-4b65-92fc-b61336db3427", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372007, "uuid": "868bee24-9e27-420c-92b0-532228f9e8cb", "value": "393216:CxityL05w5AJHvOcJVVOlVvyYTMokqp+q6LgTu1MQN:Cx7L0w5AJHv9zb1MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768372007, "uuid": "173cd495-2779-4fe8-b656-b91dd7f4ada8", "value": 37339648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768372007, "uuid": "024a3f97-148c-4ac0-b487-2dde54401a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372007, "uuid": "94bb1c93-d3fc-4557-ae06-331d11fd3fc0", "value": "SecuriteInfo.com.Win64.MalwareX-gen.15867681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922bc197-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418207, "uuid": "03dc0330-eed7-49bb-a0eb-5505404a50e7", "comment": "Malware payload (Mirai)", "value": "a60299f49994b6b837d963253e6ea31d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418207, "uuid": "b665ae8f-1883-42d1-baa4-4c692d60a40d", "comment": "Malware payload (Mirai)", "value": "73f3f3e2aa1f6843f25f8077c0e539abbe39966dd07fe930f105c30bf8b3641c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418207, "uuid": "a0ef0089-19db-4506-b433-5ac9079bb62a", "comment": "Malware payload (Mirai)", "value": "5a60b608f3a84d32c093d3bbe82c37bf98cdd4fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418207, "uuid": "bccfa2b6-ae07-42e8-b921-540adf1f7315", "comment": "Malware payload (Mirai)", "value": "8cb66e3eca28593a085f3e8a639156c656895837029982562cb335fa9238361f02aa75095f7fadb0653382ff772b4499", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418207, "uuid": "fae4f0f5-4e4c-4660-bd78-def13dfdddad", "value": "T13824B70E6F328F3DF7A986344BF75A20AB5923D622F1D545D1ACD2011F6029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418207, "uuid": "69dd9e7d-6b89-4847-b1cb-e8260d0d9426", "value": "6144:p28W0tFY9+zkGFApVzHBXWzzhUEGSwsqKHJ:k8g9+zkvWz1vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418207, "uuid": "0152d0ab-b458-4421-899e-fd5e4fd68e42", "value": 217140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418207, "uuid": "aa16b63e-02e1-4e6a-bee2-8fcb68cfaa38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418207, "uuid": "4a336c5b-7ec5-4548-ba82-3e60722d87d9", "value": "telnetdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1eae474-f199-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768430259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768430259, "uuid": "6df16bb0-5e68-4da7-b6d2-0f472197d217", "comment": "Malware payload", "value": "a53006169ad1a0f307daffc25cb7abfa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768430259, "uuid": "950d58b9-a94d-43f2-8e15-f4076860ced3", "comment": "Malware payload", "value": "7435e0348abf7c79711a33c217f6e6f3c590249122de3aaf37b07a95c877267f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768430259, "uuid": "087a53f5-de46-4c71-899b-7f2bd4bda9b6", "comment": "Malware payload", "value": "a231a79d25f64c96006532b48c5e5c580a3654a0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768430259, "uuid": "3e805b18-66af-4ecd-a2b0-4ac2d4a6dfb1", "comment": "Malware payload", "value": "d5fce0cec70be002febd0fe76f0cc1cdca703bfef4a9c96e578b1e74ff74276b89b4cc9161051bddaaadaeca02ce160f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768430259, "uuid": "24348f74-226f-41f5-b8c3-f2f58c6f8633", "value": "T150551BB0903501FCD3EB0BB8D0D6AD11EE9A406B73699E7E58D8CCDBA582D45772E603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768430259, "uuid": "fa8524b8-9fbb-454f-8690-155c08b45462", "value": "384:YA3NT1jxPq0MOyoUPC8u081JotmQRtdiPHg7Eu0vdqDgDFBeiP7KuAbqFXp4iPi4:Y4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768430259, "uuid": "52f16331-9667-4272-be44-467f3fca4172", "value": 1345330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768430259, "uuid": "ab16ee84-9b79-4fc8-a6b3-5ae172ecbe13", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768430259, "uuid": "44782d1f-5189-44f5-ac42-ad86aaaf9ca8", "value": "Booking_Information.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a479a071-f0ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768356390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356390, "uuid": "a24095ac-20ca-4a01-a55c-6c7cc13647d8", "comment": "Malware payload (Mirai)", "value": "ea681a6a0f2efe850db5eb86827a9571", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356390, "uuid": "516c34eb-fd84-4e05-9e7f-530eb1fbd221", "comment": "Malware payload (Mirai)", "value": "747a9e3bbe95b804d32fa3377d9d76a30bb46d45f6396b0357e3ec3410be0ee9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356390, "uuid": "bcde758e-8443-48b8-a681-835cbca76e59", "comment": "Malware payload (Mirai)", "value": "9cef02ae014c001f980c23db99a02701e2df2612", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356390, "uuid": "8bb1d5b8-b20e-4bb4-829e-0143b65d5ddc", "comment": "Malware payload (Mirai)", "value": "80143072a6a4377fbc9c50755333a21ed36ea08464211729f7589d47fa4adc7dca6e5f93377b4d7981920fe9fd33d54a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356390, "uuid": "85fc1e42-ba8c-4447-8a20-dc78f54897b6", "value": "T10FB339C1BA43D4F5EC1641306177F73B9A32F0791239DA87E7A89E327C92A419D0A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356390, "uuid": "25fce5d3-4f24-44d3-be9a-ca71143cf73e", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wgzSr9bMFfl3:Pbj4doYGFB0/45gdM9ul3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768356390, "uuid": "dd1da096-5085-480a-b779-ae74be2f05f9", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768356390, "uuid": "74ea4962-b05c-45e3-b325-c4a7c74e32bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356390, "uuid": "3a166b46-eff1-4d95-b4be-05444a8446d9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d0df7c-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418213, "uuid": "a328a91f-8455-443c-8c64-25fe10a3f797", "comment": "Malware payload (Mirai)", "value": "5c9b844138aa14637a95b78db74f8181", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418213, "uuid": "dc8eb230-80ce-4aea-974c-7e2d9c4ee1ad", "comment": "Malware payload (Mirai)", "value": "74c7f2c5f55356dece66bdecdf7737351f545dbbfcff706f4cb5e8548084fd10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418213, "uuid": "a30cb78f-6cce-4039-82ec-d8af3f4fda3f", "comment": "Malware payload (Mirai)", "value": "15389dce24ccdf94204ed2fe4bf380bab4f86e00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418213, "uuid": "ef42df5e-6302-44e2-b5bc-51a5b9c2efd7", "comment": "Malware payload (Mirai)", "value": "37b19d6d56e7618c303356e6e24694ebf4bd39cb8fe171c043e21ee05d61b8db386c5f9814b6852f1f02dd7cfde4e183", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418213, "uuid": "773d6766-08a2-41ba-90de-26cfd3ff8afd", "value": "T1EE343B46EB804E13C48627B9F69F42493333D754D7E77306A9296FB03B8379A4F62605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418213, "uuid": "7b0f57ec-b002-4fb9-8a86-f63d33e20204", "value": "6144:7rSc0ydkIiBi51CRZNaiaQCw3U3H0rWR5jV/Gxq1pP:vScgB8eZNafQCw3UkQ/pH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418213, "uuid": "29fe5178-fb29-4e42-9e05-3a3c1999dec7", "value": 239756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418213, "uuid": "9675bfa3-a007-4f0b-a25d-81f01391d316", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418213, "uuid": "b6ea9eb9-7750-4b26-9bfa-47dc26953719", "value": "systemd-logind", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5716e7c2-f19d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768431852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768431852, "uuid": "6ae39d25-d0e6-4126-a1ce-5ad9a2e91f59", "comment": "Malware payload", "value": "738a0a77839c22e11e4d7b772958bb26", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768431852, "uuid": "28a102d8-ac6d-476a-aa66-24ec4accec3c", "comment": "Malware payload", "value": "74fcf1e27180d840b8de78ec4cfbb48e5b7a43f13c579c9afbef17fc2b47ac02", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768431852, "uuid": "acc44aaa-4a4b-4642-94d5-b772a6728c82", "comment": "Malware payload", "value": "149cfcc1ddb77e4d3fafdad7295aeca7107d7a94", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768431852, "uuid": "2360bdd8-9ebe-4921-a8f7-22c14c6219e9", "comment": "Malware payload", "value": "1e8a02edc26e95fabafe4fe8018daba0a74a973c936677e927eb3a7e078a4fb0aef801e6aa84756c273d1288e87534ae", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768431852, "uuid": "ea650372-6982-47dc-824f-08f3e6c15527", "value": "T1BE825C0FB8424713D1A11074D6324BBBDA79A47633C854EBFBD48ADD1A686D2EC3219F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768431852, "uuid": "8d91f5c4-3d15-48dd-920c-9416717ff2f3", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768431852, "uuid": "55bbd675-45ca-4ad3-a145-fe125c2b6616", "value": "192:7lGSCngTBvUVqtbeGOy6fUrrEwP0D3le6U5KUSfnzQbSP3qc7xmJxTmv8U9cthw+:cIUVKV08gwP0D30in/izav8U9cJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768431852, "uuid": "1baddcfd-b089-42ed-8450-2e15c437d27a", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768431852, "uuid": "296dd021-f2c0-4af4-8fb8-1064c518a4a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768431852, "uuid": "b40c9fae-aaa6-4efe-ae49-7efeff33366f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d49f2d1-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768417984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417984, "uuid": "ae92dadd-0d03-4d39-bcf5-68d731a802bc", "comment": "Malware payload (Mirai)", "value": "6f90a8510c78ff2b4b257e9c7a050e8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417984, "uuid": "27053931-af25-4758-915f-ab6648a39608", "comment": "Malware payload (Mirai)", "value": "772a697699533f429ee8d317fab233df395d5b25a0e031771a176e7cb232879f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417984, "uuid": "bb542da7-1210-4536-99f4-6a3df7fe19bd", "comment": "Malware payload (Mirai)", "value": "6339e9f0a2d99907e6f276fc4dc98b85c6131885", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417984, "uuid": "bdfaa90e-e606-444f-9e92-268eb13454c8", "comment": "Malware payload (Mirai)", "value": "895c20451db3a492eb0db5bcdc5d5ba35802980cd3522f8361d67d5e49e58c89eab986e3e3a0980acbf24a9cced69a1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768417984, "uuid": "f4da8778-0df0-4094-a72e-f8a9945909cc", "value": "T1C7B339C1BA43D4F5EC1641306177F73B9A32F0791239DA87E7A89E327C92A419D0A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768417984, "uuid": "4290cdf4-a2e8-4aab-a88c-9d0755e751b7", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wgzSr9bMFflN:Pbj4doYGFB0/45gdM9ulN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768417984, "uuid": "18cc22d5-9027-4a86-ac80-5f07e881aab8", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768417984, "uuid": "c31953ee-354a-4ffd-adaf-b585ff657185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768417984, "uuid": "fc0786bb-213a-4ae8-9fe0-6edc2b52f416", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141aceb5-f17b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768417136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417136, "uuid": "29f8dbea-9986-4797-b22a-c5215e9084ed", "comment": "Malware payload (Mirai)", "value": "76f00234e5c7bb5f63fbec799a4ef7b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417136, "uuid": "87bc1aae-18bc-49bb-b748-ac3c9c6aa175", "comment": "Malware payload (Mirai)", "value": "779e71ec7020c1e9d2b802053ed79001161da48476efca43d3838d32f0db6993", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417136, "uuid": "5a39bea5-5e56-4695-9393-fbacf691583f", "comment": "Malware payload (Mirai)", "value": "53715ffb827e34c18199060229068582545665a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768417136, "uuid": "4ad769b4-d6a4-4c53-a5a1-e17fb6676eed", "comment": "Malware payload (Mirai)", "value": "528d7bb425ef34040de1d47a300928e80ce7eb11c6c95496fc2488e8f67ec1b19ac7393a7e66ba278899e1139f27586b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768417136, "uuid": "d6704785-3b3c-4ad2-97c2-bb45e7591bf3", "value": "T11AF3B50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768417136, "uuid": "ea787ef5-ec9b-4eb4-898c-592869c8e9f1", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwV:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768417136, "uuid": "28685aa4-15f0-47dc-b931-920e005e93f0", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768417136, "uuid": "e91b5b80-0acc-4d0f-b803-2af38b9a1aa1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768417136, "uuid": "0ea84468-b6af-4dd2-aec2-8ceb41f3a9f4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562223a6-f136-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768387612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768387612, "uuid": "81fe5d98-ae2e-4996-b465-7b0cb73486c1", "comment": "Malware payload (Formbook)", "value": "e481069cf2a151b3c4f90c630223db13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768387612, "uuid": "d0b1a237-01c3-4271-bd03-070e829b3d3a", "comment": "Malware payload (Formbook)", "value": "77be2ee5c55a9c5f20b6522fb6fbd174465481ad60b5143c95ee31e16fccaf8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768387612, "uuid": "e8e560be-49a0-4268-8c9b-3be56ac38eb7", "comment": "Malware payload (Formbook)", "value": "ec9b99e2caed243fc255b4512dd74e1b4d475f53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768387612, "uuid": "0e155e44-e401-4a6c-92a7-e303e35dbe45", "comment": "Malware payload (Formbook)", "value": "57eaa4af6882acf682726909ca37602853931db0e0c0a29e2f97f4489c013cf7ba0bf6972dbb84defe3faffc97362a6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768387612, "uuid": "ad5ef707-492b-4d40-9057-ee798ade80b2", "value": "T13035F158229ACA02E1E55FF12972E2F407787EDED820D3578FDAAEDF7865B804509343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768387612, "uuid": "732248aa-f72d-49d0-aa99-2b23fe3c9a60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768387612, "uuid": "30a98a46-805b-4848-ad27-7b1b10b26aa9", "value": "12288:2r6/wUKCowCFzNX7+sgWZz4LzzeVuoFuyZym5hGCnTMVVuttiZE9e7JxsIvzHjbV:HTTcNXSWZz47DUXZLuVKsE8Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768387612, "uuid": "50fe5da1-e383-4f7c-af4d-ac22d9aa428e", "value": 1083904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768387612, "uuid": "700cdf12-f6c5-4eab-93dd-385b2c0e4209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768387612, "uuid": "0ea5821e-f0ba-43f4-9d5e-6981ba3bc26f", "value": "MV GOLDEN VESSEL INFOpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c98a5e4-f119-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768375060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375060, "uuid": "107cc8b4-6753-46db-bdcb-277b23ed20eb", "comment": "Malware payload (Mirai)", "value": "3972a4c7e6d2d4b222354dadf46cec79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375060, "uuid": "ffb5dcf3-046d-432a-b37a-dad5fb5b5c3e", "comment": "Malware payload (Mirai)", "value": "7b0c7909fb060fe012799727776e56a27675a4e40b7cf826e439f5ccc29622a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375060, "uuid": "d100c409-8a1a-4b2e-bbcc-65269bd11b82", "comment": "Malware payload (Mirai)", "value": "81b4a4941236931b2a8977b7e741d5ac36efe8f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375060, "uuid": "a300cbe1-944b-4ad0-ad62-2ecc9b75c8fb", "comment": "Malware payload (Mirai)", "value": "69254a8e3e77f79dd78a8e78178175924e9e35c2b38a5706883a8466716a8ba125325b304cbd41894581b6780c0ab8e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375060, "uuid": "f076548a-5178-478c-86d3-50fc66b07b38", "value": "T1E0C37DE47A8F3D91E2C7D33ECF844AA2712BB5F4C66592F0BD01132DC1EADA989E0551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375060, "uuid": "6a24b102-a427-4533-92e3-cf91b30d0671", "value": "3072:Md3oNj8jSqlKMLWEFcf74B7T7QFllWe8o:Md3oNy/hFq4B7TEf4ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768375060, "uuid": "d1c77713-3721-4572-bdce-46cbeb4ec841", "value": 124784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768375060, "uuid": "8640f11c-fd45-4ad1-99ea-9d77d2a43fde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375060, "uuid": "6cbffeae-d2e0-4a39-898b-e0357d7bbe0e", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c09208-f149-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1768395906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768395906, "uuid": "19d0343c-8b6b-4e89-a413-c11634d59374", "comment": "Malware payload (QuasarRAT)", "value": "2d93a93ac6d864458c6f847f641c8544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768395906, "uuid": "7121b51f-8037-4802-a073-f5fc3a6fa4db", "comment": "Malware payload (QuasarRAT)", "value": "7c39c65da97ff1706ccf6e65c053468220afc6d5f551e96bcc031018a3e658d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768395906, "uuid": "1ddf6f73-f6f4-4e5f-b9e4-a9b173bcafa3", "comment": "Malware payload (QuasarRAT)", "value": "5c21bcb91330ac4cbb5103ac05c0f476446cc5fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768395906, "uuid": "4f333301-2615-4397-9795-c248bfe94a0e", "comment": "Malware payload (QuasarRAT)", "value": "e8a160c8bc342d591132fccd2f2c70bfcd38dcbe8236f6aebac668fe824fa146d2a006e145e944664fc440f1caa0b1f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768395906, "uuid": "b3ae9e8f-3a56-4a42-850a-645224eba775", "value": "T18CE56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768395906, "uuid": "fc117506-564a-4794-931b-83ad5eccf7f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768395906, "uuid": "988d21cc-8ecc-43ce-978c-b18358eba8c7", "value": "49152:jvvhBYjCO4Dt2d5aKCuVPzlEmVQL0wvwka0sRJ6vbR3LoGdUTHHB72eh2NT:jvft2d5aKCuVPzlEmVQ0wvwf0sRJ6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768395906, "uuid": "3814b83d-b69a-4c5e-b81c-59da703567ff", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768395906, "uuid": "f9242e58-de1c-4095-84a9-a3febc26f42a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768395906, "uuid": "2788819d-0e85-4bed-8c1f-06ba583956ab", "value": "Beamer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909b0cb3-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418204, "uuid": "a496d7f7-19fd-46bf-add4-985e4d1061db", "comment": "Malware payload (Mirai)", "value": "e82944c99ba861bcfaf95f431dc5ac83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418204, "uuid": "f4638355-7d4e-4f2c-8a98-4c8ffd84a80f", "comment": "Malware payload (Mirai)", "value": "7c9a8866b35d369204638a2033e4cc9111968f55edb1b0f14946f87d1064760a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418204, "uuid": "56da24d0-d061-40e1-bfb4-6f591eeee75d", "comment": "Malware payload (Mirai)", "value": "a189f8195e651a3632aaaa779e268162b45d577e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418204, "uuid": "f8a2f19c-00c0-40f5-bf8a-ca703ddd1209", "comment": "Malware payload (Mirai)", "value": "1d025b9972548184f8106f0f8e199d39e2b3d384097f551a65848bfd52e77b7cb6e488273d35f01530c8dc8d7c219619", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418204, "uuid": "f82dc13e-56fa-4a24-8fc1-9f7316df92b8", "value": "T1D3C36BD4E28FC0F5E81215717076FB369A76FD7E203EEB43D3A89A2198A3581C51A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418204, "uuid": "31c29636-d3dc-404b-8107-ec159368fe3e", "value": "3072:id/Sh4pHPmVbFrpa3SQJuXblp/Qy25tzvm+auXaaaaaaaaaaaay38S:iVSSHPmVb+iQbzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418204, "uuid": "17d644a4-62a4-4616-8dc1-185a7d9ae740", "value": 126504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418204, "uuid": "e788f5b4-c305-4550-977e-f24e9e8efc49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418204, "uuid": "aa686e6c-6c83-4f63-8804-62b58fe4b6fe", "value": "sshdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4dbe078-f169-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768409756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409756, "uuid": "789633a6-93f2-4350-b87c-17bcfe433f29", "comment": "Malware payload (SalatStealer)", "value": "226cbd772811094742b5ae0948b06407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409756, "uuid": "21453855-5958-4f53-8702-a0d7ffa3e7a6", "comment": "Malware payload (SalatStealer)", "value": "7d99b6d7af35c5ef22b4b812c6189d159ca665108c354118be137516997225ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409756, "uuid": "a727de2f-5ee7-4a46-9910-9ac9a136b82f", "comment": "Malware payload (SalatStealer)", "value": "4bc18c00b0eda5cf0257840c5a59258c65b4b5b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409756, "uuid": "1b39d64f-f2b2-497f-ac10-4db7ea9210ee", "comment": "Malware payload (SalatStealer)", "value": "248caca5ac978cdefe1068b3e3494e20a036e8965b4dfd636473597e7fd47d2dbbcc47fc07b134fef25f8de3ecc94e29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409756, "uuid": "61b1dc1a-1966-437d-a4b4-91170e24b5fc", "value": "T13DE533334F3B95BBF20A5BB056D7178A514E784BECEB6005D4280FBB08B6C49B3D2565", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409756, "uuid": "d1125f19-c7d1-4600-a081-e60e596666f6", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409756, "uuid": "bfaec8f9-7ccb-45c1-af71-91d64250f612", "value": "98304:EBavsiawZQAWQsCGDYzk7NLRSwQSPeguM:EWBIAWjiz4p/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768409756, "uuid": "3d87be9d-d34c-4518-a783-c083eae136d1", "value": 3292160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768409756, "uuid": "e3ee8a2f-e62d-4fc5-9cf4-f98a87b55448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409756, "uuid": "669672b2-840e-4073-864a-1165e2962368", "value": "AntiEac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed59b61-f170-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768412698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768412698, "uuid": "13b6ff47-055e-4d1b-87b7-0ca364db8f59", "comment": "Malware payload", "value": "b52ab9c509d08953131ea5f0c68c6a15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768412698, "uuid": "9283e9c7-c853-45d7-a38c-1fd105f0bc44", "comment": "Malware payload", "value": "7db4bb43f1a287596517762d5bb993d558af01cc96f8aca96c9fdd44141608d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768412698, "uuid": "8fbaa632-526b-4d45-b532-58c6cdae5195", "comment": "Malware payload", "value": "5f83dcf6033f8f360a25655bcbfe7cff114c53d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768412698, "uuid": "5fb3926c-051a-4221-a174-919d14a79f31", "comment": "Malware payload", "value": "19dd3a6bc1ee0f2c6ac99c28ddffb463cf13c07879a53b75179b4a7b8eb073dcd8efa62f358e21980423c465ee718b20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768412698, "uuid": "e7dd26c5-2bc4-46e8-bf71-879ec185ba62", "value": "T1BA02F5B392609CB1E81C0639745B02B89783D5F60AE6BF828D6AC438194E584AF34F6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768412698, "uuid": "346486f0-1091-4f43-9013-2c878d96e037", "value": "12:Bvwv6aOZt43n6pEUwRPHUwK6QAX46Q1jR6z7ayUX8:GCfg3n6pQRPhFTXxz7ayU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768412698, "uuid": "8039ad92-723b-4d67-8461-435248d6235d", "value": 8984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768412698, "uuid": "6c982751-2548-45b4-90b4-5d44e2ca78f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768412698, "uuid": "8dabac06-66a3-4a7e-95a8-c9ec1c5e1464", "value": "react", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff3ff25-f150-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1768398768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398768, "uuid": "d56e43c0-0ff4-483f-b6bd-28807a06a680", "comment": "Malware payload (VIPKeylogger)", "value": "b5b9b22b0b68f53a02d9ab1e952b2bc1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398768, "uuid": "deb18652-91a8-4e63-b2ae-0939baf564b8", "comment": "Malware payload (VIPKeylogger)", "value": "7f53e2245e172269ff543ed024ce6c8cf05bb6cfe99e5085369f2142f646923d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398768, "uuid": "d77cb9d7-b1fa-4035-9955-e829278c29fb", "comment": "Malware payload (VIPKeylogger)", "value": "1492a5c0810504604804275a593451295651f71e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398768, "uuid": "be5abd3b-6f25-4032-baca-d6dcd85a2909", "comment": "Malware payload (VIPKeylogger)", "value": "aebc2d3c5706cecd7a344e85b0c9fbee0fb3b9cb4e2e6a350bd7dc97041177fae324556cc1d0b029fefe540c50a84ef4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398768, "uuid": "a1cb6ff4-b365-47dc-88ad-482c904059f5", "value": "T19F6394CD7FE6B671276160732D1FA09EF72E5C88790C8095E3A7A890F92C318E27565C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398768, "uuid": "89f4f033-1aa5-4b9b-9858-4729e2c02547", "value": "1536:fSHiKsjI0M94B+4ipYyri6r+jXGGoFQ9OXV8V4sq2ZxnmFe:ciKWF+4ipYyrifwl2/m4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768398768, "uuid": "70455fdc-8982-47c8-a7fe-ef90e711431c", "value": 68774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768398768, "uuid": "72099fd3-fbd9-40f5-894b-0a438eb6bb77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398768, "uuid": "c6445cf0-f6a1-41a4-8e99-14f52bdcdd3a", "value": "BadaTek_New_Order_2026-01-14.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d398c94-f117-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768374256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374256, "uuid": "07be1b7e-4d3f-4948-aa1e-c3efa43f782b", "comment": "Malware payload (AgentTesla)", "value": "2b539fe8cef15bd243a3ee71fbb1ad78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374256, "uuid": "75588f58-d19e-4f3f-9aae-622db7775de4", "comment": "Malware payload (AgentTesla)", "value": "80af6c7383d6f577c5f5a0cdc3fb862805e887b9aca9b11c39504bdbbc31463a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374256, "uuid": "504a7bf9-0fbb-4d8e-a30a-069be78e29e1", "comment": "Malware payload (AgentTesla)", "value": "a32e1e20d2d05ee01c274999d35568d32e4ed0d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374256, "uuid": "b192d451-7900-491e-a0d2-6ec08f153d4f", "comment": "Malware payload (AgentTesla)", "value": "0f078349587de211600eb1f103d178eecdb0d7e42575cd0ae61caa423e71c2795879a291ed3361aeda61e43543d85cb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374256, "uuid": "2854495f-0bdc-43c4-a887-99a402029fb4", "value": "T1DE742A23E660B425F55346B02EB9A25638293D391680ED0BB78DDF8A3771A8374F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374256, "uuid": "c02f2816-008f-4fcd-9f2b-97c4dab42577", "value": "b758e80498eb19fffec8c151ac285503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374256, "uuid": "691472c4-6e95-4057-90c8-bd0aa65a24a4", "value": "6144:L1zRX2xqlmk+OiOk1LnqTTCZ3YWWi7v15macVxy8PUE+cL/OHEN:L1zRm8eLnqTTCZ3YWWij+VxBsHcL/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768374256, "uuid": "48697ce7-b863-4624-a309-7e429047554b", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768374256, "uuid": "d178eaaa-6f22-4356-8535-274332644683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374256, "uuid": "0fadf30f-fcde-489c-a0cc-56204ec6090d", "value": "OCALMACEN4ALM40000187105.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780b133a-f18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768425465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425465, "uuid": "ab260858-6ebe-4ba2-b000-b837ad432c9b", "comment": "Malware payload (Mirai)", "value": "0dd24ec97080e688f0408b71528e2601", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425465, "uuid": "f16582a7-4d24-46ab-9f86-9dc1aadc531d", "comment": "Malware payload (Mirai)", "value": "80da1948c77b5ce6ccefb9c74e89475d1e4c304cb5a57ec356780af24e0db86a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425465, "uuid": "d36e61db-af9b-47e6-972a-e833a5ccd789", "comment": "Malware payload (Mirai)", "value": "2d8b40cf09757efe00b867a22ebbe836b2d5bffd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425465, "uuid": "1222eb6f-40cc-4468-bda6-4df2a24b3abe", "comment": "Malware payload (Mirai)", "value": "bf37726b4b671b0de1658fd794fb8bd1e395c9cd9d114b0c5ff09b8bc15076294c9b08dd62bfe1ef958ca3c0f1d559a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425465, "uuid": "03299b28-8851-4548-84f1-cdd766a87e80", "value": "T1F8C31B96BD429F13C6C366B7FF9F068C371657A8D7EA3202D9296FA033874C60D1A215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425465, "uuid": "8bb4fd7a-3b9f-44ce-a1e9-8e3adbe85485", "value": "1536:YsopuFXTn52DmTEXhtZZq9ggEFKzwvEUVmZrVyAirONWn8S+PPupssgqUB+2b2dp:2pST52a4XrwzGEUVmKAatcGy+2b2dJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768425465, "uuid": "89796d73-b2ce-4f5f-a1ab-228e9d97dbe0", "value": 121592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768425465, "uuid": "850d01f2-47a8-4ef8-b104-261dd076470d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425465, "uuid": "6bc66f0d-8ef0-4d2d-8d4d-d15db6432e17", "value": "2016Nwjarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24485d4-f0e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768352172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352172, "uuid": "9f37dbd9-4559-4494-8736-af4b9abccad9", "comment": "Malware payload (Gafgyt)", "value": "e69b92d0d0cd68dbafac93e08b59f93f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352172, "uuid": "a32bf910-d5e4-4da7-9c8b-3b34fe195c6e", "comment": "Malware payload (Gafgyt)", "value": "82f487a075dbd05837359732eecf1f087352f582d867fd3540e8a918024f47fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352172, "uuid": "76385e49-f86d-4acb-90a5-d3ef9482b85c", "comment": "Malware payload (Gafgyt)", "value": "d51698100f5aba313f27369dfa945408130bba39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352172, "uuid": "0487a77d-94f1-4a39-b9ce-34a365ae40e5", "comment": "Malware payload (Gafgyt)", "value": "9e01894c44003971d6b5b86e8eb1691ddc556330d2d89596874a7d9d93d6b97520e5022ec6e0f6d603b03050e233d002", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352172, "uuid": "96ce284b-ac26-4afc-a5a3-09325b3187e8", "value": "T18083C90E6E619FADF7ADC23447B74E21A75823D623E1C685E2ACD6101F6034D246FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352172, "uuid": "7336ce15-2ee1-4d7b-aaa1-6a9671b34df3", "value": "1536:BrVXqjxRtGuulq1AMmU9xoaoUR/SR/qY/1FKNN76YQ2HeeaL9V:BRMDylq1vPxoaomNN76YQ2wpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352172, "uuid": "446488e3-70b2-4968-ab3b-c3950ff30296", "value": 85164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352172, "uuid": "99bf1612-223f-492c-a4dd-b495db9f661e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352172, "uuid": "287dd13b-58d5-48fd-a892-cdca7affa182", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837e17f4-f16b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768410451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410451, "uuid": "1fd313ef-5e34-4f7e-ab49-fd4be0674c20", "comment": "Malware payload (Mirai)", "value": "d58f75b5498771639471c704a64c9d26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410451, "uuid": "b71a7182-2fd8-4ebc-b679-fa5c1a3e3c2d", "comment": "Malware payload (Mirai)", "value": "839a72e0156de331eec417adf3f897e47a7100beca08679c6476c760dbac05db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410451, "uuid": "f5fa5e6e-eb75-4e73-82d6-67d3ded7496e", "comment": "Malware payload (Mirai)", "value": "a055d85c495f31b6e566701f6dd028cfa06b8b2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410451, "uuid": "de2d615e-1656-44ec-8206-aebad71737c1", "comment": "Malware payload (Mirai)", "value": "9a7510f651c70178272631918411a821d4ff30be1e7f347c64879a5fe7813a7118d371097f9fc524cb803eb9b5b26dd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410451, "uuid": "c851d0cc-5350-4cd8-8429-0c9ae4af9321", "value": "T18BD33845B9829A27C5E523BBFA6E018D332563E4D2DF72178C215F217BC681F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410451, "uuid": "0540a636-b229-4b4a-8dea-cd36ea96fded", "value": "3072:8nFif7apx6XS+kUgpjWX60yMgcWOgc6ZzyQSk:8n8ZS+dQWX60ydsgr+QSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768410451, "uuid": "210901ba-6129-42cc-a906-d9cd8e67b07f", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768410451, "uuid": "8674e06d-1378-4921-928f-3a3a2f4ac82b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410451, "uuid": "40125cfa-f4e5-4afc-b018-250aba0b058a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19594261-f167-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1768408555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768408555, "uuid": "b4b92e05-b4a4-4fc4-bbc0-5f61c1b12301", "comment": "Malware payload (ScarfaceStealer)", "value": "00aa223b1f1f7b040f37d138bda395f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768408555, "uuid": "126aeaae-1b4a-41ea-a633-57dff296b8f1", "comment": "Malware payload (ScarfaceStealer)", "value": "8403c2ff313b4e38fdbc2475c481949872ca186e199b09f13ab846c39a725a3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768408555, "uuid": "26db7e6b-2461-44d7-84f0-45ee2a350cc6", "comment": "Malware payload (ScarfaceStealer)", "value": "430ae710ae95763cb27815ac3547d93905ffc417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768408555, "uuid": "68f60beb-3958-4ccb-a203-3a4213ca3172", "comment": "Malware payload (ScarfaceStealer)", "value": "5ab4fbc5d48eeacda8421f3e57883ea6f8a44a9cecafa9f27a25da2e30b641bc8ef0d2e167a92092d598a4d92c5c4fae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768408555, "uuid": "7e968906-917f-4f2c-83dc-862f4576259a", "value": "T1CDE623D77EC863A4D48B8DB0E14F279E38D1B34988FA952E37C61D03E570E674646A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768408555, "uuid": "e549d9ed-5790-4e8d-a0b0-7a363692ceb6", "value": "c6e890f2bf1c766e673a9f6fba99f26a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768408555, "uuid": "5d201f82-4735-454d-9fd1-0a5dfe923b86", "value": "196608:Xqrzmn4QMapcQVTn/itz10pHJYg8CgCmNtFqeC3UOkl5+b25Uuf7Z1BVkeSw:XaOxT/45UO7q/Zklguft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768408555, "uuid": "7807fe0c-4c5c-4fb8-82a5-9a7f3b3b3a04", "value": 14652416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768408555, "uuid": "45a67f49-7992-417c-a4a9-e324806cf780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768408555, "uuid": "cefd39da-6fce-456a-964a-3761a1e77535", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158bf2ce-f117-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1768374189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374189, "uuid": "badec4b9-ea10-4fc0-9e0d-f73c506126a9", "comment": "Malware payload (PhantomStealer)", "value": "5bc0a1f57326b12ab4279e69f9c7bf60", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374189, "uuid": "71218976-fbe8-422b-ac37-850b8e216072", "comment": "Malware payload (PhantomStealer)", "value": "84be2af5bb5b02a2528fa3ecd0b2119b8ae6a74585c821e8da1c414b0843a0ed", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374189, "uuid": "0d1c1063-a41a-4692-b7e9-a169602bd92f", "comment": "Malware payload (PhantomStealer)", "value": "214561ad708111f3c3454a0e2f601fdf4f0b2ac8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374189, "uuid": "5c2fa427-334a-43a4-9a31-9dd8de09c392", "comment": "Malware payload (PhantomStealer)", "value": "6ab28d4c7e5c9cdb1c7967766454af66778cd9f8450946b7034b9cc638b02a16044c64ef999a7d473838a17acb5415ef", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374189, "uuid": "0752bb8d-065c-450a-9200-4da9144e56c3", "value": "T1822373CC3FC1B5A4472178732D3BA06AE12E4C40765C84EAD96791D4BA7872CE4BE97C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374189, "uuid": "f61e2dde-9a77-4a3b-a00b-d7d4a8a36942", "value": "768:Jkpj9q2JBjYx+KNRtcbJrrgdLr8WUhrPQol9UbQH/zytSgGtWu/sF:2j9q2Xo+00rrwUrzIHFjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768374189, "uuid": "94339aae-fa41-4d9d-bd9e-ab49959bd552", "value": 48874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768374189, "uuid": "47fa8980-3ff9-45c0-aa27-ced0b2509cae", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374189, "uuid": "44f76106-fb52-4322-a53b-4ebddc85fb9f", "value": "New-Stock-Order-2026-QA-214.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456fc4c0-f141-11f0-a129-42010a9c0007", "comment": "Malware payload (Gamaredon)", "timestamp": 1768392308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392308, "uuid": "69aa7ece-49d6-4b68-89bd-b4e48b84339c", "comment": "Malware payload (Gamaredon)", "value": "c5820b229dc8481ddb15de49a16c827b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392308, "uuid": "5253a4bb-98db-4fd1-badb-48e15ee4f37f", "comment": "Malware payload (Gamaredon)", "value": "853ce6e1ed15c20ee25bf205cd7d67a83b6c73a8d1c5053cd4dba2b77c1bf62e", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392308, "uuid": "8bdfc8db-105e-4b29-8b0c-e07959e14863", "comment": "Malware payload (Gamaredon)", "value": "d9045ebadf27c0dd99f2dfb50bc085f3c67ecfae", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392308, "uuid": "4e29b6bc-0dcc-492c-be79-5fd5085dbdec", "comment": "Malware payload (Gamaredon)", "value": "4cb5427d3b391c166907b942856e6b989936161883114668b89052f3f1392dd4bcab1e09352328087079b52b012fc9cf", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392308, "uuid": "02f7d0f6-6ff6-43bb-b96c-bd38462aab7d", "value": "T1C243DF64185EE8D40019282EB4C4B91934A0B6FD89CF27215AE1D874BBEF6C70B7EDD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392308, "uuid": "6a9106c3-2ccb-4e4b-935e-fb03210ca01b", "value": "768:uBBoiYSE2scmVEaAEancdo5SGs9P8bqqf+JC306UIV1fAxSYr66Sd46er94zN0HN:uBBoPSvnCOOd6fzyDNSd4FgANMBUcC6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768392308, "uuid": "5a2b13b6-582b-4c08-a1ec-5a50492d8e7e", "value": 59782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768392308, "uuid": "a22a2eee-dca9-4f11-92be-02192b40e922", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392308, "uuid": "e4b43e9f-8086-4eae-80bf-9dbdfe730456", "value": "1_11_5_1761_14.01.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a9210d-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418109, "uuid": "49a90e86-d3d7-4ed0-af8f-d8be0c7429b5", "comment": "Malware payload (Mirai)", "value": "c618f31ce8a75453ced98a3d8851fd82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418109, "uuid": "1799fa5f-55ef-4bf7-ad67-7332ec213096", "comment": "Malware payload (Mirai)", "value": "85a4bc45ce91a9a516217650d9c611b9c3e482832fc7c1be092ccd624d594f70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418109, "uuid": "cd29d92e-ba17-47e3-a47c-22030938f412", "comment": "Malware payload (Mirai)", "value": "8579c3922affd7366d94d43469523b4bd556c6f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418109, "uuid": "0c898fa3-f2e6-4fd3-b6d8-9e3079ce4cd8", "comment": "Malware payload (Mirai)", "value": "7980a4343767fbc67b9c0352de9f92edf528fd38cb0db899b80c404865a63d5e1b8ba1577684c7eb04108146bc7b2cbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418109, "uuid": "fc86cef0-dce3-47eb-9eea-12e4ff67c66c", "value": "T1DC53F2EF51ABF6BDC233B13F4479652799962C2BD3C13A0B66A232FA0E19F047855C11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418109, "uuid": "ea251fa1-77ef-4cab-8fe4-4da9475d96bc", "value": "1536:+HUBe9cRCXOq61qtVc2yygFOEsGnfqHNGXWMFoLEAwGAOxkWlL:GUBwUCXOR46lSEDfGGXWM2EDLPcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418109, "uuid": "1f81d6eb-a431-4d48-9e65-2cafddd3e42f", "value": 64024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418109, "uuid": "68926ade-6822-4021-bb5c-5f7b2e7b0d8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418109, "uuid": "37a9b634-7901-4629-a88c-9a8c32de5a68", "value": "systemdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc33939-f10d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768370227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768370227, "uuid": "4c97f1e0-5392-49e3-aec3-988d79aa2e83", "comment": "Malware payload (Mirai)", "value": "2af5e570e968a05f233f518fc65f814c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768370227, "uuid": "1f17d700-3ab7-439d-a660-73478d82feea", "comment": "Malware payload (Mirai)", "value": "85ba85459af40fd8bf83394abbc805eab3c72da34411e673c90747b45eda7400", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768370227, "uuid": "15e984bd-76f0-47d8-93b5-e89c5f125892", "comment": "Malware payload (Mirai)", "value": "db0ac4c84d2b16307d3a1b8b24602efb0aa54ca8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768370227, "uuid": "1870471d-3a1e-4582-8e54-55f79f453269", "comment": "Malware payload (Mirai)", "value": "f8a1814c2ee57766f862c8d05f55243eee83695d151f7211df2ce6e1ea75f8eda78ccc8fb2f8d4df15b65a518751b7e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768370227, "uuid": "133631cd-e021-49b6-a5c0-a85c5dd2474e", "value": "T11FA30849FC81AB11D5D565BAFE4F128933135B6CE3EE72129E245F2123CAA5B0F7B402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768370227, "uuid": "605e458c-7cad-4858-bbeb-03c7e0a2c05b", "value": "3072:5ac8t1tSgs4rN83ZK4haANG2/JlWVQBu42NsL0MCy:Yft7Sgs4rNoZ9haANG2/JljBrSsAMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768370227, "uuid": "d99abc2c-ea46-4360-b371-061156ffdb6f", "value": 99808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768370227, "uuid": "816add96-22df-40bb-b089-eefd89697f2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768370227, "uuid": "a9f23256-01f5-4254-9601-c29896b5d206", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c03aa72-f15d-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768404265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768404265, "uuid": "5b2b392e-5246-4a8e-adfc-3914c27d07cc", "comment": "Malware payload (ConnectWise)", "value": "d1a649aca42dc8fa49294cabb7df8bd0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768404265, "uuid": "c0c1e9fa-f468-44c6-bd5a-eb8ff8f6fcde", "comment": "Malware payload (ConnectWise)", "value": "85d0ed0e885b9e123e9057589207bcd85fc72f0c39326547d43db111ce40b251", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768404265, "uuid": "d905995f-836c-48ea-a831-80b3be35cbbc", "comment": "Malware payload (ConnectWise)", "value": "d0f7c484bcc92995b0e530e7baaacfeb027f81f9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768404265, "uuid": "61ae3d5f-c9b2-4b94-ad3d-79a4d65f9f66", "comment": "Malware payload (ConnectWise)", "value": "1e94bb5ad38ef7ed9b74211b8460c0cff6728f82789398325be66e4e207aca015457a6439b3e0127f23d7a40486c8489", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768404265, "uuid": "fcb066a6-905f-4078-9042-4d1740825b32", "value": "T1C3A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768404265, "uuid": "333716f3-5f2e-403a-8d35-c87602b33c44", "value": "196608:eKaLNkbgzi4QRKaLNkbgRKaLNkbg1KaLNkbg:AWgziH1Wg1WgpWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768404265, "uuid": "1203f005-623d-4ccb-87d0-ca60bfafdab7", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768404265, "uuid": "5297e3e8-d534-4343-b59f-e927044af389", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768404265, "uuid": "a75bbb8c-eb8a-4201-adcf-249fd55de928", "value": "invitation.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3989c96-f11f-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768377944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768377944, "uuid": "79213177-9a7a-4891-9a64-8e0accaf8c4f", "comment": "Malware payload (AsyncRAT)", "value": "38fd01bbad0a42551f722d13a1994c24", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768377944, "uuid": "d4329e20-5f08-47cc-95a1-7bc8fb2639fc", "comment": "Malware payload (AsyncRAT)", "value": "8714fe86182dbb4d61b9af83e175d75643980a78251b7f85700698de395ffe62", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768377944, "uuid": "cdd55d41-1d59-4e43-a84c-2513fd9d5be9", "comment": "Malware payload (AsyncRAT)", "value": "0abc47cabeeac75cc2617a4a928c09c83d265777", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768377944, "uuid": "7ae6b51c-8568-4b99-b1a1-43a7e6e51a88", "comment": "Malware payload (AsyncRAT)", "value": "0283318314aeab9b2f76bd9f21244a2253408c7e5a6e1f54fd9b054509eb97d887f6b16c85294de986f72f9944a0bed7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768377944, "uuid": "95ec6b8e-0087-46e3-a828-47ec631be8df", "value": "T1EE535C0027C8C965E1ED4AB8ACF2550146B5E5772102DB5E7CC804DBABAFFC64A127FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768377944, "uuid": "dc030ece-8c61-48eb-8ee4-f447a91e201a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768377944, "uuid": "5b9a9ef7-3fe4-42b9-8f34-54e77a5f25be", "value": "768:h4YOYBnSyiPYbtiF9JU3cXveeObMbNCl1+6SCv7mqb2nIpwH1oBXnd4wDL8GElNI:hVSJrYeeiMl8GbbXwWtNUG0NVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768377944, "uuid": "cef8b283-f301-41ef-9264-fa0644b09e4c", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768377944, "uuid": "82c00511-7f44-4047-b0f2-4fb0adcf8254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768377944, "uuid": "f67f1117-72e8-40cc-913c-6e79f1f99351", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402192f2-f0ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768356222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356222, "uuid": "d3947e98-6917-4e0b-aca7-342b839d0847", "comment": "Malware payload (Mirai)", "value": "9494e5354c5151a7fc01803e8217c3d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356222, "uuid": "2027928c-e60d-4afb-ba15-3962a4cb2d78", "comment": "Malware payload (Mirai)", "value": "8722364e6484393e70c820ce1cc25a6835bf671eee7d535c27906e39e9a59835", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356222, "uuid": "ec41ab89-b342-48e5-b9d7-5db5dbc7f87c", "comment": "Malware payload (Mirai)", "value": "6d3a2325f8dd1a0cec8e5c3afc3116dcf8b70cdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356222, "uuid": "cda69314-718e-474e-b700-3499335cf07c", "comment": "Malware payload (Mirai)", "value": "5f96f7e01e62267271c1ba1bdb386d30a3f8acfc31ebbe4fe6cf7df94b6a050a597e60aa4e8206301b2c8749513371a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356222, "uuid": "df8960c6-679e-4989-a23f-43fe5ddc316d", "value": "T1C93301B3E0F2CE99D63B50729BFA361C3890E0C93812FDB8F7991437A5807586638756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356222, "uuid": "e117e2b9-919a-4de9-8067-932ed46d80be", "value": "1536:9aeFnHdiMWc0H8eoafE6qJl4PNkG4NQrNenouy8gyZ:9aeFnH3OI/ll6N8outP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768356222, "uuid": "3a8b17ad-4571-4099-973c-5f0c3c8f3be8", "value": 52996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768356222, "uuid": "dd4a9b3a-ecd3-4255-ae93-9d46784e1162", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356222, "uuid": "012ab963-d069-4bda-922c-49a628ef439c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff966af-f124-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768380032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768380032, "uuid": "485e108e-eabd-48a9-9260-10b6a758d251", "comment": "Malware payload", "value": "8227c1f7b78c2d26fa0e6794cbe2efe8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768380032, "uuid": "f40befc2-b933-4347-b5f9-ad3827c9feff", "comment": "Malware payload", "value": "878db39e59977919a1dc652293c9335f4569a607c9f65cde754f5066731f4d47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768380032, "uuid": "853e488b-df06-4f4b-b103-e3e7c716795b", "comment": "Malware payload", "value": "ede015b0a6d3161a9d3d1d53eec4d0d2c22c125f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768380032, "uuid": "7f3598e7-bfb5-4548-851f-be3ec1fa83fb", "comment": "Malware payload", "value": "837963aa50ddb08621ef15ef0282fbcde49e0e31bea95be4d3bcd94602af237828494571bb9a953ca1ee0756ab4fed84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768380032, "uuid": "2e8ebd1e-4518-418a-a4b0-b106f3090d7d", "value": "T1ED1523EA3FCBA9ED5E374E554B0382DC22E3261BC8E87D56798C2D6407472A4717278C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768380032, "uuid": "9aea0dba-5368-456b-a308-9d6da8d89aa7", "value": "24576:zit1JUGplKm21od3sLtK1UJbhifypi9yTddShMWQ:zUOGOmOCcLm8639UiKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768380032, "uuid": "b9d51743-f191-4bfd-965f-7a48a78710c4", "value": 917211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768380032, "uuid": "968d7902-5be7-4c3c-a78e-81b8a6d1a019", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768380032, "uuid": "a4ba30a2-540e-4f2f-9738-02a5a3a48e25", "value": "bizy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656af8ef-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418132, "uuid": "76a0071d-7958-4628-8e21-1a0f2f92d55f", "comment": "Malware payload (Mirai)", "value": "0839c9c38126c3692fc9dd6ef3c156db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418132, "uuid": "0056a0e6-ac49-4027-a2c6-30c10d38a1e1", "comment": "Malware payload (Mirai)", "value": "881aa5a2a6d4df3463ead5570f399fdb19f9a48f9d98d9935b1d03573bb5433c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418132, "uuid": "e016a3a0-597a-47d0-9ba8-7396a0af78a9", "comment": "Malware payload (Mirai)", "value": "8e8c9f80e864e72ad77a41b02125fea4a1b50020", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418132, "uuid": "f7756b50-4fb6-46b9-964e-dfd99ffce484", "comment": "Malware payload (Mirai)", "value": "dfab8fe75ca23da4826b07e6773273edef5f9d1c6f55cfd441a3a73007849437214a8cb51d56eccd2e8f37d245bbc96b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418132, "uuid": "f5deaf16-029c-49c5-8502-8b84f99bd623", "value": "T1F38312D5E79E46C1D3E01EB9ABE94120BE2987D920D9B7BF13660730D8DD3E169B0940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418132, "uuid": "71ef985c-d085-4251-b7ec-d3d575f371c2", "value": "1536:ZbeBBv0X2p416dZ4YyHuGppAEEerY91llNzNyrz9LQ/Vey3F+wqlzZ5C/ytUGcG9:Zbwv0Xt16kTuwe1eMzTNZm9LQQOdqVZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418132, "uuid": "fd133ad8-309b-4306-9ed0-0d1ff37587b4", "value": 86136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418132, "uuid": "170fb39c-c07c-40cd-8b5f-791153718ea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418132, "uuid": "a2d2d399-62cc-4957-8b07-ee74cc4a3570", "value": "systemd-logind", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a96534a-f14b-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768396505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396505, "uuid": "4db34c9c-3cd0-4e88-bc53-f68d681f0000", "comment": "Malware payload (Vidar)", "value": "4078a5634d3817c648910651a22d4f32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396505, "uuid": "7bb16e76-348f-41f8-8918-2ca6527755bd", "comment": "Malware payload (Vidar)", "value": "883ff124c2e8fcd5b978ebbc207d5c0af226c2c24a8f945d6dd0e363472f8aa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396505, "uuid": "f5b33264-7fa0-4d86-a6a5-3cc30845a170", "comment": "Malware payload (Vidar)", "value": "f0e319e5d69424d4235da47322ab01923b838df7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396505, "uuid": "07e6f1a8-96eb-4083-9328-0cb68c6e1365", "comment": "Malware payload (Vidar)", "value": "283b0a8e10d049f89865d59d76e56776dada28729abf1b6e7b2454dcf61fc606ddcc773d9a7cbf07e54fb3d922618e81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768396505, "uuid": "3142d8e7-0538-460e-b531-35ffa6f3279b", "value": "T112075BE3EE50077AD69BA23ADCA252892230F444173114D7BA9917964D67FC8133FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768396505, "uuid": "cf6545fa-9574-4c81-a4ff-05039e95a409", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768396505, "uuid": "ebf27979-f4e6-45f8-bd18-f8c82d09bbf0", "value": "49152:HYOjXQPccnra9R3a2uXlRZtBqWUehzBw0dWZf1JbfiudjlsxR1AZ9e4wdpma4aPx:H/dhWTHSIxRsX7jJst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768396505, "uuid": "fb97ee3d-ed57-4b2c-955b-1ebb7a5b6fd1", "value": 17389696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768396505, "uuid": "0f585740-9a5b-436b-b2b0-1a9acc11e262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768396505, "uuid": "39531410-3c00-409e-bb6d-6fadcb7b8aef", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ac1ed9-f170-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768412705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768412705, "uuid": "13e7c51c-b20a-4b74-9872-ce6cddbb9dcf", "comment": "Malware payload", "value": "11b502b72866a092c55897394ab61df0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768412705, "uuid": "d1c82189-76c1-422b-bd60-9f2a8194f190", "comment": "Malware payload", "value": "8879ddd3ece8050a21a3aa9f0b3221c302cc97c6eb99b3c951254c23c2f1efd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768412705, "uuid": "79bf74a1-fdfd-4fe2-bbc1-753e5bd791a0", "comment": "Malware payload", "value": "91d5f17e80ae3b6056207f9094dc2a19f7594e3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768412705, "uuid": "4d3a91cd-fc46-4582-9944-2c235524fc17", "comment": "Malware payload", "value": "dd27156c36e3652d1a2f1d7e353c6709992850f50bf1babe4a2cf4c4b83aaff4e6cd19c723445fa5b5fb6576e2838a8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768412705, "uuid": "7f5df8b1-c684-4c6f-a7ea-1e63b70889be", "value": "T1FE31C074D3648CB2EC1C433875AB03B86762D4D95B47BF438A5DC4381C4A2C46F54B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768412705, "uuid": "03f08617-42eb-471e-8599-dc913087b927", "value": "12:Bvx/yZYelAXI9X56pEUwRPHUwK6QAX46Q1jR6P70Wt4X0Fg7lXcyElg3PStw:b6ZfAM56pQRPhFTXxzoX0qhlhSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768412705, "uuid": "9b533c55-72ff-4d72-89f9-490793a5bfc7", "value": 1504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768412705, "uuid": "bf3b60df-6503-488c-878c-f0ca8b40efe3", "value": "application/x-object", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768412705, "uuid": "5b6d5bd0-9809-4f97-88b0-8cfa4beb2365", "value": "react.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ec41e4-f0e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352173, "uuid": "e28c4c2b-42ba-4589-bd10-d25df2c091c6", "comment": "Malware payload (Mirai)", "value": "71b2e52f61cff5c4cb350c132ffc6896", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352173, "uuid": "620dc135-740d-4c69-891d-24fd49ecdac0", "comment": "Malware payload (Mirai)", "value": "89e1474abd79dbfed5c1f4f47150d8a1da3ff02c01f3ffd79aeafb1a7d0a21f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352173, "uuid": "679dfd6a-8ede-4a34-ae4a-01fd76858a18", "comment": "Malware payload (Mirai)", "value": "d7583151fd032ee14670c738737772a95dcf5bda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352173, "uuid": "20e045fa-a627-4c3d-905b-c4ea2288f63b", "comment": "Malware payload (Mirai)", "value": "9d90280c1b0a60a92c062c9a58aec023c13598b11658819cb1581f92d927af1147b83362e4438525287483f0465511cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352173, "uuid": "e17dd9c5-c8d3-464d-b520-38dea34a288b", "value": "T1E153E846FD819F02D4D522BAFBAE014933537B78E3FE7101D9216F50638A99B0E77A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352173, "uuid": "3e080ff9-22cb-4a60-8851-282da7b58258", "value": "1536:hZnpNS3MdzeLEXDqv+E+e06mOmGdlSkiq3ER4HLH:hNScpeLSqv+E+e06m5M3EiHLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352173, "uuid": "14c13211-0527-4adb-989d-f02a56c5554e", "value": 63120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352173, "uuid": "70cda360-8a2e-484f-9fa8-5afa75182ba1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352173, "uuid": "e7e90398-64fd-48b8-9c4d-18a8d35a90e8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8409b74-f14b-11f0-a129-42010a9c0007", "comment": "Malware payload (DDoSAgent)", "timestamp": 1768396769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396769, "uuid": "7d9d7b30-bb98-42c1-a77c-ea99116be85a", "comment": "Malware payload (DDoSAgent)", "value": "72b51a2c0bd6a9fc7b0c9e4b1e9f5894", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396769, "uuid": "77715ce2-5450-4e01-a839-c6a215b47857", "comment": "Malware payload (DDoSAgent)", "value": "89f276c4615636a259830cc80417eb2837e09d826543ad72d9ed45a6bcc2644a", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396769, "uuid": "63b547ba-1b7c-4c71-b0ea-df3679134138", "comment": "Malware payload (DDoSAgent)", "value": "ffff85044a06a3e7f18432730465a932c569626a", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396769, "uuid": "148b299e-4b1c-4d01-b8b3-e20a746c93be", "comment": "Malware payload (DDoSAgent)", "value": "f5184b9e74a0177c619a23a3a1af8b0e4dd58e2dc0366fdca8b7671f600211267f836cb476a525ab3659269e109637eb", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768396769, "uuid": "b331ea15-6d52-4e26-92f6-43b237288760", "value": "T1C3466B81FB08A126D94B0B728CB30B61B3516D46C2E4C92B5309F76F16B26F7694FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768396769, "uuid": "3236ad42-3035-426f-909e-ed272800b0e4", "value": "98304:ExqTmyR2v72QduBFVvL9hZaDmc0/OjynEjEa:tx2v7pMBF1AI3nfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768396769, "uuid": "bc584b2b-6035-4316-802b-5a816d6d73d7", "value": 5701816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768396769, "uuid": "634f0e19-8c27-4ae1-b300-11ff7d628959", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768396769, "uuid": "55b4fc3d-dad3-4e1a-a03d-870fa0f23ff8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b46856-f0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768358855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358855, "uuid": "16678730-98d8-4b64-ade5-505605057bb9", "comment": "Malware payload (Mirai)", "value": "22f71c7c097b4bbbf0b032111f7a5df9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358855, "uuid": "f1916442-e0aa-41f3-b54b-aa5fb0812545", "comment": "Malware payload (Mirai)", "value": "8b8f4ab153e1ad148a17077606bc108a4c8cf3122125f5cc61a733c5c68f34ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358855, "uuid": "c9f6c3bf-425a-470e-a04b-6d96440de897", "comment": "Malware payload (Mirai)", "value": "70b9e13555dbf4668ced3148b3c0b1209e81a4c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358855, "uuid": "8eaac2a0-8cd5-47df-b5c2-aaf3e0544f5d", "comment": "Malware payload (Mirai)", "value": "6dd7f40211d8949ed26cad9c0e65f9609706920673478a9a7134d32308dc6d5b65baa69a4b431ca1bc370f49361b4d18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358855, "uuid": "4365d67b-17a4-4118-ae0a-eaa7e392715e", "value": "T14C031A17BA96C9FEC04BC2B003FBB5398822793E093A71E177E1FE526A46DE11D1D514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358855, "uuid": "f4773fdf-123f-4c06-94e8-95f173bb63c3", "value": "768:eg2Gn7H77KF8sYNFZhNP0fi4P/BIEV9iou6msxH2Alv:mG7KSNFZhd0fi43BtV9inaR2Ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768358855, "uuid": "cf5b7856-4486-47d0-b31f-4438d76039bd", "value": 39768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768358855, "uuid": "81c83eaf-5333-4efa-b659-87526a187333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358855, "uuid": "559e202e-33e4-4811-8920-e604b4ea3b4a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d6dc9a-f14a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768396097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396097, "uuid": "64469bee-8747-407c-a73d-ee44176c65f2", "comment": "Malware payload", "value": "548d67dc5c10b02b97846da281890e73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396097, "uuid": "b50fb995-4a80-476b-a29d-184c8092b19e", "comment": "Malware payload", "value": "8d669143e51af508ad0dd4d28ff030538378d3a8e12750bdc06651953611f920", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396097, "uuid": "2df7e560-040c-4693-9bd1-8af002002217", "comment": "Malware payload", "value": "6204e87015453b778e74b93d289d913c6b112c6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396097, "uuid": "1cf59931-a4fb-4edf-8836-faeb8609f7cc", "comment": "Malware payload", "value": "cf66b286d195f2b93d46c6ea2efc7a00c1043626022a20fa76ce27cab9ff825539c00797ec3293b9ab6bba6dbf1da601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768396097, "uuid": "d08ad8dc-593c-45a9-ad26-c363647b253d", "value": "T1B0E7BE1663E112AAD577D138CBAB6603EB73B40713308BDB329C43A52F63AE45D7A750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768396097, "uuid": "eb84218c-1abb-48be-92aa-d46ae8f19757", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768396097, "uuid": "786673f0-c719-4967-b238-e192a5c14a5d", "value": "786432:ldBeI7LfOCDsno80dguj3/oyngPV13y3k8rozTNTy4:jBeI7yCDsW/oRkkn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768396097, "uuid": "9f502f1b-93cb-4088-96f8-ee0c23b0acf7", "value": 65650008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768396097, "uuid": "1b0f583a-5054-49b3-8aad-969626bad9cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768396097, "uuid": "52d09dbc-30cf-4aae-ad3f-12cc747f2ec7", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e227f5-f0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352304, "uuid": "b3ff2dd9-3fca-43a3-86b1-27b420c598f3", "comment": "Malware payload (Mirai)", "value": "c443c50c71704d3c657d806483d02e87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352304, "uuid": "66cdbd78-178d-4078-869e-ddaddae5362e", "comment": "Malware payload (Mirai)", "value": "8f40d31972029c1d7f88790b7c2ec116deabafa25352aafb5b62780edaf94d6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352304, "uuid": "4ba48b25-6a85-4c87-96aa-9c86771e2536", "comment": "Malware payload (Mirai)", "value": "d5f3b29bb536b10a0e14f259a859aa3bf4345fd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352304, "uuid": "1597943c-02a2-4e27-ac09-1d764bf0b8f2", "comment": "Malware payload (Mirai)", "value": "b15a09608ed1e588d9041a87281e8e3a52e0a28d5cdac992a605944e0b56d9ab0bed27bc6393ede83c6cc1066c36e0a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352304, "uuid": "de65e3e3-2271-419c-a0dc-9949301ae023", "value": "T15993E551BC82562BC6E423BAF6BE668D336577E4C2CF722BC8214B117B8551F0D63B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352304, "uuid": "e83b4010-afba-4845-9fed-2a3a5236bb60", "value": "1536:pd+dGSq/lv/d7rMbIG4WetuLadxi0cbrT9KM5cZiw+bY4d:f+dY/lub6Y0WcZi9dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352304, "uuid": "d6e785e3-0dd7-4627-ba30-6b15f9b0a5ae", "value": 93792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352304, "uuid": "2d510d1d-96a1-4895-b848-e0f4d313eb99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352304, "uuid": "c58fc80f-94b8-410c-af59-483d6aff5d2e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571e9d42-f16c-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768410806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410806, "uuid": "6b970518-f440-4c3f-b946-0941d522f9ca", "comment": "Malware payload (ConnectWise)", "value": "ae4c3120a72a03ed940a40c84856884a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410806, "uuid": "46583461-0771-4da8-ad78-bf836aef7118", "comment": "Malware payload (ConnectWise)", "value": "8fb27a7218e502e8430317dda96ea8ac134df47384298ce92c8bbb01cdaedd88", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410806, "uuid": "8de86f2e-b9b9-439c-9f38-f7886f883597", "comment": "Malware payload (ConnectWise)", "value": "72be039f5c3447551e3391fa71cfb56ab4735f25", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410806, "uuid": "6ea505d0-ac60-4f6f-9a16-4cb5e94a702b", "comment": "Malware payload (ConnectWise)", "value": "034361c43d6fd7c7ccd29578c82411d613c312e061a63758631604911c0d315f445f69aa6fbbf9e14d50219c1f16c83f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410806, "uuid": "8f9d639f-80cc-4f62-8651-b3fa8967cad2", "value": "T194A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410806, "uuid": "e3889f76-56c5-4a3d-879e-239c97b15a73", "value": "196608:pKaLNkbgEi4QkKaLNkbgRKaLNkbg7KaLNkbg:NWgEiHaWg1WgzWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768410806, "uuid": "813f06e1-c6f5-4952-9e4c-8f6d38233bf1", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768410806, "uuid": "0d5066a9-1215-48e9-9c97-9f3b8148ae90", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410806, "uuid": "869fef7a-590d-49f3-a351-d91fa60dfacf", "value": "adobe.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f376e2c0-f161-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1768406344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406344, "uuid": "35c72944-1c0d-4419-af34-d488e1a37ea7", "comment": "Malware payload (Stealc)", "value": "3dbc06b664478efcf30898c8064c73ac", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406344, "uuid": "d3407098-adf9-4f41-bcad-638a43859069", "comment": "Malware payload (Stealc)", "value": "90ad4739461eaa162cc632f8e09d0a71427c0525e5bf7efb31a5eb5727c3b34d", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406344, "uuid": "0a7f0e6b-a220-46ef-a855-4fbc727430c3", "comment": "Malware payload (Stealc)", "value": "83f1a135d28c4d3e231c7dcb85803095480790a3", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406344, "uuid": "505c6b0f-f28f-422e-a44f-53bc7448d338", "comment": "Malware payload (Stealc)", "value": "5c59b415d315da7c19bb83400e29df0ba98b4add3d503b9379668015d272ecc061df15c3c93ea7af9def37ad8cadfdc7", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406344, "uuid": "8cb3f290-ad96-4d27-a081-51021a2abfc4", "value": "T17A176EE2EED00776D69BA33AD8A2624A1230F185033524D7BAA917554C57EC8173FF2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406344, "uuid": "f04177d0-82f1-463d-a7aa-8a91c72638f1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406344, "uuid": "d02b3e5c-bdf5-4d77-b4b7-2941d3b3fb6c", "value": "49152:Try40TlHFSWvRoozW/x43XhfTStxEUAoNuT2/tUp0ROMz7cFzjipaTcxO94a/GOA:TP7YWZKXh/A4L7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768406344, "uuid": "67110b0c-6a0f-4b3e-b479-607d15f23a51", "value": 20137600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768406344, "uuid": "83417ffc-ab5f-45c8-ab10-a35740ee9a04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406344, "uuid": "a5d1812f-a4f2-49b8-99ea-a4f207e9e807", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885e58a9-f0f6-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1768360208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768360208, "uuid": "80e5f7ff-6100-4747-a0dc-89b3d79cb115", "comment": "Malware payload (QuasarRAT)", "value": "2d51fd7a6fbc1ec740cb71eaeae37dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768360208, "uuid": "ec712193-dd91-48b8-ae86-4887d3846cf4", "comment": "Malware payload (QuasarRAT)", "value": "90cabad8df56edd353c9bf8848ef9ef6d8b6474082f06c4649d88ebdc816d81a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768360208, "uuid": "d955223a-e735-4189-8569-a889bfa528d4", "comment": "Malware payload (QuasarRAT)", "value": "203784bf06c23c12ebc5f0cf6b5aaf4d028fbea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768360208, "uuid": "ce8de484-9833-4035-bb13-d9d42938840d", "comment": "Malware payload (QuasarRAT)", "value": "a9920a109a14712d79f7c3701cb882b55014b230f1580230d9689f1399f4a910a68aa4435890e25cd3edeafd38d50d3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768360208, "uuid": "593edc37-4714-41bd-ab49-e4c20d8356c0", "value": "T1BCE54A143BF85E22E16BE773D5B0501267F1E86AF363EB0B2181A77A1C53B508D427A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768360208, "uuid": "24fa6f6e-6c5b-48c7-997c-85bcc5fba52f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768360208, "uuid": "1802631b-6754-40cd-8fe0-45d062be74f1", "value": "98304:ivb22SsaNYfdPBldt6+dBcjHgW6GLQe/O:E87jjTLQeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768360208, "uuid": "64c87a3f-745e-4969-b2e4-a5e76b0ab9fa", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768360208, "uuid": "18abf2c3-b320-4b96-8837-8a0300052bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768360208, "uuid": "d7c3b10e-8aa6-4ee1-b32e-efe4c1207543", "value": "2d51fd7a6fbc1ec740cb71eaeae37dd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb738f9-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418174, "uuid": "363796d8-30fe-4fd8-9291-e785539d763f", "comment": "Malware payload (Mirai)", "value": "cb0d9995e54537bb24052baa2cd27ea5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418174, "uuid": "9c6d5afa-ab42-46ac-bb79-2ae42076ae52", "comment": "Malware payload (Mirai)", "value": "91fa90bc79f33d5dd9bf20fb175b57087157e416fed07ed2390c966592358218", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418174, "uuid": "8e1f6d29-d719-47b7-9abf-a9a2a8099f34", "comment": "Malware payload (Mirai)", "value": "5b0cf7313635a2598d0fd7ccf3a6d045bfd54dc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418174, "uuid": "7c14d146-2c19-4e5a-9c59-20bee4cc76dd", "comment": "Malware payload (Mirai)", "value": "de488277e1a5b35fc1b308061468658f9f4f1fe7b1f17cb9b94c38d95b52b0bf3d70211728fea443d88378e44c10f72e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418174, "uuid": "de9aa097-64c4-4831-96b5-ee32fd4e5232", "value": "T198042906B9CCC4FCC895D0785BBEB136D921FC5D027CB15B2788AB222E4FE601B6DA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418174, "uuid": "2fdae784-b749-4145-901e-0e483b51f4d4", "value": "3072:UJaByDuFPWrr/Q8verJXZ2scKw75SMFQI36mby3JrJIBxbwj:wAyeWrrQlsSOcJSmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418174, "uuid": "6929a161-36bc-4a24-a1ab-0603a98fdd76", "value": 173960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418174, "uuid": "65f56192-6a49-4f46-ba9e-41c0821fd7b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418174, "uuid": "7ec8d216-3db1-4347-8af5-458f08333756", "value": "systemdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11cdcac-f181-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768420084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768420084, "uuid": "351e3790-d738-42b5-b26a-2d23ea4d4e5f", "comment": "Malware payload", "value": "def0b78f75e66d91191936717d8ee4d2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768420084, "uuid": "173d897f-36e6-49a7-9aa4-6a469730fc0c", "comment": "Malware payload", "value": "926024492b9ee0dc0a37c792bf7ed68c2f52f9c74596b9e62b3f433da65e4a7e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768420084, "uuid": "694d37f2-3aec-489c-a959-83f44be427ca", "comment": "Malware payload", "value": "cc9e5e5e0ba3d39149a695e59e11682cc1b84898", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768420084, "uuid": "c379d6ef-0958-4eea-b61a-0b69684854cd", "comment": "Malware payload", "value": "17bec770ab09b72d20393e241c820b4fe6761c948fc54997e0738e918217fa28cb6aa152f97ffdb5e8e1838401555a02", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768420084, "uuid": "bf9511ce-425b-4d20-a6d0-dd05a598b139", "value": "T1B496336F146303D7880B38A9453AA958B8DE3C690DBFD177F1871BDFBC876E44926026", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768420084, "uuid": "cab8da4e-d041-4418-a375-12a8fb12d768", "value": "196608:u+oIIDYB28ijZXTWxFrLpdXqt087ufoRoVxjui+ph1tSqNV/Wjz8wMDm4:D/j2LXyxV1O08QMGki+Wq/pwMq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768420084, "uuid": "ef1c29f3-aa3c-4259-92d0-7e401b507f1f", "value": 8656165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768420084, "uuid": "9eaae981-a78c-400b-8942-dd0bc6cb92b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768420084, "uuid": "d283fafe-2e0e-438d-b493-44bb79954001", "value": "VOUCHER DE PAGO ACORDADO PRESENTE MES_mod.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d42078-f16c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768410863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410863, "uuid": "36ef20c6-067d-4ed1-8034-86e5ec6287dc", "comment": "Malware payload", "value": "b2402506993177b9feb0a334cf7141b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410863, "uuid": "3593a604-346f-42d7-ae92-a176dfe0befd", "comment": "Malware payload", "value": "928b2061aedb3ca6e65a4156966564dc3ded14c6fecc7d38268fb5cef884c3d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410863, "uuid": "33efc444-b128-489d-9a83-3e6998714c26", "comment": "Malware payload", "value": "d858c4ee408262a05a03584356521e71596f96e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410863, "uuid": "c95c3857-d39e-4b7c-912d-342357241484", "comment": "Malware payload", "value": "b2a018f15fa5863d561dc43aa83a0dbc88b5ccb27f3788707e410612d12f43f119e3207cd38fb4dca9e6dd2be836fee9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410863, "uuid": "dbe351ba-7228-4211-a18b-cf8ccaf6289d", "value": "T1A0B4C512EA607026E88745713D79965738193D372A81ED0FBB889F9B36B1A8770F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410863, "uuid": "0faaa36e-edcd-4462-87b7-aca8d76cc0ab", "value": "a3f46587678ebe458f5a697facc018d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410863, "uuid": "e47f17ba-2485-40d8-8556-6e7275675732", "value": "12288:KViiacc2+Q5TRwWygR/WLQY9B/5RdERnTnBnkysq6EWO2ujX0SWtvWSe4tRVZ+TK:Kk4fSe4HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768410863, "uuid": "bc21ca80-6372-4f69-a022-666acdaa4b3c", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768410863, "uuid": "0437c63d-9f4d-4389-9220-1a5c3f9e5155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410863, "uuid": "52283fce-2a2f-4605-8ccd-9bd67187543f", "value": "Cotizacion RFQ para la mejor oferta - 467667788.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09393f7-f0ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768356035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356035, "uuid": "cdc7a338-b809-49be-b49d-2dd13a4b31ae", "comment": "Malware payload (Mirai)", "value": "1f2aba76911e000120cfcf8891a822d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356035, "uuid": "8578cd24-dc09-4b63-82cb-171ba2379b05", "comment": "Malware payload (Mirai)", "value": "93cbe723336e07afeb96e188de8b9bba597b57ba96ff859bdd7b2a96c1daf7ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356035, "uuid": "50b72223-00c8-44b0-a6de-32ea39fced0a", "comment": "Malware payload (Mirai)", "value": "d9c30b6e0fda7a9c897481fb61f5f1512b00f5e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356035, "uuid": "7ac64ce7-8bc6-43a5-9a83-f94f474f9d9c", "comment": "Malware payload (Mirai)", "value": "8187d5b4cb9ac6346d72b3b0c44e8226c3f2a9563247c9123dd9a6f4249414df89ba5942a06f243c5dc171f87e6fd1e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356035, "uuid": "980c90ef-35bc-4ae8-a984-6d5c8162e51f", "value": "T1755318C4F98785F6D84709708067F33F8B31EA394135866ACF9AEE27EE27501D61629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356035, "uuid": "13dc835e-d067-4eb6-afa5-b62fc3f8fd44", "value": "1536:5bzg+bZW+zlymLcYrwDxaKRMW8y7N/XvXWJ9xyN:5bzg+bZWolTLcEKz/7N/XPWvEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768356035, "uuid": "730ebedb-f080-4c7f-a5cb-6f1dd92307af", "value": 62640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768356035, "uuid": "c39836da-358f-4beb-868e-4e7ab2e7a33e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356035, "uuid": "11ed8b4b-bdb5-4312-9bdc-57b25b6f2df5", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70da5aec-f18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768425452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425452, "uuid": "c0f78418-5d74-4820-a86b-1a848cc9f5da", "comment": "Malware payload (Mirai)", "value": "3e0a48a94fe357e1609fef1880670580", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425452, "uuid": "8689c831-47cf-4a52-9f3f-aafc2d4a4b3d", "comment": "Malware payload (Mirai)", "value": "967ab4aa43ddcf45044a5066fd05031acaaa96e07785d75fbb7445f3fd2c7893", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425452, "uuid": "c7ffde10-7ec0-42e5-85d4-f8363d78923a", "comment": "Malware payload (Mirai)", "value": "83c05fbc21b2104424a49f98eab754e03e724833", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425452, "uuid": "7c6a63fc-7e9e-42ed-9f81-026fd2f6da32", "comment": "Malware payload (Mirai)", "value": "4a76ccc25355e6d77452a500082199b4647dc94c0bd488effdc490527732ae028f2ba7a750707895ca9b708318bce828", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425452, "uuid": "0442cc50-939a-4a95-9df3-49afde4b0d41", "value": "T139A35B829A43DDB3D41321F902AB5B714E72FE364822D542F36D3FB1EA152D0B64636D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425452, "uuid": "e4e5e34b-5137-4e9a-883a-87b1956332c1", "value": "1536:XDPWLaOmWFQJ1n2rqPLjz4fZGMUWtwFJFAeqNHxXTfwA212bIRg31:DdOeYrqPXz4fZTmhAeqNHxXc2bI+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768425452, "uuid": "34a2ca38-fcf0-4913-9080-51effe4764ac", "value": 100300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768425452, "uuid": "d438b3b7-a0ac-447c-bea2-037ca62f6831", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425452, "uuid": "79b592e3-29f8-4d12-9c2d-568724d91da7", "value": "2016Nwji686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56733449-f0ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768354971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354971, "uuid": "5d64eb0b-c1b4-4354-85f0-c4f9eab48a90", "comment": "Malware payload (Mirai)", "value": "155463e8347a92fe77802799f0d4a81d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354971, "uuid": "7cd14d46-cb94-4adc-b67d-9418b38ddfba", "comment": "Malware payload (Mirai)", "value": "9847540ba6d0c1f57c2d37b91987faa60ae442c21dd65951497683d1c39f22db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354971, "uuid": "4b84452d-16bd-43f5-9d65-163b3d7675b5", "comment": "Malware payload (Mirai)", "value": "1a0f905c7de327c5d8993d60048fce8b8ff3dc89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354971, "uuid": "aa0d3313-9813-4c6b-a93e-e2a0c4d36294", "comment": "Malware payload (Mirai)", "value": "c974f9cb70dafd9935c6fd91888e07652a4478647e0fff1e5be30427e322838840e8f020bf19d81275386ed138495016", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354971, "uuid": "08ab2d37-ce1f-4315-a6ac-d0bac9fce653", "value": "T1D8B39DDBF24B11A0C8624BF00BCB4BDD3E6362519E6BC4F36C1D6A3A19754DF9A06391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354971, "uuid": "e14443a5-ea93-4eb8-9483-3d8cd727902c", "value": "1536:UF557+YrPdD8FTIZT+/bIgCx04P7Na0Su/VDcoogR/LWI:+7N8FswD9in7NaW/VDnogRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768354971, "uuid": "c7ac0f51-27e9-488a-b29c-5f21ba834dbb", "value": 107880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768354971, "uuid": "659cb9b3-650d-4f0f-b9b2-9fc37e5942b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354971, "uuid": "9d8967c7-f653-4a9d-9f18-82b7cfe2cf61", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1466bb-f19c-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768431561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768431561, "uuid": "7853d378-f4e2-4050-a454-85f413bb092e", "comment": "Malware payload (AsyncRAT)", "value": "10fa0a5c89f32f2575487b3df9aadeb7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768431561, "uuid": "88a22963-4fce-4528-a59d-9e9e807b0973", "comment": "Malware payload (AsyncRAT)", "value": "98e46f012a28847c685bb505deadb9a14c8b4eae478d1799ac022b35071e8c5a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768431561, "uuid": "441fd77f-f1f2-4732-9fa0-0c0f4046e87e", "comment": "Malware payload (AsyncRAT)", "value": "8a5018513d310a9da23a7dab601042c3dd4728d4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768431561, "uuid": "3dd36e62-c7af-4bad-8794-09e0ec45fb02", "comment": "Malware payload (AsyncRAT)", "value": "5418c5bd1dd7c69ec6d647c0dc59d749c7e5ca86ec3c792c979ffd830268d97991095e0973a1f7cbfc9dcc219da31aa3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768431561, "uuid": "ac679076-d1fc-485c-9454-e614dee6f006", "value": "T17B435D007BE9822BF2BE5F7499F26145467EF6633603EA4D2CC441D74623FC58A426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768431561, "uuid": "32c64265-0913-47bb-b9c7-16d40b57f5d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768431561, "uuid": "19926a8c-aac4-4933-a5fc-68801c8ccc3f", "value": "1536:Kub3dT5Pk27eR3H3bH1SHvlQVAkYdJS+VGdRxR:KubtT5Pk2yR3H3bHiQVYLMjxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768431561, "uuid": "4a8d2d48-9c88-48d9-96bc-02a5dd2325ce", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768431561, "uuid": "ab989862-50f7-4080-80ab-80f8d31e76ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768431561, "uuid": "0fd5e08f-c69c-42b7-99ba-1800692e57c9", "value": "Facebook.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5c5783-f172-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768413392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413392, "uuid": "fd180cb1-365a-4ae4-b0ee-aaa8bac53c67", "comment": "Malware payload (AsyncRAT)", "value": "47bb14b0f01f6b8cc063ef578bbd3615", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413392, "uuid": "ae281865-5a97-4d45-8a2a-1eaa6cefcddf", "comment": "Malware payload (AsyncRAT)", "value": "99528e9923716d980c54fef240fde7fb6463a2cc13b1e7bf3de09d0635e04c66", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413392, "uuid": "f3254d25-3d02-4b45-ab3f-384d183b7571", "comment": "Malware payload (AsyncRAT)", "value": "a9083e1c83d0bae46a71a220b5639640d9e091e8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413392, "uuid": "d2faee98-fc6f-41f1-9321-3f19d01a8b8d", "comment": "Malware payload (AsyncRAT)", "value": "3c00daeccabf70d98c5de76135a356097ac5b37019aed062144cc8902bc83f131188dcbda321191669a1559bfeedbb38", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413392, "uuid": "07f0c00e-9dba-4dee-80db-cf627bc19424", "value": "T183435D003BE9813BF1BE4F78A8F21141467AF6677603E54E1C8452DB5613FC69A42BFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413392, "uuid": "19a1421b-f890-4815-bdfc-025108cdc82f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413392, "uuid": "6af3de40-c1d0-4ac3-ae3a-dce442561ec8", "value": "1536:KunHpTJZ+2slVJjMbgXSQ3Xv7sdty0S1lv2XzB:KunJTJZ+2gTjMbgxDsv7Sfv2jB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768413392, "uuid": "c4342882-50cf-4abb-b041-5dcc5995957f", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768413392, "uuid": "28731186-0374-4db1-ac42-3aba215cb2e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413392, "uuid": "7d7398c8-832b-40f9-8b77-84f67dcb3f28", "value": "AWS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc352479-f140-11f0-a129-42010a9c0007", "comment": "Malware payload (BRAT)", "timestamp": 1768392078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392078, "uuid": "34c03ed1-2b2a-43fd-941e-c1b8cdd9cc1b", "comment": "Malware payload (BRAT)", "value": "8d9d3602234e7eaf7249338753392628", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392078, "uuid": "a76a93ab-b6e3-4f6e-be93-7db7cd4e1a7f", "comment": "Malware payload (BRAT)", "value": "99817567029914797376e0754617877e1ed2bf24e3104510f6635061db5567b4", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392078, "uuid": "b86c5c7c-9709-4eba-931a-1cdc973e92b5", "comment": "Malware payload (BRAT)", "value": "ac7cedaa5a6d8198af103e10b51bcf2e3e90271e", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768392078, "uuid": "b8f7ab02-2cc6-4cd5-b8b6-a5eef0c7185d", "comment": "Malware payload (BRAT)", "value": "894afaa8ae9edf9e425ddb7402fb03b3a91eed852d65f979c22ac350285602a59e46cb84bdce19a65b45a67fcd9b4951", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392078, "uuid": "bc6b3479-2b51-44ea-a98a-6ce0da061d8a", "value": "T1B066C0CAD16B40D6CC067FF598142BC39B3056324A34046836ABBE595F73DFA811EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392078, "uuid": "392e2a26-3c31-44b0-975f-22385c84bdbf", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392078, "uuid": "0d5524e6-af2c-4bc8-97f6-eb7b7fe68d0f", "value": "24576:z9v/WDJplHIVfbu+v+h104UcTzmIqp7NMFrJghjBcyWXEMqbewLvcEJmh3sglAqr:yzJ+jN2f9Izslar0cC++8Yso8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768392078, "uuid": "9bf25d3c-978b-4692-9f5f-ddeccb6c792e", "value": 7001600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768392078, "uuid": "bcf69b0d-6f69-41a5-84b5-ae8faf39da67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768392078, "uuid": "1983fc94-3d12-4550-a761-b693f6e229b3", "value": "RenzClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3ad97c-f128-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768381641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768381641, "uuid": "6f0b2f40-55af-4253-a09f-34d090a9b867", "comment": "Malware payload (AsyncRAT)", "value": "dac1bf0ff31c6bc55586467100b14cde", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768381641, "uuid": "0fcba9d4-dccc-43a0-b4c3-ac8bd57e9898", "comment": "Malware payload (AsyncRAT)", "value": "9a07164d4845d48b2554d74a317954c442c000f2bc78304f7f2f8c6ced5e434a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768381641, "uuid": "36032ed6-cbc7-495a-aeb8-dfd07ff5e62e", "comment": "Malware payload (AsyncRAT)", "value": "53db0697455f5077a8b54a6cd04cab82dbbe64aa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768381641, "uuid": "5023fbf6-dfd4-4369-805a-b7dc35d307dd", "comment": "Malware payload (AsyncRAT)", "value": "7b87fcf37d3923af027b943e26360eaee8ff463a363bd51d6479902c43d355d4f7d6345059d904731abbb810ababff4e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768381641, "uuid": "7b0e322b-3ebb-45c5-a20f-b8dcb11f6e8a", "value": "T134C22B0473F48261D1ED4BBE48329600D375E68B5D13DB9F6EC495AE2A337CD8A20BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768381641, "uuid": "8d4e44c9-50dd-48ad-85ba-9c1e33d9ad6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768381641, "uuid": "a795e4d3-4b3c-4dad-a71c-a5dbd6f8a099", "value": "384:XQ4K4Rt1zgeLsQk5wMymrJhxYHqqbuUsJQxnCJf+BWfXWB/lTu+:XQlst1ERQkSMyCJhx+FbHBFB7Tu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768381641, "uuid": "eb14e5ef-f9fa-42cb-adda-26b931645b3d", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768381641, "uuid": "46577a05-b8c6-428a-801d-7e91367f5dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768381641, "uuid": "db9a6d9a-3061-4312-b61f-d054c9101a91", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a65d4d8-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418113, "uuid": "9810e08a-ffd6-4de8-bc24-6b2408b5e9c2", "comment": "Malware payload (Mirai)", "value": "76e2f1f1fc2d5fd378f56db10c7c7220", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418113, "uuid": "445d23de-e2f8-47bc-898e-6bab92807905", "comment": "Malware payload (Mirai)", "value": "9ab64d8c66d973ca952966360e68ad30a7ce20bfa9f45c6da31b6727969b58ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418113, "uuid": "a3a4a763-8ba8-467d-908a-d0d6c91ecade", "comment": "Malware payload (Mirai)", "value": "5f553c084883f017c7cadc8a6ae5ffdf10a009cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418113, "uuid": "17358d41-7ffc-4a27-8e5b-bc14f7873002", "comment": "Malware payload (Mirai)", "value": "1eda981d2e8d16e2046ba764e6a93e2a8c37b7a7d17dd8a3dae92c86854f21c9e8ea47d853f02f118eff39fe3d46ab99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418113, "uuid": "50d5630d-9f80-4c5b-8a96-b828a48a7c02", "value": "T1E063026DC46D21DEC8F818BB52411BE5D2C4B1D3B2474E6C1A0F8DDCBB19887AAD907C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418113, "uuid": "fe83d125-4ebe-444e-ac51-cababf498b95", "value": "1536:wJIjDIXDDY5v0mPUatV8RJ7oqe2np9c4Nk3KfMX69:wqWPSvp3tAJ7o3gDEK0Xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418113, "uuid": "4cea26b4-5d4b-4902-8d90-85f0f2036e47", "value": 68960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418113, "uuid": "fde6ea47-1cdb-47f5-89e4-c3be80d22b27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418113, "uuid": "b3029296-27c3-4442-a42e-9dd044bfb290", "value": "kerneld", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540b7bcf-f116-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768373865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768373865, "uuid": "a79bd0eb-b017-49ae-bbe2-cc1dd468bcea", "comment": "Malware payload (Mirai)", "value": "328450393a90207b8182bc6f99a9abdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768373865, "uuid": "1b924cc4-31e3-401d-847c-88e56cff4c18", "comment": "Malware payload (Mirai)", "value": "9cfaa778d52d76faf674ee0815a7b4931618a779b6d6c178329ea87adb2f9f9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768373865, "uuid": "aa7e67b1-13cb-498e-a9d4-a896cdc4ae8e", "comment": "Malware payload (Mirai)", "value": "8cebe398ca5f050c56500fab46e6ca8ef795769a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768373865, "uuid": "d49f628e-065a-48ec-89d6-77c6b29d5419", "comment": "Malware payload (Mirai)", "value": "719895fbc27ce66aae15cf48c80aa2a86e668bb5d4362de8125bc7479616faaca064ab431530bad92a6c1adf32c5d71b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768373865, "uuid": "293a1528-e54a-45f1-911a-057ce33ad299", "value": "T1A0348589BFA03FFFD81ECD3702958A05129C5A0A5298BF776A34D508F68B10A5DD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768373865, "uuid": "32ed8d86-31e5-41ef-9e6d-1cae71319693", "value": "1536:fRwnv3Vij95QX7yV2MpUEIjKlbDrOdFCqmmXCRbz8FujdGaiEElk8Au/rT:pWfqXVZUdj1CqmmXCR06dGaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768373865, "uuid": "76e8cf0c-0e24-41e8-8899-6d863340da6f", "value": 236020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768373865, "uuid": "584dde5b-e452-48fe-9821-a8e3b57024fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768373865, "uuid": "dafada4f-1aeb-4de6-a3ff-a1f8fd274ca8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3efcb5-f164-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768407518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407518, "uuid": "d39bbe73-1d87-42e9-8a8e-b481dcb00c95", "comment": "Malware payload (SalatStealer)", "value": "60716b2aac7e648202a2cf8df8cdcc27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407518, "uuid": "a385309e-5221-488d-b6ad-43a534c081b5", "comment": "Malware payload (SalatStealer)", "value": "9fffe9101ed9aed97eeaacc47aa20bb8d25cc34a4233c3c13555cb3d60c0b270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407518, "uuid": "04d2d893-3690-4ada-b419-f608f9852065", "comment": "Malware payload (SalatStealer)", "value": "fad6966ace2e2a6c89fafbe5c0a4c59e659281bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407518, "uuid": "3f5da721-c1a5-445c-8a11-c5e95e0566b9", "comment": "Malware payload (SalatStealer)", "value": "33c1390b66a0ea1a5e61fe294868d881f8a0ecb6c51a23bf24e0bc66a9fc24f0af9d322c7931cf9c01351062cb9e9527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407518, "uuid": "45591e8a-ef03-43c8-8202-b1b553c5751c", "value": "T131C65A51FA8B54F6E9031831415BB23F63305E048B28CBDBFB547B6EFC7768119AA249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407518, "uuid": "88b76edd-0ce9-4cab-9ef1-1779126b6b24", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407518, "uuid": "276fb0e0-602c-4d41-b1e0-a47b2f45fdd8", "value": "49152:gML5shqeDbDz3YsnvzVil8jrcEX3JzhlKTTegjJBSFkNYfvxyUsDa713ryOVjXPG:pts8G7dvkj45duEfFj6GcTzbc+k8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768407518, "uuid": "8ba5f1ec-e43f-4662-bcfb-01de97994a1f", "value": 11658240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768407518, "uuid": "d4804213-da42-49af-a4d6-42ff2ccc63bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407518, "uuid": "2f18a211-825d-489f-8c80-e412c5c90ad9", "value": "0x00070000000243c5-16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a08f816-f18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768425468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425468, "uuid": "769885e6-7379-44b5-8a42-97f4215e346a", "comment": "Malware payload (Mirai)", "value": "081016504dbf9c67cff50662f75594b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425468, "uuid": "2ec0439b-994d-4146-a54c-b78551f23d03", "comment": "Malware payload (Mirai)", "value": "a0cb2f23302aab7b80bea4bcdbed24542539e9ec710530e1bec5660fd50dd1d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425468, "uuid": "239b01ca-1206-4fc7-b405-d049df2ebd94", "comment": "Malware payload (Mirai)", "value": "0eacd6845d7b48d0a7763812ca8f4876d7c00cfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425468, "uuid": "858575af-b325-44ae-8b1c-03ab1af80d68", "comment": "Malware payload (Mirai)", "value": "800ce3fe94fd163dd45f83e66753356f0dfc7f4dc95a6be640c3fe2e179b5678f4b536cee0f00955598dcaf46f7f0616", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425468, "uuid": "cf7b6845-7d12-448c-9953-07b3a6eb2bf8", "value": "T139C34C87F910DEBBFC0BE77A05930915B530FA650F621EA3712778A7AA350D4382AF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425468, "uuid": "75f56ace-69c1-46eb-a82b-9f7c63f0573d", "value": "3072:ru/7sMyryEiydF7wjy9tA4JDsN/RP1a+d:ruHyrDF0y9W4JDm/7a+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768425468, "uuid": "8a9f157c-e281-4d63-b0d2-8ba888c1c2e2", "value": 123980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768425468, "uuid": "216accb2-6914-419f-a94c-4c26973c568f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425468, "uuid": "93a749c1-fa72-40f4-af8c-4aaeb8281e9e", "value": "2016Nwjm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93985743-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418209, "uuid": "3e2069bd-1f0b-479c-a1f9-203468a93447", "comment": "Malware payload (Mirai)", "value": "c158ab11b431d943f0f19fa60e617ee1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418209, "uuid": "171ee59c-0afc-429f-9bb8-fca4c16dad29", "comment": "Malware payload (Mirai)", "value": "a1d97641d776bc4059bf6dd8b1229dc61f0c62ccded3a5a5b9ff393b59e41650", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418209, "uuid": "830d8140-1de3-4777-85f4-83d790df0f76", "comment": "Malware payload (Mirai)", "value": "d2ed2ce86e132321d6a66631bf87cd7d86fcbffe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418209, "uuid": "f31cd5c1-e532-44ba-9a0c-4426fa790330", "comment": "Malware payload (Mirai)", "value": "6fd901ce09ae724c65c9995b3c9be0cc1abb339f1c0135ff764ea636ed703bbe4fea3e4a377c236c3eccb1c1b640e56a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418209, "uuid": "f4cfd651-bffb-47b4-975a-ad4bc90647f9", "value": "T1C7F33A86F8C18E17C6C612BFFB5E418D372657A9D2DA31039D266F20378B46A0F3B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418209, "uuid": "89999d86-d0f8-4644-b314-65afa38d38ed", "value": "3072:vF9uKFyo14aod9E7Hp8+HrknCUoQU4qFChLLYevE:fuKFyo14a9J8+gxRU4mC5kYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418209, "uuid": "663e6fe2-900c-4b59-a6d0-ac6602230f3e", "value": 165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418209, "uuid": "80f1444c-d5cd-4a66-b2f7-3805a73f60cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418209, "uuid": "1fd516fe-1e09-42a0-bb06-c85f1523aeef", "value": "systemd-networkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f9dda3-f12f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768384632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768384632, "uuid": "0057d68a-21be-4a8a-a29a-22877270a3db", "comment": "Malware payload", "value": "806eb02f4f70ef3a818c33acad863553", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768384632, "uuid": "7a47eae5-15fe-4613-8739-97e830212dda", "comment": "Malware payload", "value": "a252b2e2e1eb1423cb2781dd194fd5758817157847b3eb18bc86486c2f366643", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768384632, "uuid": "c3be93c2-8c9f-4a83-b905-0dcf304b8cc6", "comment": "Malware payload", "value": "afce46fa82e1f771cb5ecfb9e4521308812ba5df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768384632, "uuid": "966c3021-3f5b-4253-8b8d-5e30ce953b7f", "comment": "Malware payload", "value": "cc5720f4b38370c3350c7f130a17315eeba0ff0986f81924b6a4d9a613b030f23a98e0d98d9b2a0862f56d9b8e1458dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768384632, "uuid": "484f2ac9-5ea9-4d55-8621-fcd130032ec6", "value": "T1F6C733AF29E09165C90ECB72FF8D4030D9267D247111646BAFFD3D637D53E09B128A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768384632, "uuid": "9a810f07-d68a-4a5d-88b9-5ef57aa0720d", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768384632, "uuid": "60ae0ed0-0f2f-426f-abb6-61bf16a1d029", "value": "1572864:zH1RzYFUppkLu8gT/WbJycxcq4Lm42eSlteBP:zVR8FUbkLu//WIuQLm0SlteBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768384632, "uuid": "75e00b67-3f54-4999-93e4-dfa23c5bb8a6", "value": 57274560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768384632, "uuid": "54cdfa8c-3c4b-45ce-9cf2-b607495cdec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768384632, "uuid": "1ae50ca7-4448-45bd-8165-92294a7dba55", "value": "quickai.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe345a7f-f183-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768420965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768420965, "uuid": "c15eb050-992b-4cad-80d9-e00d39996607", "comment": "Malware payload (Mirai)", "value": "3c16b1c19734be92ce33b9f93794d9b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768420965, "uuid": "a6b96a19-e7e7-46cc-b4bf-24de48892f05", "comment": "Malware payload (Mirai)", "value": "a3232bbe0717e8e4b0fd6ba3b600451c2d37993bbbf388600fb030faa0558b7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768420965, "uuid": "de08d5ab-3216-41d8-b6a9-00db5b181c19", "comment": "Malware payload (Mirai)", "value": "48210d402a9069c9285fc67dccf042398b1e4bda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768420965, "uuid": "932d099c-21b2-4712-943e-db9ded599a59", "comment": "Malware payload (Mirai)", "value": "2377e898bc95d432c2cbb24617fbb332f2c5a27dfbdadf1162de25032f607d56a33590232979b7736059a68294c59194", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768420965, "uuid": "6c1a26be-98f5-4ab9-b77a-a834128737fc", "value": "T140D35C0677180E57D5A34AB0263F1BE083FED5D121F4BA89291F9B6A4672E3B5481FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768420965, "uuid": "b848ea25-aa0f-438f-9754-8a8f22f19a01", "value": "3072:JUFczWKNZhc3JiwmS7ZHr2Um/u4SM89tkgb:DvNo2kdr2Um24SM8Pkgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768420965, "uuid": "6e234443-8d47-4955-8b5a-cbde2268e875", "value": 134328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768420965, "uuid": "d8528398-3b64-4f6f-a8ca-3fa14ec5aeb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768420965, "uuid": "8045dcb8-85ac-46f1-8073-ab2afc330b68", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218cbcea-f0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352305, "uuid": "1fda47fe-3768-4838-a9d9-d5eb88f25590", "comment": "Malware payload (Mirai)", "value": "491d25996f56aa387038bf81501aa134", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352305, "uuid": "4cdabbc1-d108-45d8-a479-1504a6550bce", "comment": "Malware payload (Mirai)", "value": "a644ed74dfd2b7afe22e6affed6e1b86005d339d4f6806b2b74620720815acf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352305, "uuid": "38c900b3-1496-47e0-a4b6-bd6beb2cc1cf", "comment": "Malware payload (Mirai)", "value": "5ddc14333c6c4e5956742eaf312b8733d1d03075", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352305, "uuid": "7cc56221-831b-4265-bb78-a7df2f6fa800", "comment": "Malware payload (Mirai)", "value": "bd7e2ef4a31a7889fa4234b4e5f5aebebb60e54da55697e08b9999c1ac568e39a68db880344d95d63ecc956837f61cc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352305, "uuid": "755aa0de-3d33-4fc7-9bd6-95a22e0bb856", "value": "T137131ADAFCA29E26D6C427B9EB1F5188332663A4C2DF7607CD194F01278A51F4D36B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352305, "uuid": "7df46131-de5c-4d4b-a689-ffbcdb81408e", "value": "768:WXi/lDQPrUTDYAKgW2Cz27Rb1KTvxz5lmmg9DyNZUUsIY:8PrgsAKg/Cz27x1Krxz5lmmg9DMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352305, "uuid": "c32117cb-dcbd-4a72-8aaa-b254b1769461", "value": 42424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352305, "uuid": "a932a8b7-37f1-44dc-890e-065235f22a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352305, "uuid": "8cd64290-a3d2-4bef-aa0e-06147ff0c50c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1994e9-f111-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1768371731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371731, "uuid": "61485e7f-1140-4165-b7ec-3f8526c7c5f0", "comment": "Malware payload (Joker)", "value": "f950f28a63742851e56527601cbd9fcb", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371731, "uuid": "c42de6f2-fe19-4b72-8d02-fbf4b1fb0f71", "comment": "Malware payload (Joker)", "value": "a7a26ff5d9ff93f40019e0e16937618313b75648f6a2d585651115c51821f338", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371731, "uuid": "b4bf44c2-53fd-4266-a7df-c3e4c18e1e14", "comment": "Malware payload (Joker)", "value": "e30ed211455b82267599b1abd777e8dea0198dea", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371731, "uuid": "697f8861-dbf9-4347-92a1-1c622c71a96d", "comment": "Malware payload (Joker)", "value": "3dbbbe137633db44c514ea45c7187f20e1633e4fa1ad3fc159ea8d6e19cbe3809f211774916ed8c852fa888f360a355d", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371731, "uuid": "8dd1104b-5866-495d-83da-79e7102bff14", "value": "T17367120AFB4C982FD8B6B079CD492233E15B1D656B01D3E75428B29D7CB36E08B19BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371731, "uuid": "4adb7552-6ffb-4d31-8902-d201c5710dd4", "value": "786432:CLvs4s4PmdNJB7s0Fn0YpA248pnNd6kwRt9:yhWvN9n0O48pekqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768371731, "uuid": "7d496189-04a5-4c7a-9a9a-8749cb1e18a6", "value": 31084804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768371731, "uuid": "2784f9b2-c073-4ac5-ac64-98826f05422b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371731, "uuid": "5f949cd4-fc92-4cf9-8941-4c957a08cf13", "value": "AI+Phone+Cleaner_1.16.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a4a6bf-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418162, "uuid": "fdbeafc1-e513-437c-8804-7a1aeff59b6f", "comment": "Malware payload (Mirai)", "value": "da2df35bbb0eadc1389676bdcb19968f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418162, "uuid": "d690f796-cf5e-4fdb-84b2-7a1d3a1cbb9b", "comment": "Malware payload (Mirai)", "value": "a7fba4776ca5f12e2bd02f358ca3943ad95b4f21f316e131e5224c652bc4f819", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418162, "uuid": "11162dd9-c49d-44f9-8078-921513327327", "comment": "Malware payload (Mirai)", "value": "e0fdaf318cbe7da3500f1b8e293454a798ec360f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418162, "uuid": "fc552e74-4011-4533-9755-fb2ba4931099", "comment": "Malware payload (Mirai)", "value": "d1d8a4e5111e5b649aa2b2fc2fe342de7d1460a1de0374726f5b911908fb8ab0686f111215275aa90d846503386af548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418162, "uuid": "b3187c57-afdc-4dd1-b537-e5b5679545fb", "value": "T189730A82BCD19A1AC5C023BFA66F619D3361A3E5C2CA3103E8A74B11378715F4F26F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418162, "uuid": "4b4e4e30-84ba-49b1-a6da-cfacc16e33ab", "value": "1536:GxnVUOb9ekGL3A6a+aor1SFbpFZkJpLLXXCZ8AaB0lzQJZadFW:GxnVUORek9ArUFbpIpfCZOyKZa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418162, "uuid": "a2d1132c-f493-43c0-89fb-680be9a96a44", "value": 75296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418162, "uuid": "dab70371-4e1e-4aa7-a603-96e01f3bcd31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418162, "uuid": "4442e2e7-7eb8-4bcf-9de8-34d4d3a1741e", "value": "systemd-resolved", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff9f373-f11b-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1768375978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375978, "uuid": "444dad5a-3ef9-410a-bcc0-6c4c093788e1", "comment": "Malware payload (SnakeKeylogger)", "value": "bb33d08592e4282baa15a38cd90e03ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375978, "uuid": "bca0fb0f-0f41-4334-b438-cb2bfcc2312d", "comment": "Malware payload (SnakeKeylogger)", "value": "a9748173bb602313b8b1fc6eb71d4036ad98ba25c19b360326dd74cfd71c6522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375978, "uuid": "38a42562-cafa-43fd-ba0a-7f26675d2a02", "comment": "Malware payload (SnakeKeylogger)", "value": "fba225fe6aa2d624f91f03b878c0dba0f80b5704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375978, "uuid": "9101bab2-1c5e-4f37-af16-e22c7d2deaed", "comment": "Malware payload (SnakeKeylogger)", "value": "e9ad520838eedbba06dd449cff6e6a307c04e112fdd7d0d416ef48b7f6351f6559fe19a75a7d4ce8454e8c668e9667a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375978, "uuid": "e7afa004-98d6-4e0e-aa85-636b0127de91", "value": "T1833501582299DA42D9A24FF41972E3F06B746ECDE460D347CFDEADEB34687801848387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375978, "uuid": "fedc450d-a9a7-4007-a506-eb5cd591fc21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375978, "uuid": "eb235aaf-732c-4bb0-943f-53fbeb61217a", "value": "24576:d7/l46FaRzjOPckzBsqn5L1P/KLrfV2Q:dbHacU05L1P/K/9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768375978, "uuid": "940678ec-f589-456d-9d07-ddda437ba7d8", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768375978, "uuid": "9030ad50-526e-49f6-a050-c8b327637de1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375978, "uuid": "d3c29a4a-22f5-4828-b258-d1e5d44101d9", "value": "e-Transfer_Payment_GVJ736382132026.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae13fd4-f18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768425469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425469, "uuid": "d3c55ca6-11ff-4a4b-8bc2-f6e052aa92c6", "comment": "Malware payload (Mirai)", "value": "a2925d91a07032da7b28a789170777d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425469, "uuid": "fac7ec63-fad9-4766-9149-f4be95cd2858", "comment": "Malware payload (Mirai)", "value": "ab8106aff0fdf9df611d8ee62cfbb789c0bea194ed9e3db68c69522f544eea93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425469, "uuid": "23469e95-9b4f-43a4-a2e3-e81231a9ff82", "comment": "Malware payload (Mirai)", "value": "c2a0af92b07529f106bb6b2b4d5a2042b00fbc58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425469, "uuid": "90104507-196e-438a-a874-cf972d625924", "comment": "Malware payload (Mirai)", "value": "cc195b4c51d2c55c95cd652baa0b7fc44c3a2cc41fbd9e89257046616d97c061f7e3f1f357b839424b2332ca276a3a3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425469, "uuid": "827b8884-af4a-440c-bc2e-c78442b35438", "value": "T16EC34B237AB65D2BC4C671BA12F74730E6B3A74A287C86257DB21DC96F246C031173B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425469, "uuid": "525f3eb6-1394-4773-9ca2-ff744c2ad2fe", "value": "1536:3JYUMF07Q5yXACkwIbwvt49Wgo95Ot7yPfy9cKbx:517KyXACR7+9BoPgpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768425469, "uuid": "5072ee3f-6205-4f39-9b46-05da2f3ce188", "value": 124688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768425469, "uuid": "fe17b05a-88ad-47ed-bfb5-2b16cba3f129", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425469, "uuid": "6fdc6eed-bc68-470d-8b03-a63cdb3e62d0", "value": "2016Nwjspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e05808-f14e-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768398191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398191, "uuid": "8b386409-8a6b-4e67-a2ba-fa216b144f8d", "comment": "Malware payload (ConnectWise)", "value": "82d4ebcac782535ef915229689a83d19", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398191, "uuid": "23708969-c1d9-4726-9bf1-3bb8befd7764", "comment": "Malware payload (ConnectWise)", "value": "adbe945de8a7db3e0609ad8e9730dcacd7301da2a08fd9d58fce91c0e1eb3468", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398191, "uuid": "ebbddd82-7799-4890-85df-9fe5550ad92c", "comment": "Malware payload (ConnectWise)", "value": "7c65b0d8bad0aad023f6138a09e1984e0140df7e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398191, "uuid": "222015f4-23c9-4e44-b9ad-6feee339e105", "comment": "Malware payload (ConnectWise)", "value": "b16b2546b3e1f4511905bee6dc9befd4d3dbed8064b84728ed84666ba99e6383ec17c4491bc7c852a84046618f171e50", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398191, "uuid": "ac460ded-ad36-4fa7-a9ea-5afab7ef6d52", "value": "T149A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398191, "uuid": "c66ac3fb-ea44-4bed-a35b-d11561dfc60f", "value": "196608:zKaLNkbgXi4QtKaLNkbgRKaLNkbg7KaLNkbg:LWgXiHBWg1WgzWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768398191, "uuid": "5ccf1135-4961-415e-ac99-985c2a883580", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768398191, "uuid": "6199af8e-ee00-4b58-baa2-0827df889b25", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398191, "uuid": "31f29da8-61d4-4eb2-b4b6-a72c48546a0a", "value": "invite(2).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42e973b-f111-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1768371959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371959, "uuid": "cd50299d-c550-44b8-b27e-9ee3e702d4e7", "comment": "Malware payload (Joker)", "value": "460a8eae04ed3f2a8671ef4870891057", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371959, "uuid": "8729d417-7a95-49b2-bb1a-6e104c5f1769", "comment": "Malware payload (Joker)", "value": "b04238e463c1701599c050b964897de8f97b85693b96655dcc5f017facdb739c", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371959, "uuid": "7a4f10bd-5752-4408-86ab-d74867c16936", "comment": "Malware payload (Joker)", "value": "bc8b5a7203683437ddbbb289da419e834d84051f", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371959, "uuid": "c5b59fc6-85ee-4b41-bbae-afe625bc045f", "comment": "Malware payload (Joker)", "value": "bf4c7c6a39f1e9d32d406dda5a47477e1b897943908e33e8ea43848fe815f06b57f92136b950539edc1ceb945a39513c", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371959, "uuid": "14040c40-ebb0-4300-91c2-c74ccc0fc8a8", "value": "T1A28722C9E768EB1EC83A5036CD9E53367A460D22CA8396B3A614374C78B35F04E45BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371959, "uuid": "6575ac1c-49fd-4e6b-bc72-602ddebd637e", "value": "786432:R5Yhc95+whrB+IX8tMPRe1t+UAXG9jqsxyvVVmL32voTMcdz2m:zYh8UwhrWtrjAXG1zMVVmL00Mcdz2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768371959, "uuid": "8721de3d-c6a7-4a0f-842e-9cf692d4caad", "value": 36104975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768371959, "uuid": "5d873975-50a1-42d6-a7ef-7ddbb058de51", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371959, "uuid": "fffb276a-0b98-4629-9fb5-cadb84402e76", "value": "Multi+Language+Keyboard_23.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1dfd6b5-f127-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768381431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768381431, "uuid": "b9f1a76f-4689-476f-81cc-b91d1dd0c5e5", "comment": "Malware payload (RemcosRAT)", "value": "3b073d40431c14750c88a332baf24894", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768381431, "uuid": "81a75533-7558-4677-a195-ef66f1d46a35", "comment": "Malware payload (RemcosRAT)", "value": "b0cb11bc82dab5ec3f5c33b982f8d6d896ecb09fa42b5c850cc4529c045b18fa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768381431, "uuid": "7a1ec8ea-da2e-462b-a5a6-82344b4713e2", "comment": "Malware payload (RemcosRAT)", "value": "21b056a93e4d0f6c608a3a575a5c3575ce29639c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768381431, "uuid": "2c72b6be-4e99-4199-9550-b1cfb06781de", "comment": "Malware payload (RemcosRAT)", "value": "3d7edbd0e77c250fe84d8f80a0c33df11fa2f90176c807924864f114a84e1c3cb2463cbb12cf877b7f1b7d203629c3cd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768381431, "uuid": "02fe4aad-2f86-41d9-b67f-80a3b73a9e7a", "value": "T1F376EAB335D764A229E7ED6E56709A208C473A33344EC91CF2F5226620F5E15E931CBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768381431, "uuid": "f99dab2d-14fd-4181-b9e3-d4003f6f2913", "value": "24576:VQhbh3a65k5I1xlwvL/EFHKMBQA9u7c3Lul7btWzdMRctznuVtl3dGizYfaz2XgG:v91KyBoLC2Mi9uqexFVJG82v6vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768381431, "uuid": "8d15f78f-63fb-4410-ae9f-060c8479f60f", "value": 7522019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768381431, "uuid": "28e01d8d-56e2-4aa6-a354-5743959d024a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768381431, "uuid": "b68e4d28-bdea-41b7-9443-da61136b2156", "value": "Conferma.di.pagamento Banco_BPM.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8501e4-f0f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768358038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358038, "uuid": "226050d8-d6b5-4e39-955a-7402c96920bc", "comment": "Malware payload (Mirai)", "value": "b3d1d76b3c52eb19fa3a63e33874f627", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358038, "uuid": "584253c7-cb70-4228-ad6b-9d87a9a0ef7b", "comment": "Malware payload (Mirai)", "value": "b0cb456114f2fd7bdc8ee3f7a0da44ac1a673314ce90905826524f426413e13e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358038, "uuid": "32d3b36d-f578-4458-9d6d-3c97494fe49e", "comment": "Malware payload (Mirai)", "value": "d7bb4674a8c783e34085ae2dd94a29dcdc6a08d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358038, "uuid": "7a40035d-3b11-41cc-a7df-2f432de98c5a", "comment": "Malware payload (Mirai)", "value": "b684e960a90a3478d36250be45188ec4baf0f49641a88bb4d1e9d9f9fa635fd247af6096f71dc984646735a5cedc7154", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358038, "uuid": "e016d606-5079-43f0-8063-7520c0772c32", "value": "T129343B45EA418A13C4D117BAF5AF418A3332A794D3DF730699286FB43B877AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358038, "uuid": "db7a3335-5d9b-4e80-82ac-6912f9a94a4f", "value": "6144:LYoHI9SHOBzabKacEK1dAnJd7yHf9ihM/9hAU:LbESuBzabKacE62JsYG/rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768358038, "uuid": "25044799-13a9-46f7-88fa-1fd310168737", "value": 230960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768358038, "uuid": "f071b151-a6f4-4b88-b722-87322dc4c9d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358038, "uuid": "01fc6fd7-7697-4172-853e-97aad944ec26", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd50d71-f164-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768407459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407459, "uuid": "fa00949c-c68d-47d9-b818-ec3926b04c5d", "comment": "Malware payload", "value": "88723fc93d21bafee9e5538f16c72a37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407459, "uuid": "4ac48b89-d6e5-49f0-a17d-ceed95e05abc", "comment": "Malware payload", "value": "b11dcdb51365a6ef1a5292c5e530b5fd56797d3330be5dbe890d68982473c0ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407459, "uuid": "486d5417-7887-4f81-a754-038799f8e8e6", "comment": "Malware payload", "value": "74363bfb304832c139a8732b06246f49fe50aaa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407459, "uuid": "3da7e8a6-2c97-426b-92df-86c5bcfe5374", "comment": "Malware payload", "value": "ad425b3357a893f2c4246fe8d24eb5fe7882663ce24238d710e1eed4b98f0a79a7780e8ca3de6128d53abd3c2896fe7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407459, "uuid": "aacf52c1-aaa2-4f86-bc54-31a9923ded6f", "value": "T107F612E854D4D1F8C45283F1E18A27F9F04B385D0DF9D81B7FC22A40EA35C9AD8A6976", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407459, "uuid": "5a6d9273-f4bb-476e-ab94-487da6f87cdb", "value": "13b21afc0d447d4a2c33288c7ef8bae6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407459, "uuid": "b73a1553-d504-4056-9ec5-61c182246e95", "value": "393216:k7MOG4esKhrQcRW6ydGldBzr21iLOslPu2do022OaITm:AMOG4evd46ZJOfLDTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768407459, "uuid": "96cd8e33-0274-4f05-866f-ac1214a61931", "value": 16666560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768407459, "uuid": "067c0222-67d0-43dc-8b80-073a30c4f8ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407459, "uuid": "00656897-139d-499d-995b-adb38fdf0f2a", "value": "0x00080000000243c1-5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ec8c37-f166-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768408487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768408487, "uuid": "d860603c-8bfe-4512-a84d-e7c57f01f7c8", "comment": "Malware payload (Mirai)", "value": "2395514fd9997c890320e5207de592ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768408487, "uuid": "a88c9c78-fc6b-4f56-82bf-a1ea693a1b60", "comment": "Malware payload (Mirai)", "value": "b26c44ce8de75391723e76b8a0575103ab126e3af9cf47b97fe3bade18a19f5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768408487, "uuid": "ab4598f1-402d-45c3-9851-c2098bd89b41", "comment": "Malware payload (Mirai)", "value": "399ad6435e575642798777a02745af662f8153a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768408487, "uuid": "fbd9d607-2baa-46c1-b511-1cad3de7150c", "comment": "Malware payload (Mirai)", "value": "4fb38464a9b834c81e1f494b15dd3177ca561a01beabd6f4b460463c979f8f54f5f6a9eb9b8bc721366465243bb1453c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768408487, "uuid": "f27f6d50-543e-478a-8935-a0aafb1d94fb", "value": "T122E34B55B8828A22C9D513BEF92D018E331327A8E2DF7213DD105F2577C7A6B0DB7A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768408487, "uuid": "70a29822-47e8-4e56-b80d-9e30517be956", "value": "3072:ENcMOvrpToDzK7rMeQzlue1k6aU9zL6EiueCo2kU:AOhoDzKnMereS6a4IueckU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768408487, "uuid": "ea00327e-07f3-4d96-ba4b-759e7770fec1", "value": 145536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768408487, "uuid": "36978f74-ff4c-456b-b271-6fcfb1986aea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768408487, "uuid": "b543cd1f-97b1-4731-aa3e-314df85efa0c", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9edadd1-f169-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768409764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409764, "uuid": "14e16e02-3303-47dd-9389-dd57beb5ba1d", "comment": "Malware payload", "value": "26c951c16c25dab16779aa76675f9fc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409764, "uuid": "dcbb3b9c-0ed3-437e-a2d6-6106561b9cd4", "comment": "Malware payload", "value": "b3b17d7881f464d9e5d91b17274df23f1d8c62650875601f0a0a37eb42adb556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409764, "uuid": "a0c4945e-1ba8-419e-a9f6-a4291307a333", "comment": "Malware payload", "value": "447e5013461e984ddfa8d756ca66990da7af0ad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409764, "uuid": "a7f0150c-bc67-41fa-b297-3459c7b0dd9c", "comment": "Malware payload", "value": "2d26a95dde0eb6476de443c92e0a62f31e10e09aae0cb3dfda6855969e65fa251592b6af6aa309eee4229e1b78023d04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409764, "uuid": "7e004da0-9988-4326-ad3f-8eebd76c7fb8", "value": "T117D57DB230258B2AD01427B5A2FA7F7806C35DF7F091085F5E8F658662E9DD29E31C36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409764, "uuid": "6bc5572c-e393-493c-bda6-77fce41ee2b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409764, "uuid": "1b408b00-0518-4288-87f4-cadfa400845e", "value": "49152:5imkRL3e4XvJPKHkeDwGUSfx2W1MwUwBWH0QoX/W+5UJbFotDDqIp41H9pZfBbMC:5C3/JPyDwGHUWGmtDOtH9TfdMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768409764, "uuid": "0f5d8ee4-81f5-4553-9c98-f05c5dafe54f", "value": 2812448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768409764, "uuid": "417de3f5-2038-473b-82fd-cb40d214baa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409764, "uuid": "185236e6-55fb-44a6-a210-46cb3a44a4e6", "value": "fatality crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0880e750-f16e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768411533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768411533, "uuid": "7a3091c9-fce6-4a41-bc90-405170afec04", "comment": "Malware payload", "value": "ab24e08da9e205ee3d3a5a2a05345cb9", "object_relation": "md5", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768411533, "uuid": "bdbd2020-a9bb-4539-854e-9aab67508913", "comment": "Malware payload", "value": "b4195e7584ac97d9c444ee6292160c80f9c889e6cba27cc656506d3c5fcffd48", "object_relation": "sha256", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768411533, "uuid": "76b1808c-dbf3-4dda-a224-0e68bfaf7150", "comment": "Malware payload", "value": "29de6fff67bdd0d8fb8e68476ff1040fde48420a", "object_relation": "sha1", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768411533, "uuid": "c95e1caf-ebab-4f69-a380-47df4e387712", "comment": "Malware payload", "value": "33ee5c40b9951fd2bb6b04273fda97552e442a54258bd76bf234d1845e7f6856fbd8f09bc740730688d4b7f27bfffaf5", "object_relation": "sha3-384", "Tag": [ { "name": "SkyCloak", "colour": "#7B71B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768411533, "uuid": "6b15fd3f-4a11-4f30-af2a-9b0216eedefb", "value": "T11FC63358B530CAD92A4BB7692F8537F43BB041153FE0A54F89A256414237BEACBDF04B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768411533, "uuid": "b58fe7e3-a9b6-4e89-bca9-037d30d3db88", "value": "196608:vzHrez0ULspj/jbbEnAgrbYD7Estcq5RMo4OrskJcRfwQrpXEboCSFbTOm6rhOfi:246spj//LOW7S7a+/1xUrh45ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768411533, "uuid": "a357bbac-c8c6-4d96-a2d3-aca8e24615c0", "value": 12415010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768411533, "uuid": "8ec17387-7b9e-450b-a315-91281c78b961", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768411533, "uuid": "7cfebb29-b2f9-4794-b6b2-51d7b5c3f58a", "value": "Iskh_6626_Predstavlenie_na_naznachenie_na_VD.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ef9283-f14e-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768398185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398185, "uuid": "9afbfee7-bd3e-4f87-b06b-645b1972becc", "comment": "Malware payload (ConnectWise)", "value": "d59c9540906b341f9f1a4f11adcc3527", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398185, "uuid": "d343de60-3ab4-4048-ac1b-2de3850572be", "comment": "Malware payload (ConnectWise)", "value": "b50ca8d5e2edf9bab610f947337e52ca7d9e3187d2fc245386186a25b31734c9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398185, "uuid": "757eaa4a-a18e-4c66-9cfa-6eb8abc45197", "comment": "Malware payload (ConnectWise)", "value": "27aa52fe94311b71d402f723e8231e1457ec73dc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398185, "uuid": "28e19db9-6b01-4dd6-82db-05534270f064", "comment": "Malware payload (ConnectWise)", "value": "ff06f2350b8ef54c8a8d51186ceab213b2d8b1c7bbc9549c108da3faa9d0865ec41d707ab26e95293dd6cda5de7fbd07", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398185, "uuid": "5f8d16c0-847c-4efa-a65b-c94410363d02", "value": "T1AEA6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398185, "uuid": "c2425b1e-6d66-4396-90cc-3c4f148c7e15", "value": "196608:6KaLNkbgii4QGKaLNkbgRKaLNkbgdKaLNkbg:MWgiiHoWg1WgxWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768398185, "uuid": "b2bffeda-6c4b-4080-bdd1-5da1633dda46", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768398185, "uuid": "2baedf93-5d29-4954-9290-7900e43866ff", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398185, "uuid": "0fe3485e-0286-4aa1-adee-f02c350192ce", "value": "InvitedGuests.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3569389b-f18b-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1768424064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768424064, "uuid": "86a83741-5d06-408c-8e0d-554e1dadf687", "comment": "Malware payload (Gh0stRAT)", "value": "cab0982fbf54c3c1637d4a998ecc0103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768424064, "uuid": "ef07e7dd-2ae9-4537-807f-b88f054269b2", "comment": "Malware payload (Gh0stRAT)", "value": "b5ea2e9e55132ec404d26f9e48522533dcace52dcce21ba493ed21393adc1ce0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768424064, "uuid": "44abfa18-ef03-445a-be6b-184617e80fe2", "comment": "Malware payload (Gh0stRAT)", "value": "a131778f118e6d9514c8ca7b5c83d6ae10e6ca87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768424064, "uuid": "6bbd33a9-0ad4-48a2-8823-c3c089ed5a20", "comment": "Malware payload (Gh0stRAT)", "value": "d5a1536804265e93cf6ad0eba64770a0f73bd399366ca5bc0e0929ed1fb021f3b5448c54b05fed31bf4fc5688aed2bf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768424064, "uuid": "4597eece-79d4-40e1-be8e-2f77d5f6deab", "value": "T14A173327768765FEE46AC639497ED212453B7A916D228C2B52F808ECCF234D43D3F942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768424064, "uuid": "a0b141be-8fb2-47c0-88d9-5c5121bdb709", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768424064, "uuid": "ee0eaa77-da4b-4e2e-9350-cf3426f1b161", "value": "393216:qfGNPP88gbdjKy4ASp+CPBH1/vbIJKnykRYBZh79Ff1c+cXrt:KI8/tSp+Un19ReZhZZqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768424064, "uuid": "ea4fe1ac-6adc-44de-bb25-66f5a1538a83", "value": 19807106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768424064, "uuid": "f194f6b3-780b-4497-9545-5788630bb395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768424064, "uuid": "e326c538-66c5-405d-88f2-db1eb1b1532d", "value": "Instalador DXSafe Middleware - 1.0.34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c414ec-f14a-11f0-a129-42010a9c0007", "comment": "Malware payload (DDoSAgent)", "timestamp": 1768396090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396090, "uuid": "95b23d04-b573-4a57-b703-a8b22c508af3", "comment": "Malware payload (DDoSAgent)", "value": "a121afdcab5d25c314d6f91e16a52da8", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396090, "uuid": "bac5d4c6-0b10-4dad-b998-ff8977ddb0b1", "comment": "Malware payload (DDoSAgent)", "value": "b5ecbca7df8b6bb636300a260b6295be0207d3be29a298dce61f7c4a94a3dd66", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396090, "uuid": "eb77a37f-2a13-46b0-bac8-9d6e616fc5d9", "comment": "Malware payload (DDoSAgent)", "value": "d130d3b6711418fb843b1148af963aba22d3862c", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768396090, "uuid": "5625c55f-e6c4-4eb3-85af-e503cb7d5e40", "comment": "Malware payload (DDoSAgent)", "value": "7f2ddc67aaf6f971cf2f36891ae3c31719677bca74abb42601c1770646e67210fe39262e59f4a9c3389f35b8e3efa74a", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768396090, "uuid": "8b19b8a6-64d9-43a0-a4cf-31e257a05797", "value": "T191461711FECB54F6E9031E3105ABA26F63315D058F24EBD7EA407F29F97BA910932219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768396090, "uuid": "42e19be4-afef-416e-904a-2b9d09be60a4", "value": "49152:Sr32yCmfdiN3xTUuyDzyKCv6yfAky6UaxaOFKGkYSjZtl6h5E3:emyCmf+xTUuyHyKXlpWI4XE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768396090, "uuid": "dd779776-eea6-4b2f-b4ca-5105a9a4a084", "value": 5677240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768396090, "uuid": "045ef555-6c17-4a1b-824f-6277a6bf7b3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768396090, "uuid": "43edd6dd-97c1-485d-bb3f-bb7f9215b184", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcba7818-f14c-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1768397233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768397233, "uuid": "f266daca-b546-4238-ad46-c7c4e8c06cf4", "comment": "Malware payload (ScarfaceStealer)", "value": "e7f24748c7cbc1c4ca81efcf3f9d38da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768397233, "uuid": "e03fce0b-f846-4782-b6da-83a50ee6d7d8", "comment": "Malware payload (ScarfaceStealer)", "value": "b5f207df908c155e4b3c79fd0aa94bc8e910cc1cd04b73ccd6b1c47323b4f0dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768397233, "uuid": "41808dbf-78e0-4f1b-a246-b2684f02148c", "comment": "Malware payload (ScarfaceStealer)", "value": "6a0b87697a259e2f4b440be07b74d85d796c6d45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768397233, "uuid": "11cb9d88-05b0-46fb-86b4-9a1156dbac53", "comment": "Malware payload (ScarfaceStealer)", "value": "0dae591b1b93932fe49b6b66b48ec2c10948332917cc3e24f6911fd9128aa1f69158f37c373e12bb91d79e79102cb443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768397233, "uuid": "0f352c1f-a660-450a-94b2-4aadb384d521", "value": "T16FE623E7B4C461E8D8938BB0D38F53CDB4F0B6054ABA692E37CA2D029630E974745D67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768397233, "uuid": "a40e9ccb-af01-4daa-a7ae-21b08d56a0b3", "value": "c6e890f2bf1c766e673a9f6fba99f26a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768397233, "uuid": "5a6f426c-ae3f-4d59-a90b-713da606f1f3", "value": "393216:q+uVrZy7K7gNfSIqAVJVFcVY6aDXscD9K:q+u3y7uvyJz/6gXx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768397233, "uuid": "ac95850f-c7c5-4fd4-9d72-29fe8c73f89f", "value": 14123008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768397233, "uuid": "11402f0c-23dd-4f96-a495-d3d83f2d7772", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768397233, "uuid": "4934f258-5964-4379-b173-7b7f31c2d645", "value": "Xenos Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5986c7b7-f10c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768369579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768369579, "uuid": "a7bf7a11-2ff2-4f51-b464-548b97064d5f", "comment": "Malware payload (Mirai)", "value": "cb959f64b85daeef50d7ef1f79926bc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768369579, "uuid": "dc2f54f3-5e2d-4b55-9810-d8e7d85807b7", "comment": "Malware payload (Mirai)", "value": "b71ba1689de9a8f3971cfaec066c8289285012e8d451e3c29450dd99b420f6b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768369579, "uuid": "b70976e9-7292-41ed-8feb-db9a17fe4874", "comment": "Malware payload (Mirai)", "value": "f6f774803d21d1e45b31346638a1436e709a6c31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768369579, "uuid": "ead419d8-5598-4789-b8cb-1d2302557d34", "comment": "Malware payload (Mirai)", "value": "747d36c88d4b57572cf85eb69787ba55db897b3953a095f400bdd8fe8db19f187dcb46b37e80121d86aeff606bdc9b6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768369579, "uuid": "25c7d246-31d8-4cfc-9e2b-bbf2f0e8d5a0", "value": "T175C38DE47A8E3D92E2C7D33DCF444A62712BB5F0C26192F1BD12132DC1EADE989E0551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768369579, "uuid": "11218862-d936-4abf-b5d4-7c1a8c6afc3d", "value": "3072:5e2eb+z0JLx+RpSEJpfI4zbiRvHGYWexT:5e2eb+AalJy4zbi9m1eV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768369579, "uuid": "1310f0be-0b49-4615-be7c-8d1ef7ca0a1c", "value": 124784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768369579, "uuid": "374dad91-0664-4223-a04d-6cdb1c85b707", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768369579, "uuid": "07579606-963b-4a3e-a4f7-338fcba25377", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c30a14-f192-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768427179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768427179, "uuid": "d9b38f6d-8e2d-45b6-8486-b0ea1d48831a", "comment": "Malware payload", "value": "8a14e37fa816b765947c1791c21410ac", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768427179, "uuid": "f970dcc4-40b3-4990-931d-b6ee7335c52b", "comment": "Malware payload", "value": "ba0905b431b71f6e060f0c5d5edfe52d99e7090031b0fb1e652e6e846502651b", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768427179, "uuid": "6287fca8-b02d-43a8-9331-5cbc07e0e703", "comment": "Malware payload", "value": "aa96be551e1ee5440713678fc182095683876b3b", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768427179, "uuid": "9275f89c-eea2-4b1e-b3ff-e8360982ecbb", "comment": "Malware payload", "value": "29ff535cf3f57a2edeef21af7dc3da0f181e04e97e234a0e1d27efa37e9692e0f4b986855bd9ce1cfc291147109b8722", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768427179, "uuid": "59af593d-9759-4615-97a6-66fb3c1f071f", "value": "T1A9075CE2EE500776C69BA33AD8E2424A2230F145173514DBBAA417A64D57FC8173FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768427179, "uuid": "589a4714-f11c-464a-bb0e-cdb67ea3acb1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768427179, "uuid": "d2ded86e-1239-4a3e-b135-81191a74061d", "value": "49152:FdnUNSGtKueRIomssOPu/hCIxQBgm9OBX3Gsejg90l2WifEXU48ZstqOdvJ+a:FirxsbYgWGbWZstqOj+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768427179, "uuid": "010cb035-a6b5-45f6-a270-b25a98e5a4b6", "value": 17314944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768427179, "uuid": "ca8e9329-1f44-4dcf-a32a-0128ba6d35c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768427179, "uuid": "b8ce8be6-e4e1-45b0-883f-2801dba489cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fedb85d-f18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768425451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425451, "uuid": "d732b224-3d69-4eaf-90d8-a9f1e9f970e7", "comment": "Malware payload (Gafgyt)", "value": "20e9f78962faaf35b06da5558332c671", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425451, "uuid": "2d3eae23-a0f4-49b4-bdcf-37465b492d73", "comment": "Malware payload (Gafgyt)", "value": "ba0b2a30b3d2605445576fce4621bd7022d1007f17719e2059917f364a85d1fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425451, "uuid": "2306b040-6855-44a7-a2d6-9043e3edc6ce", "comment": "Malware payload (Gafgyt)", "value": "e319838a3dfd3f656deeeb985955e20de749c28f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425451, "uuid": "83c0c2fb-f958-40ea-a35e-736d2f64e69f", "comment": "Malware payload (Gafgyt)", "value": "ed92b888a6b7b9ecedf09b0fe7e4bc30f3bdc16854b179545aee3b5469026f6770551174d38f0ea2c813927324dba2c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425451, "uuid": "c35fd6d6-a971-4235-ad9d-fe754c4ca2d4", "value": "T1D0A36B63DB225F16C00AA5F0B5F18F395F13FC698C270AD5A166EBE59243EC8B845374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425451, "uuid": "a2f0b49f-7b54-4bd5-90fd-0d7d5f91177e", "value": "1536:BJzdPreRkJ6yfmAmBMCEBkvYEkKvbjTk7bzxd++Ck5YXyyL8U/K2bAl:Zr3ODoBkv3vbkrxd++9Y55K2bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768425451, "uuid": "300ce76d-a95f-4ea2-9e27-633ca789e430", "value": 101160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768425451, "uuid": "0aab611d-b4e9-4682-bc27-28cdbe450552", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425451, "uuid": "f5cbd865-d646-4929-adfc-b6f4975c839e", "value": "2016Nwjsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a6f7a0-f10c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768369732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768369732, "uuid": "6f826744-72d4-4dfb-8833-8c273c2d5230", "comment": "Malware payload (Mirai)", "value": "2680f443ecec3978f993a4cfc109a552", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768369732, "uuid": "59d5620e-628f-4ce4-beda-7287f7d1bb53", "comment": "Malware payload (Mirai)", "value": "bbb79739681ed7322c8b2978730532817670d42e1c6b83e2a5aa2e09f49b70ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768369732, "uuid": "6ea4cef1-201e-429a-af38-6bd9880e734b", "comment": "Malware payload (Mirai)", "value": "8a9c8e533bf9e92de22e85a24fbbea9d236a35be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768369732, "uuid": "f5dadd92-64f0-4951-aa29-5e7ea0381400", "comment": "Malware payload (Mirai)", "value": "453907b4b27ccfa9622a23790d84ac6f103913420403c310abb4317968a34e69828bb0b777957cc65a841c5389c43bde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768369732, "uuid": "201a5650-9ae3-4efd-aaff-aff39586c16e", "value": "T10DD31855BD819B15D5C626BAFE4E528D33132BBCE3EE7202DE145F2523CA91B0F7A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768369732, "uuid": "c7a0eedb-04d3-4691-9b84-6a8f014fb4c4", "value": "3072:lkIeYRZtBL6F7v3tzxDLlE42eRaUVak41oRoY7XyLavfFtPj9:lkhYDti7v3tFDLlE42etVak41oRoYDy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768369732, "uuid": "7848b59f-0ed1-46be-8ffb-70af8b629626", "value": 131308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768369732, "uuid": "0639359f-806a-41d0-9748-0377a4b1ff92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768369732, "uuid": "b13304c7-8365-487c-a822-c450b621c777", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643b7c9c-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418130, "uuid": "df89f330-be8a-4818-a8a6-b085a0efd5f5", "comment": "Malware payload (Mirai)", "value": "f3402ed047f25babada5ca9a9ed668ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418130, "uuid": "046edf2d-701b-41da-b5bb-7a8b2abbb690", "comment": "Malware payload (Mirai)", "value": "bc41f2dc924c4cb42e4b1efac4cfcc6f96b9ca71cf4357d37e2ea9e1419f7052", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418130, "uuid": "26489c73-1d4c-4dce-8176-8f6f9de02901", "comment": "Malware payload (Mirai)", "value": "5a110a054caa18742c676ddab20d3e082560da4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418130, "uuid": "8d3f7001-5507-4512-80ed-07286c933bcc", "comment": "Malware payload (Mirai)", "value": "66626d7c4f15070b91cba0985550113b77f11100a96e8f8458d8562a724cf60137b774f102e82ab44dc62b35d6133d86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418130, "uuid": "be3bf5b8-9db4-49ad-be66-0d840a52632f", "value": "T131F3BF73B30F6490C86646F40BCF6B5C263321119E7BAAD76C6E323F5A721DA59063E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418130, "uuid": "4eb06df1-196a-48f1-9712-f13bf5e57710", "value": "3072:2jT7fK9JNov+KmxCrxUmgHkn44g6gDAFTq2gwCf9/FdAdqI:2O9Y7MHmV44gfchqACf9/QdqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418130, "uuid": "a9c111d1-1a86-4700-8bad-71ca65b942af", "value": 165504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418130, "uuid": "89b9cca1-c400-4bdc-b62b-c79eb6a7b09d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418130, "uuid": "ac4e4c22-b244-4f25-9704-0aaa2cca8c40", "value": "networkdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898cf580-f122-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1768379108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768379108, "uuid": "e7aaf448-6c7d-4f4a-b2bd-5a82856ebcb3", "comment": "Malware payload (CobaltStrike)", "value": "23d416e4ce37c8a405f59712fa55b8fb", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768379108, "uuid": "7012cf3b-18e8-4854-9032-109026e32d34", "comment": "Malware payload (CobaltStrike)", "value": "bcd332c9a77700156ef02bffec7d0c5a09dbf5c6ee2e924a1eff56bbac70c801", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768379108, "uuid": "cda81c3e-5d9f-4f58-9dc2-38f9df21023d", "comment": "Malware payload (CobaltStrike)", "value": "69d69b881c513a76c24d0e5bafdc216f4f1b3aa1", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768379108, "uuid": "5169bde8-c207-4745-af4f-ac5fdf6c774b", "comment": "Malware payload (CobaltStrike)", "value": "9666a60d86b66401a87880d363150445fa5c31599ed45f6797617226e81a85e17bf5e53ee70ae959846cd8c19b8033ea", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768379108, "uuid": "2cf74749-e163-44f9-834c-b7ba0a9fd890", "value": "T1AE92D93FE71368E9C506D57846FF7732DCB23DB385E6931E2724D2B42E106A42E6A610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768379108, "uuid": "eb9c1fc6-da59-4f91-98a0-e862dc5b3ec7", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768379108, "uuid": "ef0c972e-580a-45a8-9e10-8b7a3342279f", "value": "192:RV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2XbyhWF8qa1Dojjgi:jqaCF31cix+Dc4zj2bycFF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768379108, "uuid": "44ae39b5-fad0-4f89-998c-e8e6fb7ea0e5", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768379108, "uuid": "1b69a56e-9a77-44b5-a4c9-384af1200288", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768379108, "uuid": "e837ff22-f330-473a-a3b8-776b2d9ba6fc", "value": "bcd332c9a77700156ef02bffec7d0c5a09dbf5c6ee2e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c96efb-f0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352453, "uuid": "59b3d711-c5c8-46ea-ad13-0fadac0f7627", "comment": "Malware payload (Mirai)", "value": "f51ed4753c68bf981d5e837e12e11617", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352453, "uuid": "87175d3d-fb86-43a3-bca3-b5dae819f089", "comment": "Malware payload (Mirai)", "value": "bcef5d6a503c6fca15c039cc4f53e1098316a22c1f9fe29d19fc3beb5e1e4637", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352453, "uuid": "051dcfee-769c-46bd-825e-728b813275d7", "comment": "Malware payload (Mirai)", "value": "45ac2c4f3d4f4865b6a1cfeb0616f30b32fd8db8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352453, "uuid": "75c64a1e-0e03-47dc-bd3d-356a56b72434", "comment": "Malware payload (Mirai)", "value": "95c9b85b43ec722c78030789714d6b42a915836751b644ac8ea764f199261e18e8e07d5aaf28536f5f4fa01ca25a8572", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352453, "uuid": "09bca04b-2879-4815-9e63-81966b7f7c9e", "value": "T1B8C3AE32D8396DC4C1A45434F8B1EE711FA1A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352453, "uuid": "247ff080-fcbd-4acb-837e-e5ce001854ac", "value": "1536:qaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKRZwMQaX4jnOsKigXIQSUwrVr1vwE:qf5Z5Z98XdmVMJaiaX7ziGSUGfIwEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352453, "uuid": "1d96ea3d-ef70-4cdc-8f07-8b570ea7b7e0", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352453, "uuid": "7dad7839-d81a-4945-ad92-80f517a278cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352453, "uuid": "d6f0730d-f2fb-4ba2-af2f-a0f1595d6f97", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d441b5-f161-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768406194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406194, "uuid": "c9fecf70-b06c-46de-8587-7237184816a2", "comment": "Malware payload (SalatStealer)", "value": "a8b606096ce29246e0765b1ce63e2b8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406194, "uuid": "d1ac0dd9-c761-48b9-92ea-fcab5c46f1e4", "comment": "Malware payload (SalatStealer)", "value": "bd1f81e68e5fcc43e3b964b47a1f034d6d97f79a6712006e152c85f9071b732e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406194, "uuid": "f533eea6-0332-44fa-a200-8a77728e17c1", "comment": "Malware payload (SalatStealer)", "value": "38f0b021af7b8a2e7e7fde385bae3cc000be2324", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406194, "uuid": "a364233d-9ef6-4618-bf38-fca5d6f2efcc", "comment": "Malware payload (SalatStealer)", "value": "d0bf65bdf7deaef9df5339d06ef13d993ab7f53bd2f895eb154f1b41057d28491bd51c5141fbe4124f2f2654fe252b41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406194, "uuid": "6dcf7495-25ac-4538-ba05-bfe9cd8ee4de", "value": "T195E533928F92C32DEBFA17F4CC64D57965B2916913C268EB7F8D0AF1F0091E464B7890", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406194, "uuid": "e0e58f8e-0d5e-44f7-b714-b6c055cf187d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406194, "uuid": "a974c34c-0290-4695-8137-ff58b5af9c2d", "value": "98304:OoZptcVBLHuDgYA4b6KIhLBI6nH54o4B9U:NlcbcgYA4wI6Z4oC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768406194, "uuid": "ca0b5235-9b8d-47bb-9df5-c1f2c50d201f", "value": 3291136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768406194, "uuid": "a38cdb4f-64b5-4b76-afbe-d0864c9a832c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406194, "uuid": "f42736fb-ffdf-4d3c-bddf-5f7d94d7fed1", "value": "0x00070000000243b4-14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5453210e-f0ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768354967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354967, "uuid": "70d66dab-1308-458b-a0c2-feea3771a304", "comment": "Malware payload (Mirai)", "value": "6559d00aa0c1d9a3c1368d4c51354e41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354967, "uuid": "81020afb-213e-4b41-a460-5c8ad975b544", "comment": "Malware payload (Mirai)", "value": "bdc3c1a358731293755702bd652082917aca40049bde358b898ec62dce7b40ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354967, "uuid": "f5823c59-40ee-4ab8-b149-111f0f044c0f", "comment": "Malware payload (Mirai)", "value": "93a9782b2e7d4a69754eb027bbbd062a565e1983", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354967, "uuid": "78abe88f-ed61-4749-80bd-53924fa9a1ca", "comment": "Malware payload (Mirai)", "value": "1a3f365b2c485ceeb06eb84d81d49ea384a44c168af6c59f55a9f6a1154fe9c5a240ce1a4c1b7fe92091acac9c4ebfe5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354967, "uuid": "562eba80-4d21-4eb3-8874-26d9fa1b678b", "value": "T1ACF47D62B7318F94E365D27005F3C6165A9822A70AF684C1937DC6207B507AE2C6FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354967, "uuid": "1275255e-4b5e-4416-9c69-3632c52044db", "value": "12288:PhsfFGaD0ZXDBe49GgX4tWXO0S2EmlxqgpZYdyrVA2L4:JsfF/D0xFD9G3T0SH+guVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768354967, "uuid": "2c617490-6efb-493e-bc31-94e9e339101a", "value": 731944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768354967, "uuid": "ea7c4897-d555-486b-a33f-dbff4b713ebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354967, "uuid": "ebe5d7c1-397d-4cba-b366-5f9026374083", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f733e19-f0e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768354234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354234, "uuid": "1604b918-f9f9-4b7e-955e-1d8ec98fdf95", "comment": "Malware payload (Mirai)", "value": "2c6d6e8f4f3edce40d4557c8cc5b5b83", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354234, "uuid": "2872257b-c1b2-4f86-9920-06731b40b71f", "comment": "Malware payload (Mirai)", "value": "bf5a1e8b25d6ef368f11028fc492cc5e4a7e623a5b603a505828ae1c2e62fa3d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354234, "uuid": "6ef64d02-2796-4e47-9861-ef1fa9706a2a", "comment": "Malware payload (Mirai)", "value": "f9abe14126b5ed2c1e80044de3799c5a01c98840", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768354234, "uuid": "3bcf50f3-8964-43b0-be1c-fdfef0383001", "comment": "Malware payload (Mirai)", "value": "e62d697258d59ad0258653db2a3fce848972527a6c4e521db853230c8b309ba90d831a6415bf452dee306410d3af2d0a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354234, "uuid": "e11eed6f-94d0-4c40-9c32-497ada2197aa", "value": "T10E31B48F063F39154EC7CF1B73E107CA521862E1F087DBF49C092A26A8D9888749CED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354234, "uuid": "93b1bf87-3d9a-41eb-b673-ffa8dc706d53", "value": "24:9+h+Nhv3+w+o1jvQpr5rta8i/TiTCrVTdzTdtz2PSA+AiGOAsDx8G5GcB8jlA2SA:xhv7NvOwrfpA4GOAyuaTk7uGet2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768354234, "uuid": "baab9aed-674c-4653-a205-7015f9c8f9ac", "value": 1599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768354234, "uuid": "5746f4bb-4afc-4c4a-8179-a42099499758", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768354234, "uuid": "104aea2d-237a-4c8f-a443-626eea531747", "value": "logicdr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ec7a25-f18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768425463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425463, "uuid": "de5f73aa-4f21-4f48-8451-07f332223fc4", "comment": "Malware payload (Mirai)", "value": "bd473cb577a8fd0ad9c4b7223b50d2fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425463, "uuid": "8d28f935-a971-4ebd-b965-fcdf2ebdfc44", "comment": "Malware payload (Mirai)", "value": "bfce7735578ea691e018580599d49e10f7d8e949f0070c21a9bc7eaffc7b3c56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425463, "uuid": "50cf8b4a-3103-42eb-994e-27751777c98b", "comment": "Malware payload (Mirai)", "value": "fd92163aa5f51b8115a8973d3abe3631586f0743", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425463, "uuid": "e8b8f956-7897-42d3-ba59-21f80eec54a0", "comment": "Malware payload (Mirai)", "value": "2c5a5accf7f2fecd3b1c1a3f122635dc96b9378394067373df5d25d7b950f738fded7cf487d875915e39c90698b814d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425463, "uuid": "71bc4e6b-cdd9-468c-8d28-df6e724ca628", "value": "T1ADF3A61E2E21DF7FF669C27047F38A30979872D526E1C585E27CEA091E602CD641F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425463, "uuid": "f11081f7-e144-4b25-8629-312865310402", "value": "3072:fHqGCRWj+R5eP4uZpRzcfjxl1YFXzCDSKwVaGnANdj/twOruaPfyO2+r6:yGC0SR5ea1YFXzCDSKDvfjlGcfyir6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768425463, "uuid": "7a36e03f-f723-474a-b6ca-99b855b4e797", "value": 158900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768425463, "uuid": "13caabd2-dff1-435f-947e-8a94adac1153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425463, "uuid": "fdf3c170-1223-4090-946e-e3310e411897", "value": "2016Nwjmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfef6547-f15e-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1768405023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405023, "uuid": "57b22daf-d97f-41ce-85e9-79e564bcba15", "comment": "Malware payload (GoToResolve)", "value": "dbdc8457ee4e65630d70f386e93a90ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405023, "uuid": "4df6fc68-bb22-414a-9f00-90bd0641eacd", "comment": "Malware payload (GoToResolve)", "value": "c0cc13990cf447a748ad1f6a0facf17a065fc64e05a5f9f591c9aed384d0a244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405023, "uuid": "bdcdcd70-ca66-46aa-97a0-54f8c5c9ce52", "comment": "Malware payload (GoToResolve)", "value": "964ac30c5bf019c230c59a481d61a433d1615b39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405023, "uuid": "0e5f3336-1fbd-466d-b0f1-d143e51252af", "comment": "Malware payload (GoToResolve)", "value": "924634bed18a71fb3edf4a8aa07e96a2d462a2f434f21fbbb47301785ad51bd682981f52252c43dfb5227c1917a34d42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405023, "uuid": "54388005-6cf9-428b-915e-df58b358d543", "value": "T1DE3733217159D071D89111B1A9289FBBD2AEA8344BA60DDBB3EC5F2D9B301C33736D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405023, "uuid": "c035d932-88fe-41e1-bb6f-bfa365447e41", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405023, "uuid": "10e11213-a3f9-4f33-834d-44628a1233a5", "value": "393216:F8QVLTc3XQ/P2M4fBNssphLGmFINm4Y/kiCngsvba6beOBL2jk2WhyMwU+gBz5b:GQVLw3An2nBSsTiwImki6ba6NRqkPhyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768405023, "uuid": "1d869618-2361-4524-ac03-a9d29b52f4d5", "value": 24464352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768405023, "uuid": "b98fee41-1c0d-42ba-a3c8-5d3926e9db97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405023, "uuid": "dfcb4da5-5819-4599-ad06-70c3a6b5fee4", "value": "welcome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c81a948-f15f-11f0-a129-42010a9c0007", "comment": "Malware payload (Chaos)", "timestamp": 1768405098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405098, "uuid": "66bdeefe-4152-4bd1-8e61-36a7c6fa84ea", "comment": "Malware payload (Chaos)", "value": "08174ebe8d18f4be23ce9560f2e9bf98", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405098, "uuid": "795fcc0c-21b3-4da9-874f-3b70d6342513", "comment": "Malware payload (Chaos)", "value": "c14140334714625be71b73008adf8f54c878e3c9f979c3e58d6518fb5efdf485", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405098, "uuid": "f81e1530-e26d-48a5-8d70-e6d29e638e86", "comment": "Malware payload (Chaos)", "value": "48ee6826c604f553e7a265eed60eda3c558f2903", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405098, "uuid": "bc952da6-8d5f-43b8-8b4e-7328df42a4e4", "comment": "Malware payload (Chaos)", "value": "feda3063e37321e7ee77a873768ae88e5617ece5938444340139bc74697172973f1caed9184031fdf83fb06dbaf92254", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405098, "uuid": "b21d6758-c0ab-44d6-ada7-a9eb7a421eec", "value": "T1D9A461383BEA291BF5737F395ED4776E882EB7A23506E79DA08303861741AC08D51D36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405098, "uuid": "2194a49b-06da-4ef9-9764-5a29ac895757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405098, "uuid": "def69829-0816-4704-a3ed-42599b745ac4", "value": "6144:VYq94vHpEwKDdBtZd2L9btLJYmXF7REfzdwNpv23Lc:VYHpEwKDdw9btLJYmV7efzdq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768405098, "uuid": "3cb11fd9-cc2e-445b-bb07-34566a00109f", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768405098, "uuid": "d2f2af5a-3af5-4965-8fe2-3a41a50b7e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405098, "uuid": "d55b939d-f398-4f98-b6bf-359704a62d2b", "value": "R3DSKU1L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295ce792-f117-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768374222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374222, "uuid": "4d225123-20b6-4864-97d4-0100772d22ea", "comment": "Malware payload (AgentTesla)", "value": "647a5930a09d4cace63389aae5bb0a67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374222, "uuid": "cdacbbe4-ea8d-4d41-a77f-5401d5bc8080", "comment": "Malware payload (AgentTesla)", "value": "c14b63abf2b17ebc4be8f586430bbe89e1f33f52f475491fb3bc3001b86bf664", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374222, "uuid": "31084248-4c8b-4642-9d47-ed7d0e8795b5", "comment": "Malware payload (AgentTesla)", "value": "f2507867e4fb1030e8008af74c040692514974d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374222, "uuid": "16532779-104b-45fb-b9f1-f86d8ed39007", "comment": "Malware payload (AgentTesla)", "value": "c20f28dbe17848739b24e4bdcd10afc08ccb4f2a8b4093d747ce5c6495ab81008f019078ab605a7d1d1a929b0f12263d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374222, "uuid": "f003bcb3-0b5a-4ec8-8166-fbd3d7c4b0e6", "value": "T18894E626E620B4A5F89345702D78A646782D3D3A2A41EC0BF789EF593771983B1F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374222, "uuid": "50ae1cee-67ad-4569-ae14-ec0de6d3945c", "value": "6bca593fae0db46e72a3951ff82463db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374222, "uuid": "2b7507ea-7685-46ee-bed0-5a3cc5b6e39f", "value": "6144:8NK7FcbOLUo70+DeS2713QI2uM1uHU6fwHZwQvmw0y8V/XeUBVdya:8yFAwct713QI2uM1uHU6fOnmw0yeve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768374222, "uuid": "87a95784-0ef5-4dc1-b611-8895b5b42097", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768374222, "uuid": "1829faa3-3f9e-4e4b-a525-d5bcf37b004b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374222, "uuid": "65ea37df-dd38-43e2-9081-a362a3e8c093", "value": "fizz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7470888c-f160-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768405702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405702, "uuid": "d963cd77-4684-4ebd-9cc6-1e5f3c3a1580", "comment": "Malware payload (ConnectWise)", "value": "eb3fcc14b23c82745d39a220304d7a06", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405702, "uuid": "0067596d-4f27-400d-b7bf-efc144d6bc5a", "comment": "Malware payload (ConnectWise)", "value": "c1b5f7a5064f80e04d00b41cc5e24aee5bf394d592c4e4baf9da188237b56b3b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405702, "uuid": "e20f7b6e-8741-4e95-8253-2af82658412c", "comment": "Malware payload (ConnectWise)", "value": "52c864c153809cb8a6ec00d90836698c84c30d92", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768405702, "uuid": "2e5d562d-cdd0-4c71-bf1c-024f13686375", "comment": "Malware payload (ConnectWise)", "value": "ad30eb6855aa635a3fd650bce9d8ffd5ce28ec5f7951103e1c176c278030da8fb4a3605953629a0e9449d560d5313f82", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405702, "uuid": "1ca20963-970b-4f40-91e8-aa76eb190f46", "value": "T164C623B127E98425F1A79F39EE3A89E229387C64DA16C45F0BB43C0E1971E509B71373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405702, "uuid": "ecf4e951-564d-484c-b56f-78d10d750e2c", "value": "196608:IKaLNkbgKi4QWKaLNkbg+KaLNkbgSKaLNkbgTKaLNkbg:uWgKiH4WggWgkWgrWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768405702, "uuid": "393374f2-55e7-403d-8ba6-a6c6558e4611", "value": 12185600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768405702, "uuid": "881dfe30-597d-4120-916c-176f236b3f66", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768405702, "uuid": "104461e8-6114-46c0-8b98-d389f21f6481", "value": "2026JoinInvite.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d4cba8-f11e-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768377176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768377176, "uuid": "741209c2-ca56-40f6-b70c-7e29870ba451", "comment": "Malware payload (AsyncRAT)", "value": "1f01a600bb8ce7b88c3a741b44130e25", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768377176, "uuid": "b8629fed-a2bc-42ed-acc5-e5d2d0b1855a", "comment": "Malware payload (AsyncRAT)", "value": "c24d8971ba0a1db43178a025c2e74d2e80ae0115a92cc1fe125aaedc46d3fd52", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768377176, "uuid": "5331f17f-998d-4562-b7a6-e2ee363a70ff", "comment": "Malware payload (AsyncRAT)", "value": "ab8e9095a6fd8c56ae5005f18a9a5bce535e9820", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768377176, "uuid": "750017d7-8528-4e6b-a90e-8f0ba5f3eacd", "comment": "Malware payload (AsyncRAT)", "value": "b1f338d97e1986b454a8146ed8d2cb8bec9a22611aa584b0aacffabe4ac17896f461a17cb26b6f5dba06a73e511bb7d1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768377176, "uuid": "d87014f0-fc57-4440-a235-36ecf0010a29", "value": "T16BC21B0873F48265D1EC47BE48329600D375E68B5D13DB9F6EC4A5AE2A237CD8621BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768377176, "uuid": "9d79f977-03f5-478c-bf3f-df6ed897ae3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768377176, "uuid": "8f32f031-cc9d-49df-b475-d793bcd4416f", "value": "384:8Yu2rYmu1Zdjh5zgedWQkbMMymrJhxQHqqbuUsJQxnCJf+BWfXWc/Ou+:8YuXm6vjh5EtQkAMyCJhxmFbHBFBtu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768377176, "uuid": "678011e2-078d-47b3-b8a6-5a4dec401653", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768377176, "uuid": "47ae15a4-f5cc-442d-ad84-3ab79a509c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768377176, "uuid": "63a3335f-86be-4773-963d-9662ba2df56f", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157de3dd-f16c-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768410696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410696, "uuid": "136e85c3-f8c9-4e76-bf3c-3914bcd532c6", "comment": "Malware payload (SalatStealer)", "value": "1d232fce4cfee5d6e0023ce56ebcb026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410696, "uuid": "a7be3cf6-dcf8-4fcd-b653-bb2030d31355", "comment": "Malware payload (SalatStealer)", "value": "c4719fc5a5ba7dd1a974fd2b8b06e5e709c68480798a9749a88e0051af191c37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410696, "uuid": "81d09a2d-fca9-4b7a-93be-ca28413b18b0", "comment": "Malware payload (SalatStealer)", "value": "967b44d0897e8d2edc79bb9f1d88dbcef7f1c8e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410696, "uuid": "d4b651cf-42d8-4e41-bb2a-6fe7ea49af9c", "comment": "Malware payload (SalatStealer)", "value": "9d0e155b1bcd1de6b0c2d1e5d86d45aa55cdf003d9a1676b57df0b01fd3a0d6864445d703cda54a0864d655fa3f5ef5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410696, "uuid": "badc1d21-85a4-4b54-b491-e79975fc84e5", "value": "T14EC65A11FA8B54F5E9031839406BB23F67315E048B28DBDBFB543B6AFC77691192B209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410696, "uuid": "2b760d4f-f8ed-4490-93ca-211288d46d17", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410696, "uuid": "3b686d56-bd1d-4517-abcd-744df8a45413", "value": "49152:7+69nnKNX3esMMWXSzRbmkYC0k6tMSbLnnkvuYPN3/4EvQiqOWuQ2OIrjUunYbP6:qAnnMMMLAHdXx3eUD7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768410696, "uuid": "5dd84463-35a2-4428-81ff-a521ffec17ef", "value": 11660800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768410696, "uuid": "ca210455-b41c-46ab-ba75-01a4e17f68d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410696, "uuid": "0f2de6aa-646a-4382-addd-7d1f2daf5837", "value": "0x000e0000000241cd-6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf472eda-f162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768406713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406713, "uuid": "e00376fd-88c3-4d53-9e6c-6645cf6e6cef", "comment": "Malware payload", "value": "d96b63bc723780f77202dceeaf408f5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406713, "uuid": "b42822c7-7968-4e64-abaf-1e6edaf7dc82", "comment": "Malware payload", "value": "c47c5846083c3e8814437de53786d75a17b490428c8ba79e01f94568bb1fb346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406713, "uuid": "8ae94460-c88c-4f7d-a2f8-7f2b5a4e7124", "comment": "Malware payload", "value": "50f809e8fbc90c942cbdf50fa5d3ea7af485c736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406713, "uuid": "9fe0b0bf-a28c-44d0-96b2-eb34196ebfd4", "comment": "Malware payload", "value": "687174c5546783dc2daa6d4114925f102b7991e81e9b18a0af05e69f66804a7b5168ad59b754ec166067553a3dc9a6f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406713, "uuid": "ff749943-7a7e-4a21-8fe6-9396704dcab0", "value": "T18CC2FA042BF95229E6BFAA7858B17304CA3ABD356C12CF4D6844254D0E36BD0DDB1F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406713, "uuid": "41feeaec-5367-4493-a03a-3c8985fd6ecd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406713, "uuid": "9139f5ac-6af0-45d7-96c9-d988e30d545b", "value": "384:ARLKO8oMW+kxPRVe1+bvrCKD/4cmTxicRA0HDtrk4:A1my+kxPqIbGsdOWYtr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768406713, "uuid": "75088b1f-d1e1-439b-985a-8cf2c1c38811", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768406713, "uuid": "f43a2a6a-202f-4be3-93a8-717864cc859b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406713, "uuid": "8da9d007-7c61-4fe5-8177-3e1a780b5c7a", "value": "0x001a00000002b308-22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03bf4dd9-f16a-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768409808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409808, "uuid": "298519df-aba4-4bd8-88e5-543894bbbafb", "comment": "Malware payload (SalatStealer)", "value": "772d39723b853bd7272e3baa6db5d825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409808, "uuid": "ee5579b3-3852-4b1e-88e0-038036a8271b", "comment": "Malware payload (SalatStealer)", "value": "c4d0be64d635a60469cee32feea753316b9ff9913f0314c0d8b194acd3bd27b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409808, "uuid": "a15f18c9-0687-4ffd-8e8e-708d0f0f7892", "comment": "Malware payload (SalatStealer)", "value": "0d0e73172e0451ec333ab94fa9333d05dadfa2fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409808, "uuid": "77a2c1a3-7a1c-4d8d-8de6-34e6d60a52d9", "comment": "Malware payload (SalatStealer)", "value": "fd1ac3092df94f83acf5e73724c7f35c5eb3fc4835c32ae76e24f6fd5961b0ed8563d11b47f1e3b181d797c5129a2dd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409808, "uuid": "4fe5deda-09cb-46c9-b1e2-de08f6dbaae8", "value": "T1A6C65A51FA8B54F5E9031835409BB23F67355E048B28CBDBEB543F2AFC77692192B209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409808, "uuid": "ce6126b0-d4cf-4c15-8f13-8fe3047e7753", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409808, "uuid": "591c67b1-6ac6-4c91-9dcd-baaf35f6563e", "value": "49152:RUKvrW2x7BO+A3V/mZgDZRksZ88mxpUBPfvn6JunN5cTwHVn3v0QUlvyTPj0unn6:WSrW2lBE/T7jdEM60NC7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768409808, "uuid": "1d76f26c-4c55-4369-adf8-277f7a8a1983", "value": 11660288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768409808, "uuid": "937370ee-e747-4978-9341-cf4e42c57928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409808, "uuid": "477742de-2a9e-472e-8e0a-509e20c84601", "value": "AntiEac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c7451e-f0f4-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1768359402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359402, "uuid": "8beadc8d-dc2a-4af7-a767-85aaf07d2f2e", "comment": "Malware payload (Joker)", "value": "229db849c8a4f450b04bfa031fbfa808", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359402, "uuid": "b4e33ba2-ee0e-4cfa-bbc1-157a1814602d", "comment": "Malware payload (Joker)", "value": "c72950c346077bd8aaa42f7397a8501f86d94768d3180d0e9de78f9b9f349952", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359402, "uuid": "a59090e9-3589-4e64-bb61-0c81de914f0c", "comment": "Malware payload (Joker)", "value": "ac73595a085ebb2fc7652252ad8d886f14d98f36", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359402, "uuid": "5cbe6847-ede0-4a92-9d05-59cd42018f17", "comment": "Malware payload (Joker)", "value": "437c01efa12266f067e9e33625e04716b725cd7a9da66ceb98762248daa24bb5e6d4f75def2639945c20c94866e3eae6", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359402, "uuid": "22dcd975-9c6d-4c79-9d2d-9d8a60f36722", "value": "T10E18F108872C9A35FDDA747DAD796EAEF23D5870417AC096C825E805F38A1D483F7683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359402, "uuid": "5b1fef6c-379b-4ca8-b59f-4e799b4303a0", "value": "786432:3aV1Kb9Q5bR0fxGwV2dB5/ayGYPZ6ljbXrLKYl+llwmKKcrp8ZWOVoGl3mEI6rrP:3AKUeZG7clj2YPmAvOPZICerv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768359402, "uuid": "e9083c84-2431-4604-bd7b-0f561fc41ec4", "value": 86609351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768359402, "uuid": "d78339ff-13e7-4eb4-8511-85166abfbaf9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359402, "uuid": "b15ad37b-eae5-4b4b-a2c2-7a980836a367", "value": "Moon+4K+Wallpaper_1.16.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c5b819-f169-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768409762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409762, "uuid": "60c67320-bf60-46dc-a0c7-855f30f24973", "comment": "Malware payload (SalatStealer)", "value": "af0aca20c0686559a4336070974dfc47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409762, "uuid": "2d8f7dd2-3870-4939-8ddf-a9f6ce15f69b", "comment": "Malware payload (SalatStealer)", "value": "c74d72b2460cf8058b9bb86d811a66c51c8123899ae5394068862d719d864cc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409762, "uuid": "9ea8f705-fb37-4574-889b-345eef778311", "comment": "Malware payload (SalatStealer)", "value": "4828b1c8527c29bf9874f8a983efe3f3cae86ffc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768409762, "uuid": "e181a827-dca2-445b-a2bc-73db1e3c3e05", "comment": "Malware payload (SalatStealer)", "value": "9a96cf60ea5118cd621cb4e292b84cd02431060bf4a2a2c18fb81bb90c86eb91889803a3a6c2f29c1e8ddbefc2ddb138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409762, "uuid": "1f09ed5a-b10c-4f28-8029-eb8db57d1bd9", "value": "T1E5E533A61C799871E3ED0D3644C77123A3FB69C3A87B1D4351F5E2ADCD2A11A8C871E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409762, "uuid": "4d3bbb38-6bf8-4a58-9b6e-b18655a5d21c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409762, "uuid": "d10ddd8f-0053-4689-b5db-d6103aab2fd5", "value": "49152:2beuN2C8TuExePVC2Ko0iCWHaa9qbJCUeCWPEazSAzCgfScXFR6nlUsds:2qu1A4C2K9OHjKJCUb/Bc18l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768409762, "uuid": "66ebfd91-15e4-4619-a7ed-21572675eabb", "value": 3292672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768409762, "uuid": "24bfdbae-0633-470d-8f35-babdf1d7cc65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768409762, "uuid": "b7af0da9-31cd-4e84-82b9-de0319c41831", "value": "ExtremeIinjectorv3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1575afe0-f0ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768355721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768355721, "uuid": "f8ce6e2a-a0d3-4a69-8334-2d12e82c9317", "comment": "Malware payload (Mirai)", "value": "a62405449dd986917fae1fdc5500c841", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768355721, "uuid": "9c92e3a2-2ec0-401b-9a4f-28ce062e9d2e", "comment": "Malware payload (Mirai)", "value": "cc1d3e676b7a1f8a2957593809741e305b53175206970f9e92aed74a20a077d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768355721, "uuid": "bea1d884-09aa-4f44-8731-879bdd5ca7da", "comment": "Malware payload (Mirai)", "value": "6044814726e87a6f4e63fad1c7116d2d3cf1b22c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768355721, "uuid": "faf0cee4-6a6a-45ef-ba00-6d17bc9ee7f7", "comment": "Malware payload (Mirai)", "value": "54119413ed0061f681c4c890bbf1c7f0716a9f968f837f37197ed068ce4356287d65991afa814fe4cf1a608259433cdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768355721, "uuid": "18e4af50-5933-48ec-a47c-47b354539fb2", "value": "T1C803F9827D828F13C1D122B6F7AE018C3B117B7CA5EF3242E9227F91778689B1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768355721, "uuid": "3a5897df-fdee-4bdb-8ed2-062f4268a40b", "value": "768:X3E/INu8Pom2hjIWj7GEHoFw1qzojrYqT1BGa:k/sfWjqS+w1WoXlga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768355721, "uuid": "a12944dd-673b-4d30-9878-5f04803e7b40", "value": 39720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768355721, "uuid": "930a7048-e752-4c41-b27b-224f43587b56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768355721, "uuid": "619a259e-e431-4176-8f84-0259337f9cec", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed74793-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418201, "uuid": "bfe1c713-9cb9-424b-90db-baff43113a94", "comment": "Malware payload (Mirai)", "value": "18421f6cf5f1c6f364b787377743bc92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418201, "uuid": "a7e45d36-a811-4fb3-8f86-303f610fd622", "comment": "Malware payload (Mirai)", "value": "cee1c71d5ecff8e8e71e006918280dc72766bfba8aef0256eb0ac8b4d9bea692", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418201, "uuid": "aec1b5ca-5dbf-4ef1-a0c3-fcbf3a426991", "comment": "Malware payload (Mirai)", "value": "329d981684484f6372c650e83ff22ee6d7232e75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418201, "uuid": "affd413b-4030-41e1-b2c6-8af6746709a8", "comment": "Malware payload (Mirai)", "value": "6455c4c92bc4f902774a42db622899f6b0d1610e9d34d68c1f0121be372be1c9c5e7ae90323c7dad0776b137550c1afc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418201, "uuid": "3145f7b7-7068-46dc-83a2-9e88f997a046", "value": "T170F36D02775C0847D1532EF0263F67E193EFD9A224E8F640654FAA8E9172E73158AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418201, "uuid": "e4558799-b7b1-4e4f-bb00-91fab0db93e9", "value": "3072:ZSEkIEiipXDbwzDbABJx8JxyCuKaxFMYx3nUnmo+oUc:ZSEHAKuHx/x3nUvPUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418201, "uuid": "a3ffc4cb-2931-4848-b23a-d7cba5060199", "value": 166748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418201, "uuid": "1bd931c4-9415-4401-b552-9283e4b8237c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418201, "uuid": "55ad6e93-a27c-4305-a113-66429375ea21", "value": "kworker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb68e59-f16c-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768410819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410819, "uuid": "2ed1da74-a313-4e8a-adf9-020bfe8026be", "comment": "Malware payload (ConnectWise)", "value": "1afb37951ab232813edfb23ee30ff0bc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410819, "uuid": "47268e7e-c65e-443d-b9ba-0076d2f4b33b", "comment": "Malware payload (ConnectWise)", "value": "d0bbd98d7765987e01648bdeef8965d76fbfc8b31f5276a6da08ce2fa5d657b4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410819, "uuid": "3c46ef74-8b7d-4948-a84b-db252f05792c", "comment": "Malware payload (ConnectWise)", "value": "3e3114016a10be2ff31a8701e9818ce1b3ece9e4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410819, "uuid": "001c2f83-6eb9-4f3f-814d-02978d833f22", "comment": "Malware payload (ConnectWise)", "value": "2e699c36f3fedcdaf1b7e04de44b5d54aa4b3b6622f170eb50401ce0acd7c17a659149b5eaf58600c46acef204059b5a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410819, "uuid": "f9c3111d-b96b-46fc-9aee-a80451deb439", "value": "T143A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410819, "uuid": "d6904875-e389-40fd-97cc-373601c36d0e", "value": "196608:xKaLNkbgKi4QUKaLNkbgRKaLNkbgTKaLNkbg:VWgKiHKWg1WgrWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768410819, "uuid": "382d2887-7f20-4daa-9ad3-c6badbe9eb1f", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768410819, "uuid": "389b1f90-3979-4319-bd81-5ffb6638a463", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410819, "uuid": "fe834f5f-3b06-4951-92dc-ccf2f7e8c958", "value": "statement.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbf9bb8-f16a-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1768410093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410093, "uuid": "c40df838-3758-48ae-bf3b-d761f4856bdb", "comment": "Malware payload (QuasarRAT)", "value": "1783667b95697089a50786dcb01ac381", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410093, "uuid": "10cc294f-aa26-42fb-ba08-3e0f6bace8bc", "comment": "Malware payload (QuasarRAT)", "value": "d33ca9f86008d57257851b55ed04609e32b436209db53f6d3d23ec2e0289c9ef", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410093, "uuid": "fbe540a4-6040-4f9a-ba82-714eafc33f93", "comment": "Malware payload (QuasarRAT)", "value": "45932c67c4f59ce5106c70cf8bb0f7c8d61f15fe", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410093, "uuid": "16e8efcd-d727-4b6f-bea4-137ed6fa6780", "comment": "Malware payload (QuasarRAT)", "value": "9d6bbe8699144e844bf6e2ea3d438c642afab6d62ff495f111ddaffac981479fb3901f21d16681f9a1bb99add628d2c8", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410093, "uuid": "6483fc8b-9c2e-4659-a4b6-410d2cf73c3a", "value": "T16CE55A143BF85E32E56BD273D5F05026A7F0F82AB763EB0B119167BE1C53B4488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410093, "uuid": "e92f2592-f75e-4209-b573-d8af9221970c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410093, "uuid": "36833950-cc7a-42a6-879b-644fa5d5a63f", "value": "49152:EvdlW2p9agXI2PrlTnr4BZmFzeiqhCg5g+yBe2LoGDXB8THHB72eh2NT:EvbW2p9agXI2PrlTnrmZmFzehCXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768410093, "uuid": "83a7e7e1-3ee6-4de3-b094-871b354f2d7a", "value": 3267072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768410093, "uuid": "83fc0270-d9db-432a-a597-d6c1f13edb64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410093, "uuid": "55efeeb0-ba7a-4331-b0bd-d3615915be92", "value": "QAGAEndpointQuantum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c5c3bc-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418124, "uuid": "ab093016-aee9-431b-9466-06fa6b5e1cb4", "comment": "Malware payload (Mirai)", "value": "e9f868a80038dd8dbcdb2c5dd00dc0c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418124, "uuid": "5359ba1d-49b8-4124-80fe-46130fbaf84f", "comment": "Malware payload (Mirai)", "value": "d45a24a0e3b94a40cb8716571b92fcdcebc2b58afb8c7b1c7c16f9b836f8697f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418124, "uuid": "2459c7b8-27f2-4dd7-8a79-8775be52e091", "comment": "Malware payload (Mirai)", "value": "ff9eb8a5da46a966106de7aec8810d6ef3b26474", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418124, "uuid": "1f9f0f54-a3a4-4b79-82ef-0942d5b99460", "comment": "Malware payload (Mirai)", "value": "f42a6defcbf4ee532dd0bcc614da33b500c2bfd23f7e2a6b1fd9a72f513169e594ec41ef8b977074aae0c4758f904f6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418124, "uuid": "70542744-47b9-4d97-a66e-f7d2805644c8", "value": "T15033F10986FE76ABE7DCE07EB4FDEE5F49026429F50287414EC460069E98F401C257EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418124, "uuid": "52ca234f-f311-498e-9643-030d3c475163", "value": "768:PkTDM6Ab3PWq4bkCdXlP4m2DXwEVQLxGOtrEegNLCDJWlYLL+EGDvnbcuyD7UgQq:0C/WxAsXZ45wEVQL1lrRDYLBnouy8gyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418124, "uuid": "328c68f8-add4-4f2f-9ffb-d264c8bc52e6", "value": 51244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418124, "uuid": "01a95ad2-023e-4df5-8722-60c5db0ccbe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418124, "uuid": "6de3b845-eb98-4ae8-97ab-f21f83898bd7", "value": "sshdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c20578-f16c-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768410802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410802, "uuid": "346185a2-a4f9-43de-880d-f86f6b1fb91e", "comment": "Malware payload (RemcosRAT)", "value": "6418bd0abb8455648111b8ddedfcfe5d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410802, "uuid": "e8f355f4-6cda-4eb8-8b5f-806ba389a310", "comment": "Malware payload (RemcosRAT)", "value": "d5b5a49f8b54ee355cc5c3b17957ad16317396beb58bb87894ab8b11a62ddf25", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410802, "uuid": "8e919178-d44a-4326-9a21-c8febc8c7f8c", "comment": "Malware payload (RemcosRAT)", "value": "086da5e14d730a881d5f871919cfc24f93377691", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410802, "uuid": "e3f467eb-e36b-4b1c-a0b0-bfa2596485a0", "comment": "Malware payload (RemcosRAT)", "value": "b5885371bf6470275bd058961847809c90aae1d4b812a17eaa7ae076ce47c8da9b528680890d41a4954f0881b04d0159", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410802, "uuid": "b33265ab-16f9-45d1-904b-f4dc21961e2f", "value": "T16B461A02946895C7A56A851FCD9F97E50708942F9E40AFC4F3C0FDEB6608D05BF8EBA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410802, "uuid": "8322711e-a6d3-4e33-8e54-835b2aab81e4", "value": "98304:HxxXJBHxc2syi+7KTJVgMKhTmjwAEDTiVLCavXkI3cIodEfR+mtDSXxCD4g:TXnsTqKT77MTmjw3cv0YqmteXxCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768410802, "uuid": "538557bb-af71-45af-aa44-8988013f9043", "value": 5828814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768410802, "uuid": "04d61092-1bc6-4f50-9f88-1cfb603acfc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410802, "uuid": "2f171963-2083-4d53-863e-696f3c4c1c19", "value": "PAYMENT_CONFIRMATION_TRANSACTION_COMPLETED_1930006219.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87804988-f164-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768407452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407452, "uuid": "3995695e-025c-4d6f-8329-fe4cea68e58e", "comment": "Malware payload (SalatStealer)", "value": "980b77f4f7fcd62c196135782fd92748", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407452, "uuid": "88e7c404-e75d-43f3-a620-c39b3baca5e0", "comment": "Malware payload (SalatStealer)", "value": "d73e55088f9d1d5e3a52676b463282cb68065fb7e049d338598a22e98c26c396", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407452, "uuid": "aeb8d66f-0429-4f2d-80cd-b6f9f0e4dd82", "comment": "Malware payload (SalatStealer)", "value": "fe6b318f813b1b8410b08bba26520e159af71319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407452, "uuid": "dc6a2c5d-1bf9-4c9b-9ae2-f9ba2806556f", "comment": "Malware payload (SalatStealer)", "value": "911921aaea5b29ca48bbd36e14ff44affdc7b960a67e7a52b0f95be34733350a56b829f1a3ea52e512630d31e1c7e3ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407452, "uuid": "9265c6ac-b097-4587-9cd7-a9bfc5afc037", "value": "T156E53320EEE148B7E986B0FFCA8817A70126E384E1541B9F01912FF356A5DCDDE8391D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407452, "uuid": "27d15f11-9907-4dbf-b619-b2c6facfcc48", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407452, "uuid": "2dce5750-fba8-456f-a13c-9d47d21d39dc", "value": "49152:iK0edjCtJt8V+5l6Ew0rEbnw8xdqmxy5R0OEfR7wxBf4JiZ8ESy7UX:yedjdgTE7wEuR0OEY54JiZ83uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768407452, "uuid": "e1b7b3f4-aec3-4dfb-989b-e9ea3eb0d0b3", "value": 3291648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768407452, "uuid": "4f941f74-136f-4d58-8120-a73b923381a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407452, "uuid": "260cdf59-f0b5-4718-a087-201bd8497e0f", "value": "0x00070000000243c5-16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e26bc78-f174-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768414335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768414335, "uuid": "575aeac9-82b5-4b7f-95c8-ea093cb69a63", "comment": "Malware payload (Mirai)", "value": "b1c316ef99c6e32ada16a1624c1f05d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768414335, "uuid": "2caeb39c-f1a3-42b1-8fd2-40bee91f8724", "comment": "Malware payload (Mirai)", "value": "d7fb2f7eec9d78dc6e3e0f1ceb9fee0bac983485d5517128cb1159c17eeb1a82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768414335, "uuid": "d5b1a4cd-1142-43d8-9ab5-9b3b492c2c3d", "comment": "Malware payload (Mirai)", "value": "0d9b084fe82a7eee08c669032149e688238bffdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768414335, "uuid": "3aa3af24-6a3e-469d-8bb6-1f004eef351d", "comment": "Malware payload (Mirai)", "value": "e47049585435c055e7fcd4fde148ff62adb51a139794469151db428e9671f6f75bfaea86ce2a516225c9f7f068624744", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768414335, "uuid": "6d6d0812-92cc-4d1e-9c0e-4cfbf47b2a01", "value": "T162C33912F98584FCC0CAC1340B6FB63AA935F1DD1238B2EB6BD4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768414335, "uuid": "b6d6e2c1-92a5-463c-ac03-3ab546883d39", "value": "3072:iY83TgBMfVw+Z7cHIzO8SoMFAIRHp9hApD7bhLiFkazQBV8IattGp:in3TgBMfVw+Z7cHIzrSoMFAIRHp9hAJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768414335, "uuid": "e22e55b0-1da7-4139-bd7c-cc67b44877a3", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768414335, "uuid": "0e9a9251-cf49-410f-8ef0-bdd2d4f295d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768414335, "uuid": "a2d78578-edaa-4d81-9212-741e15af8bed", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec2100a-f103-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768365937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768365937, "uuid": "8991d361-c15e-4837-82c5-bd1eb1a7793f", "comment": "Malware payload (AsyncRAT)", "value": "8811ca4bf5d9450c49bd218d7e7785f9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768365937, "uuid": "5c86f9f2-b796-4e92-9533-3193b416fd5b", "comment": "Malware payload (AsyncRAT)", "value": "dbbeb9b466b5316bfcbbfb06f83654321e6f76c43dc5d902edce97e84feb2c2b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768365937, "uuid": "9539cf88-996e-40e1-b1e8-05a5da807ce3", "comment": "Malware payload (AsyncRAT)", "value": "9c3a4d60f1ae50b2659238f8f10d749a3b20bb33", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768365937, "uuid": "28af8729-85f5-4f80-b6ed-73f9ac815318", "comment": "Malware payload (AsyncRAT)", "value": "4321f7edcb017521542bc4f82ac095d226a08c517e882a6f251260e8b94e298d97da36dc52fc853dea66bd9dd29116ca", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768365937, "uuid": "e817eacb-a234-45c8-b59d-12b667cfb75b", "value": "T1DCC21B0473F48265D1ED4BBE48329200D375E68B5D53DB9F2EC495AD2A23BCD8A21BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768365937, "uuid": "0c8c37de-59a0-4a4b-9d10-4970db931d69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768365937, "uuid": "aa52b260-42d4-4740-8734-b96717ac3a33", "value": "384:H4eMn+LbqY3zgetmQkLcMymrJhxgHqqbuUsJQxnCJf+BWfXWX/Lu+:H4nncb/3EtQkgMyCJhx2FbHBFB3u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768365937, "uuid": "605927c0-3df7-438c-8e10-817806547f69", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768365937, "uuid": "899df9ac-32bc-409a-ba2a-d5cfb2bf3436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768365937, "uuid": "a67782d9-681f-4b75-a6f5-623b969c92a3", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20295e7-f10d-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768370157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768370157, "uuid": "378cc52d-f26a-4c41-b641-67ad2ef2182b", "comment": "Malware payload (Formbook)", "value": "708db27a089593014082d18e745d8e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768370157, "uuid": "81cb9a0b-ce7c-4fad-84bc-321e00cd1278", "comment": "Malware payload (Formbook)", "value": "dc868203fe63fc8e75865fcfe43849fc1a4fd6a845416dee9497834b158669eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768370157, "uuid": "3b41ca4d-a2fd-49f8-a15f-90e07ec606c3", "comment": "Malware payload (Formbook)", "value": "951e40e57f6e08637114883a3eafcf301104aad5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768370157, "uuid": "8a6b34aa-a05c-477a-b87c-8d92f7b5fcf3", "comment": "Malware payload (Formbook)", "value": "8ea96264b225448c4a19094adb87add2e1c6468b091b1c75e6e60f926aab57e025af805fe2c83b4838937f02456d6e80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768370157, "uuid": "0678c7bc-1b87-4f08-9c4e-76c506eba44e", "value": "T1BF35126EFE79AE52C66D0F73D413104842FAC2579637F29904DE19E10CAB794C88ED2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768370157, "uuid": "3d68194c-fe75-4d7b-917d-712e37ba5827", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768370157, "uuid": "b223f384-53d5-479a-9e25-8498df59cde0", "value": "24576:h8FdGwQs+hYJQHu6z7lMNn4//u8U+vgSill1CJYKJ9zd0G:iGwQs+dHFlMN4//rrgSillSYKJ70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768370157, "uuid": "96febe8b-6127-4cc3-98f8-50dfa00d56fc", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768370157, "uuid": "a42bd994-5c32-44e3-a791-632a356b968c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768370157, "uuid": "be5d7188-0b74-4d3d-b02e-cee6fe3cf740", "value": "Baltic questionnaire.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909f1a27-f0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352921, "uuid": "8d54fbb2-b815-4ad5-b82e-40a677ee84e6", "comment": "Malware payload (Mirai)", "value": "a00f2230bae10a4179220f40b13b50d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352921, "uuid": "66842677-4e8b-481e-a786-b42d0803946b", "comment": "Malware payload (Mirai)", "value": "dcc262b49a2753495bf553d3e5f767dff3749107ef553744c0f531393cb45b80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352921, "uuid": "2e29c000-f59e-40dc-99b7-835ddd1df3bd", "comment": "Malware payload (Mirai)", "value": "789ccf45d2bfc9e5494902c05be02d4b2341403b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352921, "uuid": "517d1ca5-4e3d-4e0a-9605-36c4f3baed15", "comment": "Malware payload (Mirai)", "value": "c85df015c3f31f905e029ec084ced952f5f6beeba420e69a8f1a8de93d893ac5690f58f73058d1f6a8acdae146d7f481", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352921, "uuid": "8d5ace5b-265a-4eaa-939c-2cd974086a1e", "value": "T12AE33A56E6808B13C0D617B9BADF424533239B64D7EB73069928BFF43F8679A0E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352921, "uuid": "6be8c686-1feb-4a46-9ba3-15aeb10743e4", "value": "3072:y+kRUUqD31SZ/xcftlWaiZygXBxpHb1lmFdRf6DxM/9GCp4HALX+X:y+keUc30/xcfrWaiZygXB7HiDRf69M/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352921, "uuid": "9a613a2d-a12e-41b8-b739-759474b5e64d", "value": 152505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352921, "uuid": "d5d96c87-6392-4b67-bbbb-a7e9bce64d91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352921, "uuid": "160001e3-7959-4e61-9681-9bf51c2f1934", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5a3938-f164-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768407456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407456, "uuid": "056487ef-d042-4af3-9911-976a3cc7ad16", "comment": "Malware payload", "value": "ef7c410af1ccb39db08570c1f42b090f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407456, "uuid": "32031b76-75b0-4e1f-8ddb-1ab0c45eaef2", "comment": "Malware payload", "value": "dd2ad54ad99c74e7016cc7389419460a866268b56130cd7c2328bcd46d8133d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407456, "uuid": "26555b38-3f53-4e99-a1aa-1d1f2a0edd78", "comment": "Malware payload", "value": "0fd52dbedb2ffa24d80dd1175e2de322bacadc87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768407456, "uuid": "cede523e-7382-4d61-a65c-0765e4ebc181", "comment": "Malware payload", "value": "993c46a72e667002e70de100176ffe26de0ae2ee88593ebd544fd923037ff866b9e8ce74efb2a7eae134af935d51f000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407456, "uuid": "ff302f2f-f24e-45b4-9ace-2faad129cb26", "value": "T133F622DA25C4927EC4518038E54A13FAF0C97C894CBE8827BFC76905A534CE9D8FAB75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407456, "uuid": "94601845-5756-4d23-bb40-414ae556d739", "value": "d14ead43f58e9c839d2c450a5b1a59c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407456, "uuid": "856a81e7-5b98-4539-9a87-cb1c625140bf", "value": "196608:7jhZTM+EZZ8NwEpCF2Os5kM1pXBziaQzJBwt63k6yGQYqE/YoK1cfEq6296tLvmy:7wZ8NjkGpX0a+JByMqXbIu2stp6yhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768407456, "uuid": "a16bc3de-8af9-4ba1-ad1d-8b83089b6220", "value": 16144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768407456, "uuid": "77e4f543-5420-43db-9914-6958756ea816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768407456, "uuid": "154a4a94-324c-43cb-826f-cfc703dddce9", "value": "0x00080000000243af-4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b88245-f189-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768423201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768423201, "uuid": "609cb0f6-cd48-4de2-a757-abdb9c637d8f", "comment": "Malware payload", "value": "24c1b0d6bae6c9314dc8344c479aedbf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768423201, "uuid": "f12be2d4-e620-4049-8d7e-8877c8bbb51f", "comment": "Malware payload", "value": "dd44bf8dd431961fd87edcbc709ff334d41b2d5c3986af9832ab932afb4c8104", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768423201, "uuid": "32b0f33c-c5f9-4098-830b-f61c47410157", "comment": "Malware payload", "value": "3480fbb821d417761b0c39a60b3cacc172afd609", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768423201, "uuid": "0df664aa-8dcc-41b3-a64e-c3909b0f49c6", "comment": "Malware payload", "value": "c475905bab6702cf8577374f5cea4e9b373f7923f98703f33389a6c97f8e40d53b8b62e752b3dc6341ad3b81d20b071a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768423201, "uuid": "031f9c0c-a5f1-4028-93d7-c57a4908a6ff", "value": "T1D397338AE882272AFA0BD437C16D1C4CC460BE618D95CA9F3925336774F7A0972F754E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768423201, "uuid": "fcaa3d16-0adf-4526-9078-bfe06c75768c", "value": "786432:3+MaGRpqfHVhbIO1vJvySF4iLng5qgyahz/XFizXdd24:3Z7qfX71RTATFbYBd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768423201, "uuid": "a2ca18ba-b6c2-40a3-b298-52b459336732", "value": 40677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768423201, "uuid": "72b53eca-a074-4f7f-92f8-e2842d7ba2a4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768423201, "uuid": "b960c7c3-7406-4317-8631-6e66220f5ee8", "value": "Installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fff2d7a-f0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352786, "uuid": "02555227-b9d6-44db-8739-43024580a7e7", "comment": "Malware payload (Mirai)", "value": "5e82fe5cc2ee82934fd6d32a744aa23a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352786, "uuid": "aff1c6dc-24ba-461b-a5d1-2f52b0b5d07e", "comment": "Malware payload (Mirai)", "value": "de02ba6efec83d0b921af9a0bddba252a6f1d6eca242cb48f439370d4a4a414f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352786, "uuid": "afa93a9b-bb8d-4ba0-a7c7-920138d9b744", "comment": "Malware payload (Mirai)", "value": "af4f7cec8e561f7c75190c9271f96cde509a753d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352786, "uuid": "52445673-b5b3-418c-b8b3-70fcacc615e9", "comment": "Malware payload (Mirai)", "value": "435da1278e20461f5b234e82937522b892d493dec44350474fd83a2a393bd2d57ed78f902f72b59d988dd104f5f5af99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352786, "uuid": "4dc734c2-861b-4fa0-a90d-cdeb594f5205", "value": "T1CE040905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352786, "uuid": "89fc52c6-2a81-461e-ab31-10cb1286f1e6", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2woAKFLYV0fCtZ1SD39rsJzjM9fx49SY23:t3nEr5dfHPq7UTo7FsvR9X0l6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352786, "uuid": "6da561a3-909e-4d5b-99ab-a040229c3efd", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352786, "uuid": "2af7cd26-f75e-4184-b660-42ec056aef52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352786, "uuid": "a4087448-1aa0-4008-bf7f-51ffc38d401f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf05437-f12f-11f0-a129-42010a9c0007", "comment": "Malware payload (N-W0rm)", "timestamp": 1768384509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768384509, "uuid": "283e20a8-f01c-4df3-a8d3-0cc780e2f2a2", "comment": "Malware payload (N-W0rm)", "value": "f20613bf3ee0b8561192ceb16e2a655b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768384509, "uuid": "36f5e7b4-39e6-4c89-b589-2e5174b46306", "comment": "Malware payload (N-W0rm)", "value": "dea330aa363de864d6f56d750fc1185e778971227abcfb0be0557cef78bf0c7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768384509, "uuid": "b7fba454-9089-414c-b9ad-df78e595a344", "comment": "Malware payload (N-W0rm)", "value": "1c7b07ce26e66c1a66f6c272ce6eb04c292d3801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768384509, "uuid": "56019526-ef50-4837-a4ac-a2a83228b97a", "comment": "Malware payload (N-W0rm)", "value": "ab53dc3de1e425c7932ccf8801a8d2ebda77cce3835091063a7404dedff72d6f21083a798c6183319314a323b56132be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768384509, "uuid": "898d7b7b-ad4f-4e06-949e-bd0d8d56b777", "value": "T157E612023BE88ABBC59E0775D4F206A603F2F5412763DB5F1A80AB6D2D83B915D117E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768384509, "uuid": "b13ec2bb-8704-4347-8b67-16d35a711dbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768384509, "uuid": "d77c07da-89dd-4154-ae69-d22f81852f06", "value": "393216:dEfEy2tyv2kOsdZLfjS+j/EpVfE24reOtQDBS:SfEyjOslrJelE29OC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768384509, "uuid": "876f5d34-4090-446b-9af5-d1df11b705e2", "value": 14737920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768384509, "uuid": "7cf025ab-7ee3-42fa-a38d-86126d122efe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768384509, "uuid": "d9cc359f-5a54-4020-b60e-cc48edd1a624", "value": "dea330aa363de864d6f56d750fc1185e778971227abcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da505b6-f123-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768379330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768379330, "uuid": "aa367a8d-b1a3-40cf-9269-0aea3a14325a", "comment": "Malware payload (Vidar)", "value": "7351637c5c8eba61b303eb57d405494e", "object_relation": "md5", "Tag": [ { "name": "46-62-237-55", "colour": "#20190B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768379330, "uuid": "7ee60663-0ce3-45ff-9c3b-62a223035eaa", "comment": "Malware payload (Vidar)", "value": "def28314d17108be5112dca7f1936f5ade0f88d0604ad481f1154b16af4f5f86", "object_relation": "sha256", "Tag": [ { "name": "46-62-237-55", "colour": "#20190B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768379330, "uuid": "e49a51e1-c834-4282-ae5a-6bc143fd63a9", "comment": "Malware payload (Vidar)", "value": "d150e34f305747c0e61fb5c293307a6293c7c50f", "object_relation": "sha1", "Tag": [ { "name": "46-62-237-55", "colour": "#20190B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768379330, "uuid": "c68c5f16-2119-4e03-b10a-3858c91637e4", "comment": "Malware payload (Vidar)", "value": "a0093c9d438cf9d72cbd667907f0c587b4f491df05caa5474a1837c9f663fe7dedcfae74554d00e5c7cc86cf6c00143f", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-237-55", "colour": "#20190B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768379330, "uuid": "1c0e0387-b94e-4e8f-a971-6b8f9830a6a9", "value": "T17ED65CE3EE500775C69BE2399CB2128A3230B445133514D7BBA517665D6BBC8233BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768379330, "uuid": "4255b3a8-dd9f-441c-846d-59c33955b0d8", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768379330, "uuid": "4450949b-a56b-445a-9cf2-b102577a6c01", "value": "49152:t2VDbCYz34XvJ9E9hsOu0xovlzYAuuGV7XMPAHDGcpSB02f6RoikODqYnVy6dxJR:t4cBS9hFR3HDGe2ERHPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768379330, "uuid": "c5378e4c-934e-413b-85ff-f44393e08cbd", "value": 13113472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768379330, "uuid": "1171984b-5f46-4952-95c2-812d51f91702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768379330, "uuid": "f26092cb-4ba5-421a-8388-5d6684b1f786", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8857528f-f0ff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768364074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768364074, "uuid": "28c871c9-bfea-4342-afc2-78cc93c724d4", "comment": "Malware payload (Mirai)", "value": "49eea3fbe6211b884e51ba4de0fe8a5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768364074, "uuid": "04b47f6b-9fea-4c99-8017-3322dea3dcae", "comment": "Malware payload (Mirai)", "value": "df02ff2457c637cfbcca18a65d7195ec6d94d9c5953495676f75a97e30cfb963", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768364074, "uuid": "2073b191-2732-4c18-9ac2-a0bd5db8ad43", "comment": "Malware payload (Mirai)", "value": "b3c3d3e197d9199ceb72967dcfdc102de7fba3c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768364074, "uuid": "1b3fb73f-5afa-4437-baad-7186ec25647e", "comment": "Malware payload (Mirai)", "value": "8cf7c0c03c3af88396dd699789cc3445af13039dc3956c705b0249866cd4a3f1273fbe5fe254fdc80681691b68dba1c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768364074, "uuid": "6bc6f0e5-8402-4e26-97a8-d5b061df3506", "value": "T182634B136480C0FDC496C2744B6FA226EA73F47E2175B62D27D4BE263D9EE216F1E190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768364074, "uuid": "f4468f91-8cbe-4e44-a642-aff69dd5b126", "value": "1536:mjC8BO3YmHkES8jFPFI3+BnL4+GOZsAz1Kid:uQYmo8jFPq+Bn9GOZB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768364074, "uuid": "5d48d4d3-7f45-4e1e-896f-da1c2651d2d9", "value": 68240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768364074, "uuid": "481477aa-84e7-4c57-8e98-882b3dea4226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768364074, "uuid": "be966942-61a3-43bf-b4d4-5faec9910dfe", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940744fc-f14f-11f0-a129-42010a9c0007", "comment": "Malware payload (DattoRMM)", "timestamp": 1768398453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398453, "uuid": "9cd0b250-0ad7-4df1-8488-d6d15422a7fb", "comment": "Malware payload (DattoRMM)", "value": "c616bba5e86f143efd96d3e6ace21855", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398453, "uuid": "7cf358a0-c458-488c-9775-e0053000103c", "comment": "Malware payload (DattoRMM)", "value": "df338db89665d58fa4bfabafadb76b9360b5e3840b8b35ec0d1ba5d90ea06fef", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398453, "uuid": "3c148e7f-a22d-457a-9a0a-3615525ce98c", "comment": "Malware payload (DattoRMM)", "value": "717d101ad16ee66c61e80d566c75f8fa5ebd95b3", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398453, "uuid": "9d7259cc-457a-43e5-b246-2a36f091d041", "comment": "Malware payload (DattoRMM)", "value": "6a16976a9a15b0d79bf26b57d2dcb67c36ab00691adb9bf147f09a531ec407fd2fb804d7544edc144edfba3d97eb432d", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398453, "uuid": "a295c4ad-926e-4900-9c1a-1f0b7cd71b8f", "value": "T179B63313D57BCCF0CB234678D6E10A46BB4A058A9C5AB8D4E584633E55D34ADEF38B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398453, "uuid": "61c54f13-4554-4d82-8b56-fe18fd71b49b", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398453, "uuid": "e124425e-ae09-4043-b5db-7e8776383aa7", "value": "196608:VaZk+wr0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8c:Rnr04RT9R4PkE7Ap84p29qIT0Z6rXr8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768398453, "uuid": "de7f8526-1abd-439e-b44d-20ab84b78942", "value": 11055728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768398453, "uuid": "edf4a03a-c90e-41eb-931e-f1948c96eff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398453, "uuid": "e227d6c4-78a7-4dc8-8134-29a02ff0380a", "value": "invite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a304d56a-f0f4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768359394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359394, "uuid": "a0fd2b92-f653-472e-973e-6c20b6e730ca", "comment": "Malware payload (Mirai)", "value": "362df62d033cbdc6eac866ddf9015647", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359394, "uuid": "88e1c2de-6017-4fdb-b0ec-b21a38e4d66d", "comment": "Malware payload (Mirai)", "value": "e273652f1699e68bcb27cd81dac9a01ca673834f2601fa8806c423d53227977f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359394, "uuid": "b2f74597-f33c-4e37-89db-af51ba6803e9", "comment": "Malware payload (Mirai)", "value": "f0a688167c53aedf34fadd10b51c2d7e3939d591", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768359394, "uuid": "dfc68e0c-2324-41e7-a5d2-3e75edb9886a", "comment": "Malware payload (Mirai)", "value": "99d78f7a1c6b68e86c912bacc041b8a20fb6be343008f58bffd4cc5cbec9fe2db92923dcc904e206873e986fa3cb4f86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359394, "uuid": "4363226a-2f2d-405d-9643-9382967653be", "value": "T143131B227A771F17C0D2A8F962F34628B5A1AE1F1CB4C75A7D722E8AEF105C071136B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359394, "uuid": "09352e9e-00cb-4621-9307-95ca3041b043", "value": "768:Pny9QSuoSY9a9UGG7FyLEq9R5+r1O+QE2:PnyuSuVY9a9/G5yLESR5+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768359394, "uuid": "5edd586a-583d-4be5-9615-2f3028ba3b85", "value": 41552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768359394, "uuid": "98e0e3e1-ab65-4dd9-aa7d-09dd73e85013", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768359394, "uuid": "c41ceec9-5dce-443b-ae7c-d0b5ae1184da", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d947f459-f0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352613, "uuid": "180d6665-3915-4ba8-bcc6-b23c6e80657f", "comment": "Malware payload (Mirai)", "value": "c1f4dcffc301f0373817536b5156ed82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352613, "uuid": "0ca268ac-d3de-4671-9565-dbf18515efb2", "comment": "Malware payload (Mirai)", "value": "e27487f904ff6f0d5f827d74f454a918bb64848c8b57901a626569c6102cd932", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352613, "uuid": "d7dfbfb6-a249-4c74-95e2-6e0c2b1f9413", "comment": "Malware payload (Mirai)", "value": "2e0ab7d6ba1780abc99c861b0558b7601c9e36f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352613, "uuid": "2c1725e8-fe27-420e-ae15-d88bd8584617", "comment": "Malware payload (Mirai)", "value": "409c10ea3b02b6a0dc7b3ead789d973c5e38c56fb0cb3f6a011e95c33cef9dae46183299c29013be18c5bfeda81b4c95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352613, "uuid": "4e89225d-e1a4-4ed8-8189-97b56ad2a68a", "value": "T168056D1BB2F3B4BCC017D434439BDA62A935B43902226E7B65C4D6303E6BE701B59B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352613, "uuid": "8f0b777c-9254-4c6a-9bd4-99c53a11b31c", "value": "12288:kYrmn0W+ae++4s8mD/IkmnXoex9clvJVvYl2c+1RJnbsitu+9dzuFUmJywfDYvCO:DmnR+H4smkmnYuEhVglCLbdtXaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352613, "uuid": "64c1ce44-0d61-44ff-82bf-38f9bab3ed0f", "value": 845392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352613, "uuid": "fac38a8c-2814-4800-b604-ef8db0a95f08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352613, "uuid": "31c1e3cf-b17b-4a5b-a16d-7ff4ecdbbf37", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e454e659-f16b-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768410614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410614, "uuid": "4bd405ea-4c99-42fc-97ce-f6b726db20a0", "comment": "Malware payload (SalatStealer)", "value": "617c994366c3a2e3b7891d9d9aba3956", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410614, "uuid": "abd0bc20-371f-4cb3-b603-fb702a785a38", "comment": "Malware payload (SalatStealer)", "value": "e34ac8ccb951ff080fc1f24a9395706e5d766dd0cbb498e5e1932018e2d06e1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410614, "uuid": "088f56de-f927-45d4-b4f0-e90d4ab8f504", "comment": "Malware payload (SalatStealer)", "value": "2f6be47384e40d66573c23bd92b7cb95ba7ff2ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410614, "uuid": "b2b63b54-685e-4b23-9cf8-78dca0e1bc82", "comment": "Malware payload (SalatStealer)", "value": "40a754d0f495bf300275c82e484ea528b500f010315799f368c59f7a51d88599b2de11c5e1967181e1099dcf991f9eba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410614, "uuid": "19a9caa5-dc81-4888-a294-35bbf092be62", "value": "T13CE533DB0967266BDC524FF1C7200642D429FAD54992D8CAFF7CBD1ACCE66B2E181027", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410614, "uuid": "ca32d7cb-922d-4d68-b8f2-22e104e2aa76", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410614, "uuid": "1f1652f6-d355-41c6-a2fb-984c8bbadc98", "value": "98304:9Z7vPPOFgzuY0Ou0GP1JeLFsOj97d22nQq+82j:9ZzQcuo0W5sG5n52j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768410614, "uuid": "76135a28-cd5a-4bf7-bdcc-fc8fd1c7bb50", "value": 3292160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768410614, "uuid": "eef1cbeb-6d3e-48f2-82fd-369d2aee5b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410614, "uuid": "26f604b1-1200-4293-bbe1-3d63a25bec8e", "value": "0x000e0000000241cd-6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1810e58d-f11a-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1768375482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375482, "uuid": "1792bf38-f4f6-4a50-a107-5ef1abc456b4", "comment": "Malware payload (Sliver)", "value": "63f228e9a26a1930260a855664de7307", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375482, "uuid": "0d5b9915-5994-4d66-ac3a-f1ff5b06e688", "comment": "Malware payload (Sliver)", "value": "e3d5dec266eadd53bd507d450e556aafe6707e936f45f92b6e4a25b9fd571e75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375482, "uuid": "6ba65e2d-1976-4f7c-b3c9-0d1fda59350d", "comment": "Malware payload (Sliver)", "value": "a1b1f5b65ebc8a53faf847b5843c5586edf45366", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768375482, "uuid": "099e25b4-4f76-4784-a4ad-b7ab009925c5", "comment": "Malware payload (Sliver)", "value": "9d1e6cc9e35dedc17d30906ed6fb11f29b2e74ea729a7af9501f350942c3f9f8cc03ba3ed38c03ce9e1968b99fd4dc81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375482, "uuid": "d3d4213d-80df-4878-9bb9-b348c722bb6c", "value": "T1C4774C43E8E61A94C4AAC274D12A426BB7B13C4D1B7C27DB1BA0F3701F36BD06A76751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375482, "uuid": "dc344dda-3fb6-480e-9f60-f28d15088544", "value": "196608:h0IEx3BlPX8tkhD6TAfQbjLXk72/kvtSYDMUX43p7Nk1AOJXqd:hTEx3jstUGTAd7LVrjX43r81A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768375482, "uuid": "bce7e438-76d0-4616-818a-5aa78a08af06", "value": 33611924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768375482, "uuid": "9d0b31e4-ec38-430b-a2f2-a073b0c2856e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768375482, "uuid": "82d100e3-f491-46f7-ab53-364bce10112b", "value": "update", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5507ad4c-f118-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768374725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374725, "uuid": "3817339d-189b-4456-b6ed-40a2d8aad444", "comment": "Malware payload (Mirai)", "value": "84046c131e7012fafb0fc8a41228b967", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374725, "uuid": "6aade9f2-03dc-4281-81b1-557aabd04bff", "comment": "Malware payload (Mirai)", "value": "e4cbc94d05cf68b17152711ab035bfb71e9d98e36b342ce45198d26f1d374e6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374725, "uuid": "0ae56fcd-802d-443e-9877-125e354d02b6", "comment": "Malware payload (Mirai)", "value": "ce6305cd89d1d3edf5b3bfc12043e1f026b60265", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768374725, "uuid": "6134b1f2-25e2-4f71-a1d2-3fb3888bc702", "comment": "Malware payload (Mirai)", "value": "98a5ad162378f4fea7f1ccb5ed3dc382b05356c9c673b911581e640e0a983e449a546f5a3272c1630019f10d4d2362b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374725, "uuid": "a9a002fa-faa9-45bd-8ca6-26f6c55ed3dc", "value": "T174D31855BC819B11D5C626BAFE4E528E33132BBCE3EE7202DE145F2523CA95B0F7A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374725, "uuid": "7f98cdcb-3417-47a6-8d50-2ce77d6d30f9", "value": "3072:5h6ru40d8tJLRYv3eHxPUENieRaUVak41oRoY7XyLavfFtPjH:50C/qtfYv3eRPUENietVak41oRoYDyLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768374725, "uuid": "6dddb65c-b8c6-4700-8717-7e7102d548d1", "value": 131436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768374725, "uuid": "d1bbec5f-c003-43a1-a136-cce09d71391d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768374725, "uuid": "b9691438-230d-4bdd-a31f-95026707fa7b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924452c9-f0e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768353353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768353353, "uuid": "63ded181-a873-4ab2-aff9-0449470ba8ef", "comment": "Malware payload (Mirai)", "value": "40119f3ddf51d69a18400076f534125e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768353353, "uuid": "265e0914-688b-4090-9b21-d3914239bcd0", "comment": "Malware payload (Mirai)", "value": "e594c4dca244303ec4efcd939d95cb7108104e335c3edf85d1766bd462204180", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768353353, "uuid": "8e0d6bce-21aa-466b-a509-eb470f9fc84d", "comment": "Malware payload (Mirai)", "value": "ee9c25044be010cd312fb79290826a8b00ac02a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768353353, "uuid": "427cb73b-a92c-43ef-86e4-bb5b6f913f1f", "comment": "Malware payload (Mirai)", "value": "b65d8f9ffe34859ae50046ee9df38f8e8ae8258ce439c074e23ef9fb422fe8cd545589b20ff0643868c3fb5d56845671", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768353353, "uuid": "c9bb9cf6-af4d-404f-b7c1-05653c9a98f2", "value": "T1CAE34D99F402DD7EFC0BE5BE44670E15F93093A13143172E529BFDA3AC321A61D26E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768353353, "uuid": "467621bf-0769-402e-9286-17dec38495f0", "value": "3072:RmmyBVk2SJgv+EdV0+owYl10cvjvF9JrT7vyb21:8S2SJgW+owXIvF9Fab21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768353353, "uuid": "1915fd3c-7a57-40d5-bc95-50806ffcd4c1", "value": 146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768353353, "uuid": "1563fd51-ce4c-4828-b791-2014bd7af9e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768353353, "uuid": "d4130720-364c-4d91-af3e-3af79d42d016", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8591a5-f0e1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768351037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768351037, "uuid": "bc3ed22a-abc4-4be5-8d95-50441beb1642", "comment": "Malware payload", "value": "861b6c94f988678a87d79c61129a3e83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768351037, "uuid": "1434f128-9687-422c-9e75-81744452e772", "comment": "Malware payload", "value": "e690f95e8925e0c6b57030d0e69011252fcf02e00ebe313e652b9041d615dbb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768351037, "uuid": "3a0ce36f-8014-4e55-b505-3ceaceb34f7b", "comment": "Malware payload", "value": "b89e62d71dd7cead9f959fb3cc629d0e955a7041", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768351037, "uuid": "ae180007-8d1a-4e09-ac52-b3968c1e0716", "comment": "Malware payload", "value": "acb2387f36e0860928fa6d5fb756566059b0762abd9c042b445dced16cade8eb9fc111891f26c28236370672b6e69c51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768351037, "uuid": "afb204dc-25a1-4cbd-b963-487445780550", "value": "T1B8E633D956324221D571A63863784CB3B334A1BDDB32AB4C148E57273FD3B5E2A786B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768351037, "uuid": "74ed5619-70f2-4ee6-9cf3-f91801fb6d63", "value": "393216:GwTqxvHkfxg3gTNvUMeLP5P57EzijDwpsSjdNf:GVv7Max5ZWiQuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768351037, "uuid": "7267eb0b-4b94-4a82-90c1-aa86fccde79b", "value": 14758616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768351037, "uuid": "14773c80-729b-46e9-90c5-af3b267b4613", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768351037, "uuid": "8e2cb3b1-18c6-4b88-b93f-5c28e2692130", "value": "robot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a1c773-f17a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768416948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768416948, "uuid": "5b2dfb15-e369-46c9-9791-e3117fc1b381", "comment": "Malware payload", "value": "0fe5f45d9e8e80d35487a3d5a9446298", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768416948, "uuid": "ef8082ec-eef7-42f9-bf89-3ad11cffd32b", "comment": "Malware payload", "value": "e73ce6f671cf1d3026f62da19dd9fede189bab4a84793a848abb82251afdd498", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768416948, "uuid": "8567862f-ae77-420f-b7d7-4cdb86b15049", "comment": "Malware payload", "value": "52fd99da41a7a11c25b4b35cb9d6bad7d88d1502", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768416948, "uuid": "57c9fb49-3375-4292-b1a1-d41bb14de91a", "comment": "Malware payload", "value": "d25ca386b492a701adc3aa531b10bac40060539839b3f4d712dc9e50a2b5b7e83c357ba8e3633d2df385a59e7034addb", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768416948, "uuid": "5ce7e468-7f50-48f4-84a1-7253cfe073c8", "value": "T1DCE5336963D7D04DDE2F46708B6B26014B6AFC215760587720BCB7ADEDB2B809D38F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768416948, "uuid": "3ce446a3-87d9-4808-a8ab-89a977dd6a88", "value": "49152:GsOnvkHee83+ragCl97iUKL0ebiDU85wqfjC6RRCN2iTafXki4mFwxH3fqOX7CAn:Gsuv0ee5eQxJbiI8eYvs4z4GwxHvZX7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768416948, "uuid": "dc071297-a7f8-443b-afc4-c0cb844444bf", "value": 3049472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768416948, "uuid": "1b295e6b-b645-4bdb-9fbe-ea9cd78efecc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768416948, "uuid": "9d34d186-7861-40c1-9c9f-c2fbc1dd8e22", "value": "Palanit_leak_disc.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04a61b0-f170-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768412701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768412701, "uuid": "b9d71c4f-d2ff-4da2-93e6-003caf7104d0", "comment": "Malware payload (Mirai)", "value": "79dd2ec8eaa5b12a3e130f5dff082973", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768412701, "uuid": "3c6f886e-9c97-4bc9-94b8-522212b34cc6", "comment": "Malware payload (Mirai)", "value": "e78b8307479dedb074ebb74dda5723315533ebe7c74e53a1e5e15572bfb6247a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768412701, "uuid": "5a5075a6-f59e-43c4-bea2-3d8ceb249beb", "comment": "Malware payload (Mirai)", "value": "88e1e53d4912525a22e5f1c8a6b8636263b5d5f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768412701, "uuid": "df641589-49e6-4b34-b1d1-2d27e9aa625f", "comment": "Malware payload (Mirai)", "value": "eaa20922f02260b4cc705d60f24edc357738532d18901831848b50468f004729194f72613f17dad1e62af604a9921631", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768412701, "uuid": "527db3df-405d-43b1-bb33-c15d5ec9ee0e", "value": "T1DF836CC4A683E8F5DC1602B52177FB378772F53A212AEEC7D3A86D276C59A40851728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768412701, "uuid": "aef82f62-33bb-482c-9500-2c188b2722e0", "value": "1536:hc3ekKRd8fbTk8yYSpHuOTwgA2+yt0aiNx/eqT5DP4E1IOGcsHNj8XaUsNuzw6g7:hQyYSpHuO0gA2+ytfij/eqTtVIJtwXa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768412701, "uuid": "692e7f7d-e7b2-49ac-834a-631d0b90d213", "value": 87120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768412701, "uuid": "d3c6df46-5b52-48ad-a13b-2fee28c21548", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768412701, "uuid": "6aff077b-e7d0-4272-9c08-61e96a1638f6", "value": "StormStresser.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f07d19d-f0f2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768358367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358367, "uuid": "4ea0b72e-875d-4f6c-87dc-f50a2d0a9b0e", "comment": "Malware payload (Mirai)", "value": "8b9ed90cf926115754c6b4e6db05ab37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358367, "uuid": "a0b2a380-27e0-4786-8e76-1fe99a5ad8ce", "comment": "Malware payload (Mirai)", "value": "e868327424a6b2cacc60c09e7dca335c4bb9178b723d1fb4e57b05959b1336c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358367, "uuid": "3fd452cc-4efd-4f28-8442-253b2d22f1e1", "comment": "Malware payload (Mirai)", "value": "3eb488565e707517ca0c1690c31940cbda7f9048", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358367, "uuid": "fedffb27-6ded-44db-807c-5c9a097cd708", "comment": "Malware payload (Mirai)", "value": "8766ca80465981e2a5aaf72941fa3f186d25b88a0fc4c8550e8e0ec4bf06d899439f9143d3599654dcbc6d6476024e26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358367, "uuid": "812c1221-728e-4cce-bff0-ef7bd898f73a", "value": "T17CD34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358367, "uuid": "1336e948-d08c-49d9-b313-8518927901ae", "value": "3072:1CldeCsOs9kzj2vV44qURgyPykV30Qm9Jlsb3j64:wPeCK9kzivVjqAymymbT64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768358367, "uuid": "9ee40dc4-4527-4317-81d0-ee128e944774", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768358367, "uuid": "914c8215-3bfd-4720-96e1-6df2d753ed33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358367, "uuid": "4e93602a-67b5-4eb9-8c20-d183d04f3209", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b7dc13-f0e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768352018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352018, "uuid": "9abc5caa-9bb2-454a-b170-8296636c35ee", "comment": "Malware payload (Mirai)", "value": "ff3183456b3e98ea280ea2f1f9877cd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352018, "uuid": "dc3e298b-d825-4e95-80f2-4f53e675220d", "comment": "Malware payload (Mirai)", "value": "eb64f0fea903199eadb6f2c8985a51461d8c249cece4d9c6b4c9f4bda9af4b5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352018, "uuid": "cc94a05c-af8d-43d8-894a-3491756d49d4", "comment": "Malware payload (Mirai)", "value": "92cc5d3e75b91fa619f5b430e7b70a76a4bd18b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768352018, "uuid": "4ccec9d4-deb6-46b6-a54c-169361398a69", "comment": "Malware payload (Mirai)", "value": "21433b6c1e39b847ba69fa1c74231e1b135fa08cece9faee8206c4020f1d8fdf6d79b79cb13a6ba301841c962f1e703f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352018, "uuid": "39d51401-7133-41a1-a722-8cefc6a4d45a", "value": "T1F8733A56B8819B11D5C512BAFE1E118E332307BCE3EFB3129D146F25378A56B0E3B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352018, "uuid": "ab0a19a3-b02b-4b39-b284-8b8e7cda1b61", "value": "1536:7kn9aj6cMHBSh9EoqAQ7Jj1FvIas+l/IXIHiSh9JaPhg7D5YYE:Kaj6ccBShzq7Jj1WaLLh9JaPm7Di7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768352018, "uuid": "c7333a8c-4fb1-4a23-9d90-c96152370cab", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768352018, "uuid": "e24188fd-0f1c-4a52-9107-2e1193e0d26e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768352018, "uuid": "dbd27ae5-745a-412d-b078-8c2acdd911e7", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc7fc3f-f0ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768356271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356271, "uuid": "05620fb8-0f18-48a6-82c7-604d11e3bde6", "comment": "Malware payload (Mirai)", "value": "e4ff6363a528de0a83981512cacbd307", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356271, "uuid": "0fc54b6d-a7ab-4664-a5ae-9a84f26faba7", "comment": "Malware payload (Mirai)", "value": "ec5fee242f7ffecc2bd42923efb13c9868f53b09c7f2122843d0bc805974c8c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356271, "uuid": "20aa4db4-6d09-45ed-a19e-d92d50646803", "comment": "Malware payload (Mirai)", "value": "3e372ea0e36b02a03fe3bfdf2637cc983626e04f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356271, "uuid": "711564c7-3346-4798-b8e5-c8fb418e2a82", "comment": "Malware payload (Mirai)", "value": "2e3af1fce5a911bf343b2a59887ccd89b1c9d5c4e29e77db562d25e393aa59e1ce0788e6acf5216b01bc7631f68d341a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356271, "uuid": "5228bf18-e36b-4b3c-aef2-02fa73d02d55", "value": "T1DCD36CC9E6CFD0F5EC1216713026BB365AB2ED3B0239DF47D7A8963198A3980C61675C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356271, "uuid": "52cdd1db-b62c-4cd6-8d7a-34ce6e56119d", "value": "3072:iTSykZiFrp2OID3BAWOVDoGE3tq5NvBEIo:cSvZihIDeoGEdquIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768356271, "uuid": "69a54f42-138f-43eb-b0a6-3e86d8172733", "value": 131144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768356271, "uuid": "93c0ebe4-5aee-420f-84d0-21b918a2b736", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356271, "uuid": "80fa7e1c-0d36-4655-8392-a62d643b8f10", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16a48e1-f161-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768406260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406260, "uuid": "5f9e4e59-dd70-4733-a842-fb11a3829cc8", "comment": "Malware payload (SalatStealer)", "value": "6185d0f3262a129b921d54831d605bf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406260, "uuid": "08aab8d1-8f86-40a8-a141-26dbdd81f548", "comment": "Malware payload (SalatStealer)", "value": "ec8bc1d67835c8a07d283f451cd08826fd32e6bb510fc0ffb10b713e36862ec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406260, "uuid": "c95d05f6-5acb-4138-b322-810a52969ae3", "comment": "Malware payload (SalatStealer)", "value": "9c0a5a1165873bd2d6f1763911b2d4952b85a49d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768406260, "uuid": "307a0097-9120-44f9-8408-3ca07101cbe6", "comment": "Malware payload (SalatStealer)", "value": "603b36812e44c47e574182af599edb8806ca61ee86dc1b6883073b3642449aa2b5996768ba655052f3389cbbdde2b6be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406260, "uuid": "5328675d-22fb-47c1-b46c-dfb9e7dff2ce", "value": "T170C65A51FA8B54F6E9031831415BB23F63305E048B28CBDBFB547B6EFC7768119AA249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406260, "uuid": "d2d8ea79-817c-40e7-a56b-ec11777f76fb", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406260, "uuid": "e24fd9f6-1200-45ab-afa7-3ec4425f95f1", "value": "49152:+tnxE65rrUTbfgwOfvR1lS7qsErajfNl53/OgjFBpO9N8XsZOwJvATmjy6DBtfwu:KxEWf4Zg/M8Hy+1LEj6GcTzboLkLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768406260, "uuid": "0a874143-c527-4204-824e-b13b13e84f89", "value": 11658240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768406260, "uuid": "6329cad1-af25-4772-b64b-bcd9d0686d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768406260, "uuid": "196c5d9a-bbb7-40fe-b5a7-489d8f4ff0c9", "value": "0x00070000000243b4-14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b485de23-f172-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768413540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413540, "uuid": "186e35e4-ffe4-433e-8a80-c487817c8f69", "comment": "Malware payload (AsyncRAT)", "value": "a8ecb7bdc5edf0027e83d6c3f23e0deb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413540, "uuid": "ff8d5f29-1670-4bfa-bc08-3001370026fd", "comment": "Malware payload (AsyncRAT)", "value": "f0dd907348f30d6b192af01ed332b17b28c6ad6400ae7f22cd44bc9068bf4de0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413540, "uuid": "487bfce2-eb8c-45e6-804e-bc1ec24c80ae", "comment": "Malware payload (AsyncRAT)", "value": "fd74398a585b03586718f82ac1b093984efbcc5e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768413540, "uuid": "7db4b0eb-957e-42fc-ae57-925103a036ad", "comment": "Malware payload (AsyncRAT)", "value": "8b2ca84f7ef654576674871014e5a3d4f7f6266877e223768c52b8435112c81231c339f3b6ccfa892757298342a4dbbd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413540, "uuid": "3a58e327-46c5-48e4-8729-54cc5dee92a9", "value": "T13B334D003BE8822BF2BE5F78A9F21145467EF2A33603D54E1CC451975613FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413540, "uuid": "11213e33-ea95-4adf-a531-b6384aa2ec6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413540, "uuid": "836d78f6-6ae8-4610-84e4-05c7be5d825e", "value": "1536:IuW01Twle2WELIEaEm3bXXSfuKafZjdqa:IuWgTwle2WeHm3bXzf8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768413540, "uuid": "35a5a2c4-1eda-45c1-8829-02b0e14d8512", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768413540, "uuid": "f7b32ead-e750-4461-8cc8-dd61b448b418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768413540, "uuid": "ec709977-e4a4-49d9-8d07-95cfdb0c5524", "value": "Apple.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115c72c6-f199-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768430017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768430017, "uuid": "f16d682e-14d8-4ef3-a7b8-14311c761ee9", "comment": "Malware payload", "value": "0d8877297bd4918303bc0c8e195111af", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768430017, "uuid": "6f7a242d-b25d-450a-b405-52008111003f", "comment": "Malware payload", "value": "f154fa45aab0fce2d7eaae7b733f3d59ac9cb6d3421705d7d26a1f89e5e7001f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768430017, "uuid": "497d4436-f970-409c-9c8f-1387209f358a", "comment": "Malware payload", "value": "0ed07f3daf5e44dae73ac630235fad1dd6455d1b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768430017, "uuid": "c8399a22-0fad-4577-b36b-e4c4599c9636", "comment": "Malware payload", "value": "c81494dd255d4832d0a2d38f5f08deb457e5f9e8f326f495e53cd011a5a8bb9f07f8072803211df61d0238ea163b680f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768430017, "uuid": "bb397594-f3a6-4dda-ad39-015d113f8a30", "value": "T1D586335378B9572BF37283B28A54C3A771181F07B769A507D921B38FEEB62700592F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768430017, "uuid": "8180ab3b-7afa-4e01-8bd0-e71e90bd1b84", "value": "196608:HrFGv7PvU1/5o163erAimCrq4u/Rll7YelfYsHT:LFC8sdrAuu/DFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768430017, "uuid": "174119ba-f9ef-40a0-8e7b-805c48dc2439", "value": 8073216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768430017, "uuid": "5bc40761-491b-4571-bd6e-2aa9f34598a9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768430017, "uuid": "fed30169-7265-4195-8fa5-524d02104d6f", "value": "BWEHKRPT.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738767ce-f187-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768422450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768422450, "uuid": "a9252ae4-69d8-438f-a417-b6da7fad5df8", "comment": "Malware payload (Mirai)", "value": "5221c074994ad64a6a10874838199503", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768422450, "uuid": "81b03beb-dd86-48ac-a23e-fabddaeb72e4", "comment": "Malware payload (Mirai)", "value": "f1c4ab7b35df8acc59a982c6a50985823581d8ff61bbff9a916760d454ae17e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768422450, "uuid": "c0a0abbf-a23e-4df2-9219-3370620f9df4", "comment": "Malware payload (Mirai)", "value": "2b2baf7f7cc4251bd1fdff29bdaf128e28481a87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768422450, "uuid": "832a0663-f568-479c-b98e-d09e3ae69764", "comment": "Malware payload (Mirai)", "value": "42829fab46bb03ede0c4a602d3af1f6ac1d13407c77a10dac87f99968c4b55b10bb1943e6dda794827b92660b1946338", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768422450, "uuid": "690c3837-25db-451b-8d0b-178a918ac6ed", "value": "T1CEC3AE32D8396DC4C1A45434F8B1EE711FA1A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768422450, "uuid": "c195ba16-da4e-4c00-bab7-48ee1751b89a", "value": "1536:qaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKRZwMQaX4jnOsKigXIQSUwrVr1vwe:qf5Z5Z98XdmVMJaiaX7ziGSUGfIwEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768422450, "uuid": "d459c5ce-7f69-4923-86b2-9d2f178a17f7", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768422450, "uuid": "a4340e04-00ae-4cef-acdb-0158cb5e2efb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768422450, "uuid": "ec47294b-ebc9-4780-b366-ea69d5582893", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5963d140-f110-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768371296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371296, "uuid": "59e64f20-d3a4-4c78-bc78-2bdd580a5f81", "comment": "Malware payload (Mirai)", "value": "d758528590efad5fdf509c1f26b64e96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371296, "uuid": "2c670ef3-b8ff-45d9-94eb-e86c9c097810", "comment": "Malware payload (Mirai)", "value": "f2730b8042cbe013b518d0d11ea6880fa46a73a5010fe1a6a4c7272dcb277a7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371296, "uuid": "3dba7950-026e-408b-bda9-0393004f2f22", "comment": "Malware payload (Mirai)", "value": "2c5f32d282e1498066fff6f1c1f2ae90da7b9e5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768371296, "uuid": "f6da5fc4-6e6f-4a40-a32e-a9d0aa00bf4a", "comment": "Malware payload (Mirai)", "value": "eff03f4a831f4b304eb53fd294d4e94ac42f73e18a5f1f842899bec012da7ff721b891eda321085da511a855cfd537bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371296, "uuid": "da20961e-084f-4595-9d05-b5869b08ca12", "value": "T16DA3D70AEF500EFBEC2FDD3705E91B4535CC654722A56B3A3674C928FA5A60B09E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371296, "uuid": "f3d25ffb-d9b8-4bbc-b05e-c4056c1597b8", "value": "1536:AvoY2qW2d2R+GRfI0wObYAMD/zBNfsa2UTCoiyZoiOZRxIV8ZeLnqGu9:U2qW2d2Nd4Fns6TCoiyIIqeu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768371296, "uuid": "48d24eb8-e794-46ee-8bbb-a47f1a5747d4", "value": 105448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768371296, "uuid": "7ee08877-3780-4997-9e8b-4c557174e21a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768371296, "uuid": "13ca9898-d73a-45ea-a798-d35b8a986f41", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba92846-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418115, "uuid": "6ac78c50-3d06-4607-9968-6aaf6713d535", "comment": "Malware payload (Mirai)", "value": "6c0237f9ddc2525c9a820944fe5c8b6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418115, "uuid": "e56321e0-4567-4dbc-b5e7-695058a6618a", "comment": "Malware payload (Mirai)", "value": "f46107f0f0d10e18a72166ad9c817adeea4c20403b1d05071692c4c35453fe02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418115, "uuid": "6c6d01c5-1fbe-4c33-84af-597d7ff5624c", "comment": "Malware payload (Mirai)", "value": "902376779f4c03b146304eeccb818d63e0d0e644", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418115, "uuid": "58fef38a-a9e4-47f1-b752-1ee62e714127", "comment": "Malware payload (Mirai)", "value": "97454389b7606e502db553e95cd5c027cbdee95c9dd9a16963cc65e22db1030b72b2217ba45fbf37c7e2b385807c40ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418115, "uuid": "2f16f94c-6b7e-429f-b24c-ec51e8d9ffee", "value": "T1A0043ACBF801DDBDF80BA67A4C530905B130BBB250825B377257796BEC3A0A51967F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418115, "uuid": "f251fcb6-0bab-42a8-b9fa-b20dfc2f0768", "value": "3072:f/Tl6NKFPowVQUZI9IZds4F0BcGfiP4Iyniwhtm4mwrZOyOVTjbi/LeUotY:fbkKFPDe6K4F5lynJhtm4XOyRLatY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418115, "uuid": "8bb05bdb-3b18-4257-84f4-ea260ef8d092", "value": 179616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418115, "uuid": "0af3c88a-b547-4bbf-a317-a51bf055aaaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418115, "uuid": "0c1715bb-57d3-41bd-8fa5-c134a5830bb9", "value": "rcu_gp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1e185a-f17d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768418120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418120, "uuid": "2fb6ab31-d6f6-45b3-8001-58b58df1bbc9", "comment": "Malware payload (Mirai)", "value": "9510836a0bc6160aaa4ad0f6f60ed8e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418120, "uuid": "68188eab-f5a7-44d1-87f5-4734549f8db8", "comment": "Malware payload (Mirai)", "value": "f5953c026d680521bedcb65dc73cc8ba227037ed3a2b4e6ecb7c4d7f0a78dffd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418120, "uuid": "541117fc-4165-48af-92c6-53a3164428f6", "comment": "Malware payload (Mirai)", "value": "6b046b9213a47e9ab194f5c6743d025b6f6a2d81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768418120, "uuid": "bdda03c0-d3d0-4219-8690-920d2ed26a16", "comment": "Malware payload (Mirai)", "value": "c79bc4b704211fcde66b7e810ba323ac5255c925cdcd18c0fc682f5ff43aec188aa536739f3ddc796f259aceb846a372", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418120, "uuid": "fe7abdd3-ae9d-476d-8a6a-df5a216cc03d", "value": "T16B732A12F7B8173AD0B0A5B480776A137EE95ADE0960E68FBD750D8ADD132D40B277E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418120, "uuid": "40980efb-25bc-427d-827f-a404383c2a31", "value": "1536:0VqQfqS4zAWjmZgA0ooevkED3bnzlXbnb3ZcHx7HmXacHYFpLX8FYPJRF78P:0VFy3hjmnrD3bnzlXbnb3ZWxi+hm+EP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768418120, "uuid": "b6178d4b-12e6-4c0f-be58-4eb89db43809", "value": 77060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768418120, "uuid": "0f92e8b9-585c-4d74-9d89-5810498c8ce2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768418120, "uuid": "f82cc7e8-7a60-4a1a-be34-1d8071b3a352", "value": "ksoftirqd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f464c5-f15b-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768403419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768403419, "uuid": "40a99f37-85dc-4fef-8111-0fdf83a79b3f", "comment": "Malware payload (ConnectWise)", "value": "b21b3adcb8667438641ac06ccfcc1630", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768403419, "uuid": "e9c877b5-658c-4b74-abd4-66de7a56e95b", "comment": "Malware payload (ConnectWise)", "value": "f59b2a70d53bc4319aa5efc56d9eb3b169a674a906cea9ce4a03a2ddc793731b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768403419, "uuid": "1e56e92d-e0b2-4f2a-aa98-08f1b2aa4e1a", "comment": "Malware payload (ConnectWise)", "value": "641dc5324b5053032ee2041369a3698d2c5ddd36", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768403419, "uuid": "0ce6924d-03c9-4faf-8165-134b4beb3e6a", "comment": "Malware payload (ConnectWise)", "value": "76f067f39b2e96770b875798ebb971daaaadfb6ab7f67bdab727e26c10d5a6b7a82af03c5f7f9091e112f7997562d887", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768403419, "uuid": "4b997be8-0e0a-443d-8222-ab235e2f916a", "value": "T185A6231126E89134F6B31735FE3A56F55A3ABC25DD23C12F1268B91A2A73D808D72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768403419, "uuid": "e1d9e3ba-ecc0-4a24-8ae0-74a1a83b8cbb", "value": "196608:psuCcGaDprmcYMDGsuCcGaDpPsuCcGaDpksuCcGaDp:quGvhMDZuGpuGcuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768403419, "uuid": "3b41eae9-8f07-4eec-a8e3-c21c81d10eba", "value": 10059776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768403419, "uuid": "ba2367d5-dbd4-438d-aff2-fa5bf00baa1d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768403419, "uuid": "02b556e2-066b-45ca-a662-89ac5d883399", "value": "E-invitation.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c70f48-f0ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768356389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356389, "uuid": "f9c2d7fa-4121-46a0-b731-c430de9c3401", "comment": "Malware payload (Mirai)", "value": "9e822bc6a92e5bf16542e2ea954c44f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356389, "uuid": "41b13e39-0eb7-4289-8829-bee1d43478b6", "comment": "Malware payload (Mirai)", "value": "f7d2afdec972e57c79775f06665e80ab7cdc8a1974f1d3002a89fb0f27a9bbae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356389, "uuid": "c8583419-724c-4efa-ab7d-cbfba24bcf87", "comment": "Malware payload (Mirai)", "value": "52493540485a991d7be4b662c5c56cf3607d0fa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356389, "uuid": "96cf4cb7-6e82-4808-9169-56c87c0a3b64", "comment": "Malware payload (Mirai)", "value": "74df9f7301a91e4f1fda892c7c55b72004626b3b01a1b97a1fbd5a3ae3dbd4ed2d1f2efe0cd8a74ab209ac1d1f1029bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356389, "uuid": "055e82c3-907e-42cf-809e-3d6e72b30194", "value": "T17BF3B50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356389, "uuid": "c239fa7c-41cf-4836-892b-372dd48a0ec0", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwf:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768356389, "uuid": "22c48e54-122e-4e1e-a8bc-065eaa9fd314", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768356389, "uuid": "d3145aa4-02fe-4516-9f2a-bd1b1e1bf528", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356389, "uuid": "e92a32ae-d110-4ea9-a9cf-7f6b75c8fdb4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589f5980-f0f2-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1768358410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358410, "uuid": "dfbb2a11-fad9-422f-8f51-84098defe1d5", "comment": "Malware payload (ValleyRAT)", "value": "09662d5c52d41c17b06f7a3e0e64d466", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358410, "uuid": "4d517585-7a2c-433b-9fb9-57ac4d986708", "comment": "Malware payload (ValleyRAT)", "value": "f857819e6e755ebae3f2d4907df767d16c7cdd9c3d4083dca308e1e7ad075295", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358410, "uuid": "41977163-e3cc-448e-8ec1-6d1d16e0a6f9", "comment": "Malware payload (ValleyRAT)", "value": "310ae7a31719f78c1279027ecb049ae0395444df", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768358410, "uuid": "dd1b4971-8f00-4395-9dfa-4a1b04b62126", "comment": "Malware payload (ValleyRAT)", "value": "f7c048a5dcb40ef7d833fee6b7e609412d8ad00bf81d97b0ac3ca556cfc36ecb197e9ab36d0ffdb20b1f7eae200bf8eb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358410, "uuid": "2e1d3462-f6ab-488b-9551-882a673bcfe9", "value": "T1A4C47D56E6E048FCC467C278CE975252EBF6B8190360BAEB07D199665F27BE1833D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358410, "uuid": "80027cc8-6c50-447a-b426-7525ea0cd516", "value": "1777cd715eb912cff192a24f21ba3859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358410, "uuid": "2ed576c3-90a8-4b44-a851-7bb133a7e6a4", "value": "6144:U9jfkiNc8LuAT/9MXtzR28CB1HMa69VZ4APMq1gjcOrEFQb04xGLcTRpC6D:qr3/4k5HD6VZ4AdOrkIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768358410, "uuid": "a5a41a45-979a-4dee-a515-799186a5aa54", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768358410, "uuid": "a6757348-fe34-426b-85b5-f2cae7d714b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768358410, "uuid": "8507f6d4-a93b-44f1-bb0e-40a9d14dd74d", "value": "f857819e6e755ebae3f2d4907df767d16c7cdd9c3d408.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5921cfd8-f16c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768410810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410810, "uuid": "28b43a35-210d-4f04-86ea-80e4169ba8c2", "comment": "Malware payload", "value": "f7f0ee31a5c0db17656414b0a9b4389e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410810, "uuid": "cd246e94-f803-4a6a-bfc5-7ae89432f95f", "comment": "Malware payload", "value": "f87dcded559755d3fb76f0ed3e861799294630844305128276fb1b6452ed7061", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410810, "uuid": "ded5e1c5-453e-4750-a7b2-c89d79db6bb7", "comment": "Malware payload", "value": "c93a2c2137f94698d054e94f1ffeae8abf51dac5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768410810, "uuid": "c985f695-243b-4cf8-91fd-7220a5b01e10", "comment": "Malware payload", "value": "083d24bf433075bfc791874269fe7acab39a92ad26a62eb05b6395b67d6c63f0fe368f362bca162527c4b0fd914b30e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410810, "uuid": "5b905b66-9e92-4833-9b3d-42d66501a839", "value": "T11516D3EB19BDB425CD6500115E296D4EF1E3214F894568CA7FC0A1F87BEA0D7CE2EDA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410810, "uuid": "c3f1149a-9770-4dfd-8359-5177b40f0dae", "value": "384:Ktqaqzs8BDBGex2C7MKUw/qEwOcnX7s5aWJ+UXrlQS4R2OKiLh+jgL7lr3q8Us28:kqzFBl2CYO6ziLap/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768410810, "uuid": "d984c669-b2f2-4475-a249-550b5e4c4327", "value": 4217575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768410810, "uuid": "db42baa3-a94f-4773-a17d-a0b503561316", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768410810, "uuid": "c6096d74-ce29-480f-b306-0cd3b5f33390", "value": "Form_1768322935.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c52ede5-f151-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768399299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768399299, "uuid": "9b5f4587-e6e9-4cfd-a3c6-f5b50ff300ac", "comment": "Malware payload", "value": "50c9784656794d7f57a4920ca53ba9d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768399299, "uuid": "d7d822ff-1f55-4682-9076-b8c9c7a24573", "comment": "Malware payload", "value": "f9b643684eada908f25b2a04acec3dd31b47f9e4b744c76db474d268d1e01d07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768399299, "uuid": "d97b8641-d1a9-4727-a8a4-3b3933ba02fb", "comment": "Malware payload", "value": "8657e5beb130e235cf4b53104bd9cb0322fcb54d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768399299, "uuid": "0419e408-a107-48df-877d-7743e3e3a6fb", "comment": "Malware payload", "value": "a1d1edd825c4391245249bd9d80df17a0e89356eac7fc44c54025e513d846701e427d957e46a7023b7999e91e83a6cf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768399299, "uuid": "c7b023b0-7d0b-4d1d-b244-248b24dfd9b2", "value": "T1D4A372897AC6F8B053953477A92FE49BB33F4CC1750C40C1D6A9E5A8FD28708E676938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768399299, "uuid": "c974de33-6ab8-4038-973b-cc069972cf3b", "value": "1536:5XDRdYaKSkFc/u+XInwkmpT8c4TddlpXpJosgkO0Khv65yg0c1XXPLI:5XDT0SkygiT8jnT+rsXPLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768399299, "uuid": "a2ed8927-4206-4cdd-a870-9edaaf65124b", "value": 104969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768399299, "uuid": "a2844f7d-4852-488f-8ca2-e1981239b145", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768399299, "uuid": "567e2f2c-0722-4c18-bee5-44d23494fa07", "value": "ORDER ACR-012614.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b8566f-f112-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768372235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372235, "uuid": "3ccef773-0619-4664-ad34-42ecc8443c3c", "comment": "Malware payload (Mirai)", "value": "3ce89612c159b0a848db7b04aa05c3ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372235, "uuid": "f420ba29-1379-4086-99e3-36883f9ab68e", "comment": "Malware payload (Mirai)", "value": "faf9e7d48b1746103cd349dfff5d21b22f6ec23fa10bfb41f81115036999c5d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372235, "uuid": "7ffed683-efcc-44bc-983e-1699dd87cf33", "comment": "Malware payload (Mirai)", "value": "c71cd0ef0468dab21ecd287bda83feeb1602c14f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768372235, "uuid": "eac0cad3-7f3c-4a58-bc7f-f98765329841", "comment": "Malware payload (Mirai)", "value": "31099cf5f89c29248d433b29d4ee1d3166f6f4e94951b2d87c2de89ac5907cf9d78c9ec3ec281f633aaa2ae3532f63c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372235, "uuid": "f91d0226-0cc3-4989-984f-a4e9d4cb3133", "value": "T10BB31956BC929A12C6C656BBFF0E4289731363ACE3EE7213DD295F2123C751A0E3B451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372235, "uuid": "4ae4f5ec-f016-4739-87eb-17c768964aaa", "value": "3072:a4ohNSd8dALP/GRSHT0FZ+7FMUbvblfEFhBZNK9M7B8+7O:a97SWdALP/GRSHQZ+7FtvZg69Ml17O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768372235, "uuid": "fac75bed-c584-4a4d-98d9-4a03b3fdae36", "value": 113296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768372235, "uuid": "c69b7d67-98c3-443b-8d96-859376dbbf0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768372235, "uuid": "bbce39b1-b248-46ca-84b3-e7e782f1f07d", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4add138f-f0e3-11f0-a129-42010a9c0007", "comment": "Malware payload (SMSWorm)", "timestamp": 1768351945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768351945, "uuid": "45b1f2d2-0e65-4d96-9b9c-60733e0a8bd1", "comment": "Malware payload (SMSWorm)", "value": "631434457573070ee25881cf50d1a95d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SMSWorm", "colour": "#2EA4A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768351945, "uuid": "d25d8c0e-7dbd-479e-80da-4b3c3efe0f1c", "comment": "Malware payload (SMSWorm)", "value": "fc6f822e2a6c599d395190f8da1f0e640926c79fd629493e9c855f7827fbcf49", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SMSWorm", "colour": "#2EA4A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768351945, "uuid": "d38fac64-cb8c-48f3-b0b4-53f7b2a0d1d5", "comment": "Malware payload (SMSWorm)", "value": "96a8972e66ceae35c9567e2a12f70355538bfe41", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SMSWorm", "colour": "#2EA4A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768351945, "uuid": "fd11f4a2-9323-485f-a10c-9369ab305497", "comment": "Malware payload (SMSWorm)", "value": "e0528cccebc71fcae8387af8587e89e419306942b4ba834e1287310279cbccd2374e2c6013de4edae3b162cb1c939e00", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SMSWorm", "colour": "#2EA4A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768351945, "uuid": "d89451ac-3608-425d-b1c9-cbeacc6f5d11", "value": "T11437224AF758D91FD8B39032C86A4233315B5F459952933B7A2CB3182B739C15F8ABC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768351945, "uuid": "8f6f224c-e6c9-4a97-b15d-b0fb89b3e4df", "value": "393216:J4ri8qOe+JPMHudw1VYBSogbmn7owkTT0VWG03vhBXs17G1NEXsO1k:J4riFQJP/UVYB7qmn7owwPGePXe7EKs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768351945, "uuid": "e02ad92c-cbb6-4f03-ba75-b3e71eae3e18", "value": 23139348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768351945, "uuid": "e4e4fb6b-aee7-413c-bb75-4e45dfe54091", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768351945, "uuid": "761342d7-01ec-48e7-8db8-5d42d447a1a9", "value": "Raya app_4.0_APKPure.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a2ff64-f18e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768425455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425455, "uuid": "ab0905c9-c39e-472a-964e-850c521a127e", "comment": "Malware payload (Mirai)", "value": "f5dc3ae1649a219968c081b5a2262c90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425455, "uuid": "f749f93d-5d8c-481e-9867-b55958332357", "comment": "Malware payload (Mirai)", "value": "fcef4d777f6bc95746ec39589abbf10804b085148fc502f52397151cc49a3784", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425455, "uuid": "853165fc-a917-4277-8819-261fb637b388", "comment": "Malware payload (Mirai)", "value": "7628a6ca1d910cc4928be634fbaaa477818ef9f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768425455, "uuid": "0eca3526-b7f2-41cd-bb0e-03284a92f024", "comment": "Malware payload (Mirai)", "value": "6d4de9dfdf1b89db492f9d1caed594c274cfab4e031a421d9a2d16997a6ef6b48d69bb168af082ea6d99460a3804a905", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425455, "uuid": "7798cc4e-1cdb-4422-9cf8-2d052621153d", "value": "T165C32A56E6919F11C1C32676FF9F515933039FB8D3DE7212C8286FA037874EA0E6A216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425455, "uuid": "6c499530-d691-4763-8cd3-fa8ef9bc474d", "value": "3072:Wvn+fBpXhDaQ9azK7t3lij2NxToQQ2bgjW:mqBNhDaUaMt1zNDkjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768425455, "uuid": "8a978007-588a-4537-ab76-34c91b871410", "value": 124592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768425455, "uuid": "31c0d8fb-5ac6-4a03-966a-368768085da7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768425455, "uuid": "1670d787-e886-485d-941d-4cf6762a2b13", "value": "2016Nwjarm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b45e44-f0dc-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1768348956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768348956, "uuid": "482092a6-5e58-46b5-a909-d2c3bf65617c", "comment": "Malware payload (CoinMiner)", "value": "8e5c336305b3f3dad83a9ebc554906f6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pf", "colour": "#8FD0F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768348956, "uuid": "8a5664e8-8ca4-4a4a-bd83-d97c2f3c1d20", "comment": "Malware payload (CoinMiner)", "value": "fd3550391fea1a00a68314e70e813175bc133b11bd1f6ff880ce86b446daf4d6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pf", "colour": "#8FD0F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768348956, "uuid": "19af9cfd-6593-4753-8bfd-a1b256b2da1a", "comment": "Malware payload (CoinMiner)", "value": "34f5d002f995b9f5566d940f7fb84f10036f595b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pf", "colour": "#8FD0F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768348956, "uuid": "1ada7a87-5ca6-4e03-8237-ab5298b77ed2", "comment": "Malware payload (CoinMiner)", "value": "f3f5cc3b32b60b770950b05d06c492210f447dfdb974d825390db89a367673cd043ca47ca2f7785a56ec40c7bee8bf9b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pf", "colour": "#8FD0F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768348956, "uuid": "e6934747-5453-4822-abb6-7358ccdb3ad5", "value": "T1852633827587C2B6F8E45F3F88843A85F577BE392B26D9EF18F87574280D2355A30096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768348956, "uuid": "5c0f74f8-3714-44ee-a0f4-18e5a04830e6", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768348956, "uuid": "a0552291-d530-4394-aa63-409b6e07baa5", "value": "98304:wn5tgDP9Ghg4ARziAkItEEOoDeWG6elNLm7t+go5+cDJmiC:wnH2RHkI2oDeBm7kgo5LDJmiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768348956, "uuid": "e952f612-97b7-4c2c-8082-c76230a0c9cd", "value": 4836488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768348956, "uuid": "9ed4b9d9-22f5-4aa3-bdd3-a1c4e3a7c8de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768348956, "uuid": "c1403d05-b4b7-4ac5-a8c8-2db9345f0c9f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc46de1-f0ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768356033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356033, "uuid": "c0e36855-3e36-406c-b6b4-49a6de5cc1f7", "comment": "Malware payload (Mirai)", "value": "58a8a445d82c19e6ee9fb3653ce2314a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356033, "uuid": "e2ee9912-c070-4ba6-a566-4e62a0331b5b", "comment": "Malware payload (Mirai)", "value": "fe75d377cef1bc619904f107a1686c914340532dab020a53d99de4ac68ced47a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356033, "uuid": "e5e0eb58-5601-4a6b-aca9-e456268c52c3", "comment": "Malware payload (Mirai)", "value": "8e1a63ce9a58e5e6120c7d47b559f28c5ff9e3d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768356033, "uuid": "23c4f903-5fec-45a5-beec-6083e45763b3", "comment": "Malware payload (Mirai)", "value": "06b1cf1dcd35a3f3027366035d5267d5fa3e4039b0069442f81c110b2466c07390dbd34f3ae66223b40c6fd2c781c509", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356033, "uuid": "bed4fd7b-1cac-42da-84f9-6b6e62ad0a7e", "value": "T19A03F8827D428F13C1D122B6F7AE019C3B11BB7CA1EF3352E9227F90778689B1967651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356033, "uuid": "a3170c2f-e700-4f87-b0fc-45a5ae50c0b5", "value": "768:o3nStkBjVqNvyZySCGIwOvP5jEGundqNQL2qvbV1HEaM:cnvjDOvjKd4Qbka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768356033, "uuid": "0758b90c-6480-4231-81c3-68d78d2602a4", "value": 39672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768356033, "uuid": "6c0cde07-3a2a-436b-b7c0-a3a182178129", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768356033, "uuid": "987567a8-a461-4462-8ba7-b35739b1de6d", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29e5cc0-f14f-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1768398612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398612, "uuid": "ed25b740-8f85-4cf4-91a9-13ec838e2a2a", "comment": "Malware payload (ValleyRAT)", "value": "9e7092a1e450096e19d0fa75f6de2e2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398612, "uuid": "3d5d295e-eda6-4de3-8253-22afe113777e", "comment": "Malware payload (ValleyRAT)", "value": "ffc89638df4301aedb7a018f2bec7f929abe03de04ebfe040d5a53272582e618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398612, "uuid": "690d7e44-53b1-46eb-bf35-7bf34b0b3411", "comment": "Malware payload (ValleyRAT)", "value": "94217788f1a01dd34c5303f64b905cd47a674679", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768398612, "uuid": "647ae971-621f-4066-a395-515c95788502", "comment": "Malware payload (ValleyRAT)", "value": "ceff6975a8b8f26895decb4faeba42c4f44d9b97bc12bba50fbe3a268d469e0b45af515866a81013987fd8a1b5b753b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398612, "uuid": "bf4b5bc2-cd09-4079-b2ba-48ec5c07f370", "value": "T155535C2B39D14233C492C1B594B0CB139A3F9522032199E7EB805BDEAD71AE6D53E30F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398612, "uuid": "9cc82783-26a7-4dc5-8e08-2f087d4bfd9c", "value": "05482834eabaa8536ebbfac6b783f546", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398612, "uuid": "067dbfb6-75fe-4116-b266-3406cbedcd11", "value": "384:0apO4cEYOy2NdCI30I4WISfngEAQboGi0+SE1AoN5FqNfzZJ4CeHFH5mZgalQz6e:ZispNdbb4WOG3+H5FQf/elURQzh55qti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768398612, "uuid": "d632b482-b5e0-4d77-9b39-ba2d25ad7582", "value": 65610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768398612, "uuid": "f44c0e17-4c9f-420a-8c2a-d052f55348e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768398612, "uuid": "f0c408b6-6640-4c3d-97c2-cff87c3dca6d", "value": "kernel32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }