{ "Event": { "published": true, "date": "2026-01-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-06", "timestamp": 1767744182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "aa68ceb1-2944-4713-9042-f8695b621477", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db343db4-eac9-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767681313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681313, "uuid": "a1e6a78a-ef52-4d73-8b97-412e0f12646f", "comment": "Malware payload (Formbook)", "value": "684320b339d57a44c4e7a1c1d30d6cb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681313, "uuid": "af7142a1-8c87-43e7-877c-3c30b0da6978", "comment": "Malware payload (Formbook)", "value": "003edd29ea6bb38151c2904388e2497670f560bdc9f1c9aa132210815e07972a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681313, "uuid": "1f9e5bfb-ad3a-403f-8013-970847c7bfe8", "comment": "Malware payload (Formbook)", "value": "43e0750338740c532fdea2c04422b8ebb4882583", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681313, "uuid": "28771cf2-cfac-4d1e-8674-b937894e1dbd", "comment": "Malware payload (Formbook)", "value": "9ade730ae5f19cbb9585bea86f5b463adc7df125a10f6bfbb3521c2fba5ef4cd7b90b1820c1b328ab060ec7dd5fb0afd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681313, "uuid": "449ba129-1485-4cd0-b09b-e6b8deda865d", "value": "T1E0F4E04433A9DF07E0A69BF54530D73447B86E9DA821C21B4EEAACEFB479B046D50393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681313, "uuid": "23144682-29bb-481a-b890-3f04751814a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681313, "uuid": "d0d5246c-a7c8-4d03-8f66-4f692264a704", "value": "12288:PSiuN2kx6scdN784RTm1VAtK9Avwt2yAFnv8mldW2CNykG/LXfZhzs:BrecdN7/RTGVqsZsRFv8mldyNq/DZhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681313, "uuid": "883c25d0-db65-453a-a69d-6a8e6c6bd4d8", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681313, "uuid": "9bbc21f2-53df-4d1e-a213-b0513e635db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681313, "uuid": "406f8571-4b91-45dd-8421-f514d7d95933", "value": "MT Caribbean 1 Q88.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cee986-eb15-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767713815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767713815, "uuid": "8db4ccc1-c4cf-4423-b9cd-e5d82e2f855e", "comment": "Malware payload", "value": "d60829a4b26c111770fa59c9e3b4e474", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767713815, "uuid": "fedfadfd-b415-41e4-ab9b-2730636cbfac", "comment": "Malware payload", "value": "008606478690c680ac620605fea48c673e5eb6a3baaec2af52b8e8c0aa20ab61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767713815, "uuid": "b3e63013-77da-4ed9-a3a7-3474ab7e3aa0", "comment": "Malware payload", "value": "b5b9e46727c633a1f1aa91e1427c67cfd30ef51a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767713815, "uuid": "89e0db85-fd05-4c00-9481-354becc35e39", "comment": "Malware payload", "value": "0188f6f6d3037f4df758acdcced94545fbca267393bcb99aa6c337e4a68b8e2b73a4f33cfedfeada10fc8601bd30363c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767713815, "uuid": "8453f666-5432-4238-b493-96497b9a6d57", "value": "T1BB7423CBD82129D98124B81E54ECD9E5F3E1EB67A30135DEE5AF58F484E30CB61936C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767713815, "uuid": "34a2b9b1-da46-42b9-9dfb-06f215ec510a", "value": "6144:03RvIFZkJq4fwnwZyDxxmKU09U4w3LR/ZWPFNkzPrgEIJxtM6JkglR84aq1:YvIF8fwnwykKUsk/86PrgBRJ1co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767713815, "uuid": "1b3331d8-4448-49f3-b280-bf8586acc3f9", "value": 364787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767713815, "uuid": "e2c63c84-aecf-4964-9997-97e079f94893", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767713815, "uuid": "e36dc92b-bb5f-4816-bf06-3527535db57d", "value": "bizy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9870b9d1-eae1-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767691509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691509, "uuid": "2cb19029-e754-4ffa-832d-2b253a8dc38d", "comment": "Malware payload (AsyncRAT)", "value": "f51d0f8922881aa603d5503ca8b56ebb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "schtasks", "colour": "#79E464", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691509, "uuid": "919c4ad1-d262-4bf5-9f38-0c6201019e95", "comment": "Malware payload (AsyncRAT)", "value": "01139818cc4f023f50dfa34b471e6440f097d05a767d72e7f5cf129cc1b7f3b1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "schtasks", "colour": "#79E464", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691509, "uuid": "da1d6904-845c-4f1d-aefe-3353c9c8233b", "comment": "Malware payload (AsyncRAT)", "value": "70710b60a027f78f4f36bf6a839c71cef08c97a9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "schtasks", "colour": "#79E464", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691509, "uuid": "e558a81c-a69c-4be6-8f98-559685f1e910", "comment": "Malware payload (AsyncRAT)", "value": "d7b73b1297e358265f3f30cdd2409d567d0f88cdbdc22d74dc1949e98d94edf0e65f9c789f87dc32e823722422283305", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "schtasks", "colour": "#79E464", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691509, "uuid": "614d80a4-5a23-43f1-9ac2-cf1366ebe259", "value": "T18D534A002798C965E1AE4AB4BCF3550106B1E9772102DB5E7CC415DBAB9FFC64A123FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691509, "uuid": "0716d19a-da54-4a4e-8508-a0a41a41188d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691509, "uuid": "461ce850-faa4-4fe1-a9f7-72c0424a6709", "value": "768:qVbyx3SWiPjRYin9JSP4Duw24DGXEOa8w1+jNSCv7mqb7napwH1oaclhPI85Kg80:qMSN9GxwEaDjGbbUwcXIYKtG9AhVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767691509, "uuid": "8667a949-a84d-4bb0-9a33-f03f7707c1e8", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767691509, "uuid": "e30ab977-d448-470e-aceb-631b2db83e8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691509, "uuid": "1a6263d4-653d-4a6c-9456-8fb90a882e51", "value": "StratigonEndpointPrime.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ee8671-eaa6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767665982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767665982, "uuid": "c4c2f83a-a5c8-4111-a4df-afc5c8b9d623", "comment": "Malware payload (Mirai)", "value": "429807e454baa217167c22f607133a98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767665982, "uuid": "7c02163a-7ef9-42b9-9aed-16fd34fa7e8e", "comment": "Malware payload (Mirai)", "value": "027e6f3191a718fac22772ab50577ac224e86f0cbf8fa8579cf41e63be4be338", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767665982, "uuid": "1c512eb6-9155-41da-b817-d953e59780c4", "comment": "Malware payload (Mirai)", "value": "a51b8d3862ad766d28b56329b8f8d561f37cbdb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767665982, "uuid": "75a085bb-7bfc-4e80-9297-c99928fbce00", "comment": "Malware payload (Mirai)", "value": "c299fc36bb9d935da2b61bd4f1a1046ad98b52cae19480ddae35c64307bc368d8a993b634eead560ac4e1d969d23a948", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767665982, "uuid": "f5564904-d603-42a5-a8cc-08d8236c2211", "value": "T111D47D5CFE4E3C42E2C7E2789A4E83E1732771E4D72391A37982421CD5CA9D9CBE1A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767665982, "uuid": "6da3b620-47aa-4b8e-9ebf-fa732e31ade8", "value": "12288:zHyh7DgoAT3M442Jpg+huOkEwZ8LLSkpSbGToSJ9HVBtw5kXFqm:zHiwoATRCOkEwKLLltTzZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767665982, "uuid": "37832147-a450-4d41-8030-4a4cf92dcc1b", "value": 639248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767665982, "uuid": "a40b7f63-22cf-4cb8-a7b6-4c5a09c02e17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767665982, "uuid": "0c023272-e2ec-435c-b386-f95a5e5b5dae", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac9d14e-eac9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767680963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680963, "uuid": "016234e7-b20f-4ff1-a794-1a2606603070", "comment": "Malware payload (Mirai)", "value": "c79bc17d390643359d0524a8c98f8f7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680963, "uuid": "f3d2d71c-412c-4325-a304-aa8b1790f525", "comment": "Malware payload (Mirai)", "value": "041df47a19aa70f9b120615a3cdbee36770e02b3186c5493321af28b34d6d1cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680963, "uuid": "f6be7e36-a024-4497-a2b3-c363869ee0b7", "comment": "Malware payload (Mirai)", "value": "f692c4a842c767ded80faa34344a59ca9958bcf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680963, "uuid": "260e7a8a-b3dc-4f08-821e-485566418c3e", "comment": "Malware payload (Mirai)", "value": "3aa7962ebecfb2ead66ba224e54e3c629a1c467de38d95844034eb7f3b62403b43c2fecaa299a93f1c3ec9f50ed61d80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680963, "uuid": "24ca4d05-200c-4afe-9c04-6399c9772620", "value": "T19B04B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680963, "uuid": "b21ed4b7-19b0-4683-bd35-7e5b73ccfa69", "value": "3072:HKpzG4edkSfcQq2Kv8S6Qll3IDXIWMolt:HKY4edYQq2O6ilwtMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767680963, "uuid": "75b4395f-7b41-4203-83ec-1678b0dbf428", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767680963, "uuid": "86059ee2-5288-47c5-abad-116147691272", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680963, "uuid": "715b0672-c103-4219-91c1-da324fbcf060", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9120353e-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767721132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721132, "uuid": "627c7817-d184-4466-a3a9-190a6c4b9e64", "comment": "Malware payload (Mirai)", "value": "d0e9b058c0f984e76d28db642b33dbc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721132, "uuid": "b7866039-ee63-4b7d-b60b-9d5209f3f5b3", "comment": "Malware payload (Mirai)", "value": "04adac82ae46cc872e97966aa098af0dbe01e3488572c1a6cb22c7a8eeb7e7b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721132, "uuid": "c994d3b7-843d-40b1-be9e-70c9f23abd0e", "comment": "Malware payload (Mirai)", "value": "9004867d3601cab2352ba650baef6770246cbe92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721132, "uuid": "793e7032-a464-4e3f-80f5-7267154bd4f8", "comment": "Malware payload (Mirai)", "value": "9a118e2cad74a3b75b145110d9f2157f18912c18c5ad1944cd190df42b401572ee173f44e6935f0646b2f544ac17c897", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721132, "uuid": "935ade7b-d9a1-4d74-975a-a15e0c2399fb", "value": "T13DA3D040B710EE4AC02222FCB1C50944E7B16DB60B96550B55E3F9B82EBDCD87F46EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721132, "uuid": "21e461fa-0586-4e2f-a42e-95483ce86c6c", "value": "1536:QoSBiYmvjeEXNBVSa5qgF/Btmo1/iAe27SGCh75GepUOZ1sRPIsrppKpLwgFGRw6:QFueEXNkgF/riAeZh751JYRPXrKJwuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767721132, "uuid": "f338807c-4dd5-4084-907e-ea7a97d939d4", "value": 103608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767721132, "uuid": "2c04667c-4e77-485a-91de-e388dd8622f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721132, "uuid": "a99a8f99-0d9e-4149-a3ad-b7e938640827", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12c36cf-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767721159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721159, "uuid": "700dafe9-15e6-44dd-acd7-36b876716086", "comment": "Malware payload (Mirai)", "value": "745078a768d799eb3e8113c99fa92ece", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721159, "uuid": "b3a1f5f1-0353-4cc4-934d-290ac2e8407a", "comment": "Malware payload (Mirai)", "value": "06ba744f34dab55e50f9fef119bd5198c453cac37e89a2d7bdc7ab10fee605b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721159, "uuid": "bbf6b950-cc5b-454b-8e9f-65ad3d7dda60", "comment": "Malware payload (Mirai)", "value": "ec9a10b6919d945eba95ef56609b534010eb7503", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721159, "uuid": "69971ef3-eb08-4d93-b770-5189e41577b6", "comment": "Malware payload (Mirai)", "value": "57753af03f64b1d50905d76c2cebba1fc4a2419fe003eb680763e91d5090e059ceffea160565ea26e8534e9345324e36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721159, "uuid": "4bd7643c-2153-49dc-94fa-e29fb25be5ea", "value": "T1F5143B0BB7118FA1C368D67009B3CA67D7E625921AE19986E76DDD007A7075C3C3FEA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721159, "uuid": "bab6da11-72e2-459a-869d-995bc7738282", "value": "3072:1aOz4o/JPTGBqm4MXMLyn0EUfftxpsJHwopozuM9fak:1ayJP8P4MXMLQaPpsSHNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767721159, "uuid": "9a80cff4-7ae5-4398-b503-d98a2f2c6b03", "value": 198764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767721159, "uuid": "17d5f769-a3eb-4df0-891c-2be206ccb3d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721159, "uuid": "431edcd2-07bd-47bc-8d10-f648b8a53029", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8845b76f-eb1d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767717252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717252, "uuid": "9a273b82-6373-441d-9ed0-9c40d4e52772", "comment": "Malware payload (AsyncRAT)", "value": "c10f8301f217bbfdbdcc915f27f3cd76", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717252, "uuid": "184f04db-dc7a-4a7c-8d70-4a2f36e83de0", "comment": "Malware payload (AsyncRAT)", "value": "07633175862d8e362fc8b19dad17e955528c2ffb7afd164ebaa06496ef3d3bd2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717252, "uuid": "88a8e4be-af98-4f65-ba0d-87f62c5e06a4", "comment": "Malware payload (AsyncRAT)", "value": "6a5038bdadd12ae1b5c8830a32fc75d881b45309", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717252, "uuid": "a68df315-2570-4a80-b27e-69646275f88c", "comment": "Malware payload (AsyncRAT)", "value": "fff40bff6365df308af1a42ae4c188a7b7b9a37612f23fea169abbceaabfc9b00042da22103b17c69167b7fcc4734cff", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717252, "uuid": "403304c6-cf2c-4ec7-b9bc-7eb9ddb0b8c6", "value": "T1AB536B002798C961E1AD4AF4ACF255404AB1D5372112DA5E7CC815CB9BAFFC64A237FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717252, "uuid": "a92c2ad2-9098-4e0d-aeec-bda9ffed91d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717252, "uuid": "8a597c7b-f4b6-43b5-89be-ffd7a8b9bc6b", "value": "768:FesZE8giwiPanvix9JYWwdcw9bqhAX1+VSCs7mqb2nQpwH1oDZ01rR2G8G5YVc6c:FeTivvHeZOhaXTbbXwTtGG5YVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767717252, "uuid": "31d89d9c-5b37-43b3-9571-e9f8c286edd5", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767717252, "uuid": "26727160-3cf1-4071-828b-549dbd7f32fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717252, "uuid": "fc0863bc-54a1-4490-83ba-0eb53849225a", "value": "Virexa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879fd9d5-eacb-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767682032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682032, "uuid": "68804b73-5ca8-4872-9a40-59d27c3642fb", "comment": "Malware payload (CoinMiner)", "value": "7c48613e72d167e11a002523a383bbdf", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682032, "uuid": "8fc3d0e8-7056-4c56-84ed-36ab8b84002e", "comment": "Malware payload (CoinMiner)", "value": "082b9a0ff9fb2a42d8c1200b25a4f757ee3c0f849917f4965ea02e04be6afcb1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682032, "uuid": "b3a1765a-54c8-45b2-b4ff-37ff0923aa69", "comment": "Malware payload (CoinMiner)", "value": "94b3c550788881e73d16b0f5de89222e23f8926f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682032, "uuid": "6edd2886-236c-4a16-ba17-c43886dec081", "comment": "Malware payload (CoinMiner)", "value": "6c827c98c869bb14f42e924bc3894054f491bdb9ad29deeb8812c7ee4be07eb0d0d9ccdeba2756f74f3a1f83f21dbe7c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767682032, "uuid": "616c851b-91e7-4725-b564-fcc899d8660f", "value": "T10317BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767682032, "uuid": "5a8eecfa-d345-44ff-bb09-6895d9b2b36e", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQv:cqYUQuVDt0TZEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767682032, "uuid": "444bfda5-c737-4a73-a0c6-5384471f781c", "value": 18710528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767682032, "uuid": "48d624ae-5c41-441c-934b-5c0353b1a0bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767682032, "uuid": "2390e909-e511-48ec-b4fe-a22aee73bf4e", "value": "082b9a0ff9fb2a42d8c1200b25a4f757ee3c0f849917f4965ea02e04be6afcb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b25322-eb08-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767708124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767708124, "uuid": "8bc4bf8e-c1af-46eb-aa8d-d694469a8cad", "comment": "Malware payload", "value": "2a5ca4975f1d89ae6da018e5ca30352b", "object_relation": "md5", "Tag": [ { "name": "bjtvyfqp-acouguegbcompras-com", "colour": "#3C3B4A", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767708124, "uuid": "35059183-1bb2-46f6-88f0-507d44265c18", "comment": "Malware payload", "value": "082eb3b22aaf8b8554ff52d41f7e357547250f31d8e10e797cbcc1c486cc33f6", "object_relation": "sha256", "Tag": [ { "name": "bjtvyfqp-acouguegbcompras-com", "colour": "#3C3B4A", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767708124, "uuid": "91789c25-2043-4b63-9c61-29a4efc40254", "comment": "Malware payload", "value": "0034ea657b0e53ab17c85a8b0ba6bbbf9716eecd", "object_relation": "sha1", "Tag": [ { "name": "bjtvyfqp-acouguegbcompras-com", "colour": "#3C3B4A", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767708124, "uuid": "714e0e86-9456-4dc7-a280-22ecbadb5ab6", "comment": "Malware payload", "value": "2a93aec3989e578ae2d5d77f7a67937ce95112d933e8482ce40eab586eaeddf571e158f484f6f4b325f74f9e11692659", "object_relation": "sha3-384", "Tag": [ { "name": "bjtvyfqp-acouguegbcompras-com", "colour": "#3C3B4A", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767708124, "uuid": "158b3baf-dd02-4603-b44f-0684f594bc23", "value": "T1DC31B76301EB9A98CD354BE72440CFC31E59D020C0A2B0F955AE1783A59ABD0D93D0A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767708124, "uuid": "05a74fdf-12bd-4515-9d67-971ad883fa32", "value": "24:9BMBpgortYpH4BfjDVbKgK+kazXwHy7FW2OUipIHgUp5itVccjsL3uVNdB2C/Hx:96Bm2YpH4BL5KNSM6ipKfQsruVNHTHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767708124, "uuid": "dbbc220f-be71-47b5-a2c2-8c0dcb2912d9", "value": 1533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767708124, "uuid": "6bd7798f-623b-4312-be12-075416195b07", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767708124, "uuid": "855c90db-0eb6-4cc4-a390-186434d911cf", "value": "0197c680f33c8cc-36b9-9dbd-0e01f702.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb876e5-ea98-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767660193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660193, "uuid": "8b86b7e1-4f49-482d-93f6-27ffc6ee99c8", "comment": "Malware payload (Mirai)", "value": "aff8f27c1c35965f53f9e5d05e3661b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660193, "uuid": "78aa585b-cbcd-4133-8b38-89fae96c8b4e", "comment": "Malware payload (Mirai)", "value": "0850c944fb1f8c4401a34067ba71add594fa5c22d5638c5fa6c6b746d1fb0619", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660193, "uuid": "c6a5afb9-7e15-44a8-9c00-5d899be8ec2c", "comment": "Malware payload (Mirai)", "value": "a22c7a3d10775cc33a59243186eabe8a08c34500", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660193, "uuid": "09152d9f-4e13-40c6-981d-d1893c1a04bc", "comment": "Malware payload (Mirai)", "value": "d3c62149c8df53ba5f30b16896178893d2218eeb97d1602786a6afa8c8e166668c9bcb94b95d5395f3f77bce8ce0208a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660193, "uuid": "76533eca-b849-448f-b8ef-43cbbf6205c3", "value": "T102335B8AEB83E4B1F95204702427AF13C332E525641FE6DBD3D46C71DC52A15AB173AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660193, "uuid": "6f567b86-578f-4943-b861-b31e93b30360", "value": "768:0gOJaFpDS2T/qDy3ZLpIlgiZzO9nbJD/Q5I6iXWA8DlTsv6grS61F6jIK:0rFJwLp8Z9gB/Qi6mWjRsyg+ukj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767660193, "uuid": "d4f95cd3-34a7-4393-8b00-da188e04e6bc", "value": 54412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767660193, "uuid": "6754a71d-8096-4147-99d6-8532787a905f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660193, "uuid": "74fb5c95-ebcc-451d-b3ac-7e50173e6e05", "value": "root", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950a2d2f-eac1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767677759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677759, "uuid": "5014be0e-9f5f-4422-8986-59a19a4bad1b", "comment": "Malware payload (Mirai)", "value": "8aad3c4ba50212c98a0862484aedf8bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677759, "uuid": "b467c072-efbe-4218-9cbf-e580caa981a9", "comment": "Malware payload (Mirai)", "value": "094c01ed43ebf4822dc7c7cf97c4475bcccb3b54f201569802ff32529838f469", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677759, "uuid": "d736de93-3e7a-4ca4-8e55-5e73bc301b95", "comment": "Malware payload (Mirai)", "value": "b9c6b84a6b9fde2aa021184bbae16f3708ffc959", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677759, "uuid": "80744e81-a577-49e9-a9e8-a3f4eabad1b7", "comment": "Malware payload (Mirai)", "value": "2bfd0b83f72ac1a396c114bc66fd832862fc5f8773ef0bd280e7214344f442daef63132c3be911edc873b2643857e53b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677759, "uuid": "dd71ab5e-908f-4de6-88ac-fa300b8521fa", "value": "T145E30A46F8814B12D5C111BAFE1E528E37131BB8E2DF72029D246F647B8A97F0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677759, "uuid": "353025ec-30dc-4aee-950d-e1d18ae2595a", "value": "3072:yneaYC/9Uau4JQXkDHTz9ai5oudNV0/4fLU:KevC/9NBQXeHTpaVC0/4fLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767677759, "uuid": "8641c916-16e9-458c-9a93-ee7d9374c2ec", "value": 144124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767677759, "uuid": "85fe0c1b-ace7-4070-8152-8214a0f98c86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677759, "uuid": "a0f7d754-6f75-44c1-a057-1bb33cb290f4", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab4355b-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767720987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720987, "uuid": "2edfa437-66d8-48c8-a121-363e532f2361", "comment": "Malware payload (Mirai)", "value": "daa86043cd24eaa323b9261bfa3099f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720987, "uuid": "dcff145c-8d16-447c-8015-159d55edc231", "comment": "Malware payload (Mirai)", "value": "0a9b0045fa03c700f203bed255c2b80307461d68b458df3120b3f0ceae607240", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720987, "uuid": "a03b2939-6043-41cf-bb6e-b25eba1718a6", "comment": "Malware payload (Mirai)", "value": "c09a20e82e2ad3911c493a4ac557f062d62da317", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720987, "uuid": "914799a4-8b48-4e5d-bfd3-5350104aa475", "comment": "Malware payload (Mirai)", "value": "724974e59376719316db13f18e032a4a9f080db9fc75d810afd5cfee2d86954cc7e086b5d7ae8c982cc43f0d4ea0d85b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720987, "uuid": "fd1af726-b799-45b8-bec7-2a5220c691f0", "value": "T101145B2BB3C3ACE6D11163309C312362771FCB091954EBFB9E1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720987, "uuid": "dd28f9cf-d99f-4cc3-822d-d50776d08b7a", "value": "3072:l5ZOm515ds1smDkaF1E5QH4bOSkSyMfL9vy4zNb2NCsXo7IKZ5tA:l5ZOm515ds1smDhuk4E4OCsY7IKTtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767720987, "uuid": "41aede0d-53c0-469e-a0cb-ef6e891f4210", "value": 197384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767720987, "uuid": "72ef203b-d194-4f4f-84d1-b634e9051d78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720987, "uuid": "a45f42cc-bb27-44c2-a2a6-658d521b28a5", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3487037f-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767720977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720977, "uuid": "83d911a2-71d9-415d-b651-3f34bda17685", "comment": "Malware payload (Mirai)", "value": "0e05fb14f187a1a5e6b099c102e3e138", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720977, "uuid": "5cc091c5-eb6f-4170-b83b-c14599cd710a", "comment": "Malware payload (Mirai)", "value": "0b86cfdaa2a44f58a163cef54053f0bf0423d94c837de7e7571399a17cca275d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720977, "uuid": "3ec3e577-32d8-4d2a-ad83-0c1830a78b46", "comment": "Malware payload (Mirai)", "value": "bdd7d46072d860d020c139b2be2922a6f2b60ad9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720977, "uuid": "3b754fe1-d917-4063-88b1-af37988f15af", "comment": "Malware payload (Mirai)", "value": "7714583e376eae6a8821ebcd04385adf50ed8d72c9a1ef21c754a1549fc32c3d9dcb105d7203a54e435fe6db1009b409", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720977, "uuid": "e0b3f81c-5932-487e-89a4-0dccbc3f488d", "value": "T1DFA3B087A550BEEFE0985E7FC453CE29FF20CFA05A831B25A0B9F5805E393547692D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720977, "uuid": "99338e93-b81e-4f76-8ff3-72d8b44034d6", "value": "1536:pIamHCT0JuAB4ZcxKuaafMsnHi+gXvkKjGb1pOVDF9ylvb8rSF:pIaaxJuo4ZAKzAHi7kK5DFsUSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767720977, "uuid": "7cc1ca54-8fba-4e5d-9142-9e813b4fa649", "value": 106936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767720977, "uuid": "9899e894-e777-4d63-8819-3fd3011bdfc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720977, "uuid": "36320e6b-e88e-40f8-8568-e357fdcf8552", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b07402d-ea96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767659059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659059, "uuid": "80716937-b4d4-45f2-81c0-8064c37ac2c8", "comment": "Malware payload (Mirai)", "value": "337740a9f3901536f92d4b2b15cacd91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659059, "uuid": "94c897af-accc-4635-9bee-6158a3cc5f3d", "comment": "Malware payload (Mirai)", "value": "0c48f0371708c2208ef58b46bb767a3838c9acd7085ee4a85e554dbf39faa066", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659059, "uuid": "a3ccbf5b-9d6e-45c1-9cec-ce97854fb573", "comment": "Malware payload (Mirai)", "value": "66db9f2d13c268435075115446a6b0599c95d495", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659059, "uuid": "654f48f2-af47-4576-b070-f6fb16fda1b8", "comment": "Malware payload (Mirai)", "value": "7ded1315c24e53c822e4ce68ce8ecb586962af7492b0a78170e7ef2b3a2c3812add7cad73d91c1360c9004f8aee654ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659059, "uuid": "fee45a41-220f-4b71-9da2-68b26d912fa2", "value": "T13C43F945B8918B25C5D412BEFA2E118D3323677CE3DFB212DD105F15778A92B0E7BA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659059, "uuid": "7b76fc46-59fe-4099-b162-587c8d2d4a47", "value": "1536:ktnqGoEOelqgAUWbtscRqgsKDPD0IZi1NL9/xKuD:WFl9atPRqLK2NL9/xKuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767659059, "uuid": "112f5ed6-afa9-4305-87a9-de4938288200", "value": 59988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767659059, "uuid": "34f9e6f6-b4d2-4188-a35e-bba6f608b275", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659059, "uuid": "e97e287b-e88a-4ba0-a542-9f9ddb611695", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18856e63-ea9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767660800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660800, "uuid": "d22d2cfd-03fc-4be3-9094-34825ea1bfc5", "comment": "Malware payload (Mirai)", "value": "db5e0dabf924da3ebca5a42da7e46fbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660800, "uuid": "63b0d3cf-57d4-4f9a-853d-8e1863095fd3", "comment": "Malware payload (Mirai)", "value": "0c4b53a4369188aee970da536c2b7ac65edf9019f40b14cfeb5be411c6f3b7fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660800, "uuid": "7f723529-16d6-4095-b0b4-55ecf0283422", "comment": "Malware payload (Mirai)", "value": "c414b67f62d86cd98d6b3510bf2d5dee4888a9ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660800, "uuid": "8460c192-f072-4dce-b324-d9da2b8b63aa", "comment": "Malware payload (Mirai)", "value": "6882af6ae63a925952bd1b39ff047e42f5bb9d4c1920fdada300273d7f27eb44c3bc69fa478d9299656c4bc583c77ada", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660800, "uuid": "cff23065-b0f9-4e5a-bdd4-51d387183c43", "value": "T10C53C60A6F258FACF76C873647B38E219798339627E1D645E15CEA011E7030E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660800, "uuid": "239cc677-0a37-420b-8630-2dca7cd76388", "value": "1536:SK5pHZW+XvJIjKh7/sBXC1FqRF7z14hCarAvrWxvrrObhXdey3fFuJ9:jHZHXv+jYwXCA7z14hChNlPFuJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767660800, "uuid": "673c9388-cfe5-46a7-9dd8-c2bdeb1e6ef3", "value": 63536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767660800, "uuid": "4cb31cf2-7c2b-45ba-8c87-40223745f477", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660800, "uuid": "ba2fad11-b5d0-4cdc-a57f-40e1239c8f39", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4414baba-eae8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767694374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767694374, "uuid": "11d8c56f-eb19-407f-aa64-f7102fd943e6", "comment": "Malware payload", "value": "bf571c2fcf47b5e04cf9db8c7f83856a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767694374, "uuid": "7c9dd7c0-7802-474e-8c27-b062962e4d39", "comment": "Malware payload", "value": "0ca95455c68c8b5009bd903947067daa22aea6e1239ff9b2475ca6158a41b5df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767694374, "uuid": "4ce86c39-bf21-4a76-8799-695bd26c1f4a", "comment": "Malware payload", "value": "69389bfe3355f767e5cbae68141864a231f39979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767694374, "uuid": "78af2c2b-2936-4b14-9746-cfc019467094", "comment": "Malware payload", "value": "3b81bbadbe5131db8992764a7e602b017593d6b81fe3696a074d5995b367e655d9b443b2f89e78e2fcd5490f72963619", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767694374, "uuid": "bd9d7ac8-15f7-4623-8098-39bc3b1968fb", "value": "T139F6332591543F9AD4BACD3C8931E23DBDB23C521F80C29B6A78B6523D736A75832F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767694374, "uuid": "ff2f0b84-f7c9-4166-b092-c2c4d328aa4c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767694374, "uuid": "7a3427e1-5a27-43b6-8518-49f810033e69", "value": "393216:OFImoUS4t3GH6YkIbZ1DfDgHc68yh+rbbQnTyqaa:gDBGHfBrb08trvQTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767694374, "uuid": "6a2b9520-c856-4060-9504-52ce6d138db6", "value": 15559197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767694374, "uuid": "88c3690a-3997-4001-9cb4-ad91c7930355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767694374, "uuid": "bc9a2dd3-1f78-44fd-a88a-75ca690670f1", "value": "Discord.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf269ac7-ead0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767684272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684272, "uuid": "fd623630-d035-4673-bfa9-a313cd4010cd", "comment": "Malware payload", "value": "cb0597fe1a5c80ae0c38a7f9af885f02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684272, "uuid": "7ba5a751-0a1f-490f-82a8-a1dbb97c6be6", "comment": "Malware payload", "value": "0d4d9c48004d1ba7495a085a33c906ec54397b8e28654a143b392b6ce416aa22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684272, "uuid": "958c2111-5612-4c5b-befb-d87faa3e58cd", "comment": "Malware payload", "value": "09cbae8709f79fd9f66a15a47bc22734e2c4f48e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684272, "uuid": "2f643c94-3c5c-4218-a717-f8d612759d56", "comment": "Malware payload", "value": "e7cbe28c82e9c841c57f7f09e8943b527a72857acfb3e8e4bca9309fda6ca76c1494ca5d56b5cb1145264f210be12ae8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684272, "uuid": "c92a2ced-b32a-440d-aa77-196b72730fa8", "value": "T1943423FFDE018951D3E03C32442A38DDD2DA69A709B42C0BBCDD5EA5EA97535BE06312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684272, "uuid": "5828d44a-dec5-4a0f-a3cb-70a5f8dcd0d3", "value": "3072:MoXYcB/6/HqUu+gRmtep+XidFCRufTEfsa+tyaLajD98oZG8eRvZhiVitaAK4yMy:B/UBg8kYXibTBtyauDWo7VLALbEIq0qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767684272, "uuid": "452c344f-35c4-4ed7-8919-024702a3b9e2", "value": 248195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767684272, "uuid": "334f7d73-6a39-4ea6-9ad0-2398ce204756", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684272, "uuid": "e78102e4-f145-4fd0-80c7-8d10d5c92e48", "value": "bizy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbb1410-ead5-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1767686226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686226, "uuid": "d3557a15-7b57-4145-b046-563f141f98bb", "comment": "Malware payload (AgentTesla)", "value": "b81858b5054e2e7ff351be1123ec1913", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686226, "uuid": "7379dd63-a167-4424-84a2-78c2a7753a46", "comment": "Malware payload (AgentTesla)", "value": "0d63429062d086b729682e06a4a0ab1913cb45a79ccd2776691ad21cfe22d241", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686226, "uuid": "56235fb7-21b3-4a34-8e80-38d5df450ff8", "comment": "Malware payload (AgentTesla)", "value": "faaf1850303decb117352fc50adecfbdd4a1e054", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686226, "uuid": "da2efc54-840f-42fe-bdbb-daad85b9ac41", "comment": "Malware payload (AgentTesla)", "value": "830931ec8e94d3d57754df25abe747602d9fcb1a325d94e090752e92208817052696e1cb60f5bd5fb46db1b1b1909929", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686226, "uuid": "8ca75f5a-c68e-43aa-bcf8-1c9ec4564be7", "value": "T128F4F1043399DE02D1A69BF80970D77457B82E99F821E3078EEABCDF7539B016A50793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686226, "uuid": "2e2e16bf-36e6-4fa3-8f5c-4cdd94eef8ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686226, "uuid": "de7a624e-dbf7-4f00-ae4a-9eaeb30c80da", "value": "12288:i7Ez4Czegsea49i3b9im3DcI18BSDPUWhIleAnIe7WuN2kx:Njpqmi3bUEYk8ADPUQstQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767686226, "uuid": "44b92c01-fded-4f8b-b2cc-1e288994b3ea", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767686226, "uuid": "e9f99eb7-91e1-417e-b3d3-6c34657c047b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686226, "uuid": "5f7ca5e9-88e9-4127-b3cc-0e74d38252db", "value": "Dekont___________________________________________________________________________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b943678-ead4-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1767685904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685904, "uuid": "036bfdeb-c9fc-4add-99dc-09f49be04cb2", "comment": "Malware payload (VIPKeylogger)", "value": "6a6ec3a6756ed7e3bcc8c05cd9c6dc54", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685904, "uuid": "ec6717e0-89f1-460c-8b25-a288d0d2fd57", "comment": "Malware payload (VIPKeylogger)", "value": "0e022e4bd32da69349111b651d97fe588f32a1abc043bb7ba9131f2861ae1975", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685904, "uuid": "17ec425b-38d0-4393-9001-e885426b929a", "comment": "Malware payload (VIPKeylogger)", "value": "10868cf757b1a729fb067f59385c3d6e7f4e975b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685904, "uuid": "2ef676de-7a38-405c-a6a3-cc6f5f92cd00", "comment": "Malware payload (VIPKeylogger)", "value": "fba72345ad579baa651b6fcf75acf90a593c06f27adffe0e5a29799bab9063f57e3f4a5f7fa75ef719f33c890e89163d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685904, "uuid": "8cf63947-c15f-4ddd-ad31-e46da683631a", "value": "T193E41735C1DDD1C5E9275B28375F188F6A91EABA96F82D544AEE0043A081C0F3EA5DFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685904, "uuid": "ba00a650-e4d5-40fe-8198-fa38ae438b9d", "value": "192:Q0UFfSLBZXxcCOSvHUy69H1VmuHpdRXZ+/F4tAjmfBTaNq8:73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767685904, "uuid": "2bc1780c-b5a0-42ed-8c66-8cbd5ab0a4f9", "value": 695346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767685904, "uuid": "a56e7ac9-3829-4781-a1c5-cef0a386647d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685904, "uuid": "c78a6f4f-be8d-472f-af88-2f2f56ad2408", "value": "NEW ORDER_2026-0039374_IMG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e086bc89-eaa5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767665860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767665860, "uuid": "64fb0d16-1960-45a4-aabb-74af16c2e2a9", "comment": "Malware payload (Mirai)", "value": "17985bcbee7b989ff51cd23d71394c05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767665860, "uuid": "a60c8810-6ce2-4d98-84ce-3b7cc5a70298", "comment": "Malware payload (Mirai)", "value": "0ea3c2371ce328de5395578d5ea9a35ead75af26e13428053d4c4b2339e5de19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767665860, "uuid": "cd882f3b-8599-4a68-9c47-590e2a38c57c", "comment": "Malware payload (Mirai)", "value": "5a6ad9e024e4a3385ca9ae40cb48d1e23d536171", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767665860, "uuid": "4ba5f5a7-9a47-411e-9a9c-e07482496f58", "comment": "Malware payload (Mirai)", "value": "c003b4bb6cd4b772ceadc4dc06217af73805148c1ce317fd54c298dfdb9b3247dbc5292761e8fd301df76a54ccc47185", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767665860, "uuid": "746daea7-19ab-46b2-8eaa-d4d3000eb674", "value": "T17B233A21BE7A6C2BC5C4643A51E38231B5B6434A21B8CB3A7D320E9CFF54554234BA7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767665860, "uuid": "573f9056-67a3-4c32-801e-b5b013890d89", "value": "768:PWZeb/+DiHKVp7Ix1+DQP9hMORO+woWxbebch+J:+ZebZKVp7IxHnMOh6bebchG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767665860, "uuid": "e8ae2943-0c0c-4cbc-b52c-19c121fe97e1", "value": 50040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767665860, "uuid": "49cc8680-9d2a-4411-95b2-faa8f4629b36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767665860, "uuid": "3c920995-b593-49b8-9a6f-89259385529f", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa5c548-eb44-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767733845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767733845, "uuid": "5c1732fb-8548-4b22-bd16-7c0d5ddd405c", "comment": "Malware payload", "value": "ca0f01467d443eb143a1770d2eba1c69", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767733845, "uuid": "e2ebb52d-1b6d-433d-aace-fe6e77e50c74", "comment": "Malware payload", "value": "10df4b91c72169e68da56cde6755bc0642fba46ec5fefdb14a6d2baf8493c7ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767733845, "uuid": "4804c198-1a99-496c-99ec-825da2a39258", "comment": "Malware payload", "value": "9c704067ce765fed658b49333fc8f56661361136", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767733845, "uuid": "cc458b8a-c923-4c05-ad9f-737ad2d765b7", "comment": "Malware payload", "value": "a0a44dc682a7ccf131079de0028511ac2181d30ba644b64b41eeac0ccd9dc77372726adff6539af41e5a836d59e7ceb5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767733845, "uuid": "253ca7f8-2645-45f9-bf4b-1bdfdcd28aae", "value": "T1E41612401434E4D8E6539246DE27BBBDCEFF10CE28556DBD34D2A2B8F63603509B0B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767733845, "uuid": "7fe3a606-bc09-4de6-8e5a-f0bce0dce14b", "value": "192:7JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ8:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767733845, "uuid": "af253005-6ca0-4700-a0f6-e289afafb34b", "value": 4214880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767733845, "uuid": "035fd998-943f-4bf3-b372-8680ed1bea36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767733845, "uuid": "ed29c8e3-2b2b-4b5e-95a9-7df1f1b24665", "value": "tcfsdswwaas.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d53bb40-eae8-11f0-a129-42010a9c0007", "comment": "Malware payload (SparkRAT)", "timestamp": 1767694363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767694363, "uuid": "42c4ea80-743e-4c80-a20e-891035246734", "comment": "Malware payload (SparkRAT)", "value": "d2c59a00cbc22fd4f07043138814fbe2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767694363, "uuid": "255fe2ca-c449-497a-9534-51887b3fdc45", "comment": "Malware payload (SparkRAT)", "value": "10fca076384a292f5e79bb6b92dbaefbf63ad025d5dae392007a993fb5391fca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767694363, "uuid": "00b57693-2cf4-427a-abfd-b31fc86b69f4", "comment": "Malware payload (SparkRAT)", "value": "ddffe70af3cce3bfc3f6222e1dabe4a9c8b68511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767694363, "uuid": "39480a44-8e94-480e-a913-4bfd3853a1a7", "comment": "Malware payload (SparkRAT)", "value": "2ff28110cb33123cd0f66e182a208843e07c780c786f7227c1b90e10b3944207202914441655cb1a8959da24871c1085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767694363, "uuid": "dacaf4ac-993d-4f17-995c-6949f99cbce4", "value": "T1FEA63907FD6549E9C0A9D2308A669223BBB17C484B2127D72F60F7282F77BD06E79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767694363, "uuid": "c269f286-b477-40a6-bad8-e71dc6e2e110", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767694363, "uuid": "d4b2074a-3a63-4f18-a7ae-a210651f05c1", "value": "98304:fPV139MtQcWu7ZKU9LR6lgyOxR/NYwyMLE2z:fDtiQcZ7ZKc6lgyO/NyMY2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767694363, "uuid": "cb459371-77c5-4c7d-a2c5-c54438c677b1", "value": 9991168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767694363, "uuid": "58cacdf6-4440-4674-925a-ae6cf16d5d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767694363, "uuid": "7b52ca17-1f6e-43fb-b656-1750d1e9405f", "value": "Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efea054-ea97-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767659549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659549, "uuid": "51fdc70a-6b4d-4990-afe4-b18505519825", "comment": "Malware payload (Mirai)", "value": "052642f0467f3813a5e0d4d60daa4a80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659549, "uuid": "5915d08e-06fa-4786-9047-ea8d2d30aedb", "comment": "Malware payload (Mirai)", "value": "13416fe8f226cd713e3fe8054bc380a21be086631e0b606627a2cac21cca7a80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659549, "uuid": "bd26ad32-9208-415e-ba6e-dfec11eb5b84", "comment": "Malware payload (Mirai)", "value": "eafa7e3652d763b02602c612ab07b14bda310e75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659549, "uuid": "dcbc5739-e56d-4391-b3c6-97eca7b11a7c", "comment": "Malware payload (Mirai)", "value": "4790ca19c36282460ffae2c7236175812646bdb3ae1c7d558b25df072360420fc2fa59fb5676df9151400e5a262bc606", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659549, "uuid": "d8122e10-d09e-41ce-86fb-3405074c0749", "value": "T165C44B55F8809F62CAC52976F79D829C73134B79C3EB720699144B383BDB86B0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659549, "uuid": "1874a8ec-7e45-4622-b46c-8d5bc6eeb4d6", "value": "12288:wQDgYR3yS0XX8++zcUFlRVT6ItxXgpZ6mpaXeI:BR3O87F9TjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767659549, "uuid": "0dacb6ba-1a78-4f31-8aa3-719227dc6e26", "value": 566104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767659549, "uuid": "a2aae5be-f6bc-46da-ac2c-f01275826672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659549, "uuid": "3154a68d-3cdc-4c10-8049-035111c7be7e", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd88cb3-ea94-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767658558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767658558, "uuid": "4715951f-b3d7-4b6e-aa3a-12caee21b827", "comment": "Malware payload (CoinMiner)", "value": "143d71bad028df5b3d95291f36bbf905", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767658558, "uuid": "2191707a-a7dc-44d0-8f61-7a4ec2f945c1", "comment": "Malware payload (CoinMiner)", "value": "147374b22125beeb88fa867d914d1b31d8747e1ecae91cbd6e7b9b84e94dc640", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767658558, "uuid": "31e38827-af93-4770-a977-bbb28be792c4", "comment": "Malware payload (CoinMiner)", "value": "ba97e4ba100be95c278f32df63c7fa4e15198b18", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767658558, "uuid": "a12a361d-adec-42ac-9927-52fc1a188a6f", "comment": "Malware payload (CoinMiner)", "value": "52484aadd5499f1ff738d7d7ba7a6c61f680bfc0600c048ea9939fe9e095a0b6ddc3f6ff0b79e99eb7e3ba22f861dd32", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767658558, "uuid": "c755fd6f-927e-4f5d-a66f-f0fa36db6429", "value": "T170F533369C7E3AECFA407927911852528969F913BC0F86F6DC54688FEA3BA774342305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767658558, "uuid": "b7d50411-a8b9-49cd-bb5c-2788714948f8", "value": "49152:wRnjM7f82/g+C7GDKhbz5YxqgEDSKYC9oKv/T+EBU3pTJD89ACqc2uffh:cGf8Gv2hZV+89oCnBYTJw9p2uffh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767658558, "uuid": "68ab3700-ee2a-4cd7-8c73-295156bc21c1", "value": 3404364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767658558, "uuid": "7848cf47-09dc-447f-8142-afa8d83e3a24", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767658558, "uuid": "c7c5c9d2-120f-4c6c-8592-fb0877459f97", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a24147b-eaca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767681445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681445, "uuid": "dbc1ffc1-6c5b-4ed4-94a2-4d3b0484ac4a", "comment": "Malware payload (Mirai)", "value": "7cda8d1247960a7a9d36b36571c8edad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681445, "uuid": "71985c00-c5f8-4a68-8c5a-ccc9c1c4d65b", "comment": "Malware payload (Mirai)", "value": "16938e782dcfccc61f70bad4dddc8ae0531059d5f339ab28375c19309416d350", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681445, "uuid": "3b394990-bae7-45cb-8aef-09a969ea0496", "comment": "Malware payload (Mirai)", "value": "b16256562e5fada49edf78dd479b7084ae01e501", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681445, "uuid": "e0c5471f-b29b-42ac-818b-b9498563f18d", "comment": "Malware payload (Mirai)", "value": "284eeaebfb3d67d6662c73eec0b7d5fadd9b66ca2001f9ee17665f6180fb5dd85de3aa5b6661485e1dcb434548c3145c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681445, "uuid": "875dc6f6-29e1-4823-8226-ae88c1a1736a", "value": "T1FD431891BC819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681445, "uuid": "a4c2756a-344f-47e7-be8b-4375d3ced3b1", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681445, "uuid": "f37c45ed-d2b1-40b1-b570-063660edd1ac", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681445, "uuid": "90213327-622c-4209-9809-1b74d00c6d22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681445, "uuid": "0e12b67f-56ba-45b0-8e7f-b540fad8227e", "value": "8204be1119875b1c8ec9b145d9fcbe0fe0c5439fbe8a0b5d061a367da37b67d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387a8b68-ea9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767661283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767661283, "uuid": "38a2f975-c419-4767-a97a-26aab21e244b", "comment": "Malware payload (Mirai)", "value": "e855cee51b5948eb729ef69673f40d8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767661283, "uuid": "91b05878-7a23-4c9b-9928-6566974328c0", "comment": "Malware payload (Mirai)", "value": "17b969159b26210ae95bebcd4a632651e7596fe314b0deaea6306e035c0545c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767661283, "uuid": "0cf82e05-15ca-4993-a391-bb0e4fc53f9a", "comment": "Malware payload (Mirai)", "value": "dbd7dd931e7449b8dbe5287005c8784eb986ff3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767661283, "uuid": "b7dd3cc8-f3b1-45d3-987a-13d47377e0ba", "comment": "Malware payload (Mirai)", "value": "8b37b189a549126078fc4fb8afba18684332a9ad9ef3f3302c7a3a68352226f63f3e0e340d15e9617d0c3101c1fbb164", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767661283, "uuid": "537d7d3d-0584-40cb-8767-6acfcaa01539", "value": "T1ED635B21B97D2D1BC4C4A47A11E74334F1F21B4B36A8CA6E7D720E4EFF606542117AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767661283, "uuid": "229f7186-63e3-4f6d-b529-786096e45d12", "value": "1536:BMWSgJZB8g9+5wbeZewSla92Rhi55g20M+jhTSmEebch/:WHID9dqTCMi2GSmEebG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767661283, "uuid": "fc08cb6a-ce89-40e2-8279-daa4f24bd8e7", "value": 68968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767661283, "uuid": "f6dfe14e-90fc-44dd-8649-310488815686", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767661283, "uuid": "d062fc7e-0278-409e-9b4a-6f9f7b938b8e", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b989ef-eac1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767677761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677761, "uuid": "53f6c334-d3fe-4347-9ddf-1cd07d9f4e54", "comment": "Malware payload (Mirai)", "value": "6aed289bc2ab69f4802d33fc7a553303", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677761, "uuid": "f48fedef-fc08-42c1-b9b8-a8bfb4f9f3ef", "comment": "Malware payload (Mirai)", "value": "1843a15a9af1ed09a4b2f5482b64f6b1f0ba69af237fec4f849d803290503694", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677761, "uuid": "c008d6e9-6c33-4bed-8cdd-7d3bcc1028f1", "comment": "Malware payload (Mirai)", "value": "ef8c0d3572bdac3792a543c279303ba1306885dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677761, "uuid": "8e089772-9c76-4de5-a6b6-b0b594c998fd", "comment": "Malware payload (Mirai)", "value": "85b274c1c3f5bb0307e501acd97275084124b09f02dc08e564ad5a1b2dfae313df8d5d78509129fea2b2575aab5164d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677761, "uuid": "5aed8c0e-1fa7-46a8-a670-2a36a9d53bf1", "value": "T1F6937CC0F683C4F2E84705B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677761, "uuid": "7c4a8fb3-51e5-4a74-b976-18d083b134f4", "value": "1536:W/QCZaxGdvts3i5JPhofsxPu++4HRsUIKqI4FrS4LSl:WYCZa8dvm3oJPhisxP5lR+KfUmDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767677761, "uuid": "3a73e81f-c9d6-4386-bfe4-30dfdad8c332", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767677761, "uuid": "d5f5f612-26b0-40e5-a0eb-b152b00eb841", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677761, "uuid": "c6bd2bd8-e3d9-4dff-ab29-466433838caa", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc18987-ea97-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767659551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659551, "uuid": "5a5ffc4b-417f-4f1c-88e1-7c3a8c4a3aa2", "comment": "Malware payload (Mirai)", "value": "16a99a273c138e76b431efe493527bbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659551, "uuid": "34816f56-c110-4c23-9764-b34d20550d73", "comment": "Malware payload (Mirai)", "value": "193bc938c8ca7840c8ce786c10c07ee30c0f881fa4b4803aa70e4f9c5eee5ffb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659551, "uuid": "0dada6a0-5c97-4fff-b554-8888ae265541", "comment": "Malware payload (Mirai)", "value": "d74195f0a2a6a8f6e62153312981083ef191b8fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659551, "uuid": "efb8cf9a-c680-4ac1-a359-ce65cc25aff7", "comment": "Malware payload (Mirai)", "value": "13b6f04d9953d96d63b492dc01a32317501b1a7907c9424c1432b54c78542b8036ad7707b1ce9a539753a4b5dc43652d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659551, "uuid": "2659b91c-4f45-439a-87ba-350d76a3b3b9", "value": "T1F753F945BC81D627C6D462BBFA5E41CC332623A8D2EF7207DD11AF15778A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659551, "uuid": "15df7e65-5175-43a7-aeee-78402a490f7c", "value": "768:otPIu/akza5o9prI4XfME6tOyWhSvS4fKdx45imXOuNmd8H+68up7R:WAuCkRfMFtbuSvS4YxcimXODlup7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767659551, "uuid": "dd3a5a2a-95ab-403e-b875-e0c2bcf89928", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767659551, "uuid": "cfcf5491-7343-4ab6-a05b-d90f07d22d1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659551, "uuid": "b33637c2-6d07-467d-b15f-62883d90d923", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f591e2-eaa2-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767664493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767664493, "uuid": "6eb0bf43-c4e1-424c-a0e7-44d64c49404b", "comment": "Malware payload (AsyncRAT)", "value": "a042f1ee652115e63e5b389f7c4b2b38", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767664493, "uuid": "89312108-0057-4dde-8beb-34502e170fcf", "comment": "Malware payload (AsyncRAT)", "value": "196a2ff1ea16a4f2e63f41a833735477d84800e648ea6412b813b6775fa8334a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767664493, "uuid": "0e14bcfc-3274-4ed8-ba4c-13c50f322973", "comment": "Malware payload (AsyncRAT)", "value": "732cd1bb1943daf0b0c2edcd8ad1abb3928c9f06", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767664493, "uuid": "000df010-b0c4-4c7c-9132-bf34803714a6", "comment": "Malware payload (AsyncRAT)", "value": "233b8941b3fa96eff241bd044dbf785be32c6b5c40e7c35cffbec5d620531ee8d09b3be6c18caf59629428146dfddd03", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767664493, "uuid": "0d72bde3-1ce4-4f04-983d-d23982de1dff", "value": "T116534A002798C965E5AE4AF8BDF2550006B2E5771116DB5E7CC404CBAB9EFCA4A123FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767664493, "uuid": "3da6f7ca-b747-49b3-86a8-7a1b320d4a3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767664493, "uuid": "49e330bd-5154-4268-824c-300971fecf9a", "value": "768:AmnL0mnDH35TiPdZqiN9JGfXVEbtrs/Dd++1+OASCv7mqb3napwH1oXeUR1zkF89:Amnn75wzXbsPGbbgw2eIgqGHxdVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767664493, "uuid": "5b19aa79-1eba-4a2b-adf8-07448d967a72", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767664493, "uuid": "adcce246-fdb6-4ee0-98c2-db29035f7e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767664493, "uuid": "57c3e541-cf3e-46e3-a967-20da74e221b8", "value": "AtlasEndpointPrime.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9045f498-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767721131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721131, "uuid": "4d59a7ce-63c0-48b8-b313-c3f664b3d613", "comment": "Malware payload (Mirai)", "value": "5b9458a272719a5f14f373f149a95bba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721131, "uuid": "8a9dbbae-1daa-4110-bcd5-b4330196bba3", "comment": "Malware payload (Mirai)", "value": "1a7dff0a538f10468c3918e50735de858cc105c6626015a9d0e7ceaddc0fc35e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721131, "uuid": "0b8e792b-7196-4d4c-9337-322ed6abf16b", "comment": "Malware payload (Mirai)", "value": "900b8918e17a7669837eda06e2f830c979d03004", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721131, "uuid": "b3d3d0ca-7c6d-41a1-85ea-5492ee0309bc", "comment": "Malware payload (Mirai)", "value": "780b76fb14205d909026fdf51f172389f7c94f89d0065247ba915febbeb7a3e544cb67d92c11ceef92974124f3771ccd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721131, "uuid": "5fb85d15-8d2d-481c-a615-ab3629ba0639", "value": "T19F6301BAD033335EF6358CF9960899A04093EEB1B783C3646FE1194E359E53DA149ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721131, "uuid": "2dbb5484-0333-4fd4-91f0-29df8082fdbf", "value": "1536:bgsSrzybdXlMQuo/qmje5zFhOz3nZjhNpnW5hhZpba4bNS:jS/8dCQuo/Jje5zzOzpvhW5hfpbakNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767721131, "uuid": "5b7075f1-43f0-4ca0-99b3-3699ad1d721c", "value": 67976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767721131, "uuid": "8439ed1e-ec33-416b-a004-5204e4e6a8f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721131, "uuid": "52766e66-19de-4414-b91b-c017ecb398af", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5977d9-eaca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767681449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681449, "uuid": "421e26a0-0d2a-4e3b-ba65-1ccc3c177b82", "comment": "Malware payload (Mirai)", "value": "7f519e43eac87b8f74180f18f3a56bdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681449, "uuid": "b5fdb926-79af-4efa-9b61-35698a9ba756", "comment": "Malware payload (Mirai)", "value": "1ce784465b85d30b9087ae8856b52c969756dafcc8a9accdcca4acc2f7c1f210", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681449, "uuid": "1ab3cd60-7381-4439-8335-3871e6822a70", "comment": "Malware payload (Mirai)", "value": "df347816eb9fc9f2c5f9dc1ab955018d5a75a6f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681449, "uuid": "7f61857e-e274-4627-8453-2a9e5c154f3b", "comment": "Malware payload (Mirai)", "value": "4b8d1ce23bc9ab65810a104b0b0cf6f776db5fa812c0df615efd75fcf19f1849c894dbaf4128a9db082a830738a6d3f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681449, "uuid": "facb7ca7-624a-4202-9a5b-faffa1191fac", "value": "T17E73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681449, "uuid": "c701e040-2571-4a5c-a2e7-d3e9da5ab6fa", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStd:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681449, "uuid": "75540010-1614-40b7-bb0e-d17a1af1c90d", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681449, "uuid": "44a88d6a-9311-4738-9229-c828379ac185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681449, "uuid": "189a17a2-70d7-4a1a-b35f-604f43ba1333", "value": "a1c0ddb250d0736b740304169b9376832f1caf201ef5cb2f319b952933dab839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e0cfcb-ead4-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1767686020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686020, "uuid": "6f8dafe8-13a8-4c8b-ae25-15c3d4653dd6", "comment": "Malware payload (AgentTesla)", "value": "95a2bedf9725507f644c7379b0077d76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686020, "uuid": "1080a9ce-ad8c-4658-af3f-49f8a9a76c6a", "comment": "Malware payload (AgentTesla)", "value": "1d01053e7f1c99ebbedfd075c4e53e106427f6871a3d270da90e98bf1027334c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686020, "uuid": "e85b0b97-dbfc-485c-a355-88631d68ca86", "comment": "Malware payload (AgentTesla)", "value": "663223a3d7d75df19c23be00cd0ea2b3029f153b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686020, "uuid": "3b195b91-e55b-4e42-a249-12f9bfff928f", "comment": "Malware payload (AgentTesla)", "value": "44f738bdf792985c3790f7dac24fc713b76b73dd9fa01eb62268b5be978d01bab4f31218505966507dd776ca26605273", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686020, "uuid": "e5a6ff73-248f-43f6-972d-08c05f8d6686", "value": "T1634502148DC86FB5CFAC9A1890BE171DE7F0568F4016748AFB2BBD46BFB7644420B189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686020, "uuid": "436028f7-f881-43fd-9d1d-f2400d84fb8a", "value": "24576:kwj8M5U/Q3PtICLvhD+MOfNA9a9Vx6k4tCmmr:zEQ3PTdVOfRl6dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767686020, "uuid": "61aa7f55-ce99-4581-8797-5482e3aa89cc", "value": 1247492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767686020, "uuid": "6936d135-874c-48dc-8609-02a9a1c645eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686020, "uuid": "dcd5b8d5-07d0-459a-9dc5-7010c7400fc9", "value": "05.01.2026 PO001MPL206.PDF.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306270a5-ea94-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767658263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767658263, "uuid": "710cd025-cf4f-4440-87b6-1ccacfa6cefe", "comment": "Malware payload", "value": "d60a74dac5c19fd45dcc632502501031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767658263, "uuid": "76edc47c-ea84-4dd1-b6bd-4f73f135ec69", "comment": "Malware payload", "value": "1d4edfe3e4c16ccbc39bc1164ddf95b80f3a8954db5acdcc14c8483a40c1682a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767658263, "uuid": "d0802ce9-98d7-45cd-a751-55e6d6319266", "comment": "Malware payload", "value": "5d284b588e36f3d6b778832abfacd7f95441c6d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767658263, "uuid": "a4d4d432-141d-49e8-901b-11aaee5a962a", "comment": "Malware payload", "value": "1146123ccc5bcdcfb4107384210de1a6b242f356ac33bec47fe1db8f9bec4472190b34833d753dde74728eead0309053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767658263, "uuid": "82c93f0f-e40d-4e9f-8deb-1ff2996b09fc", "value": "T17BA633A2BB85D075C56D2938BE67E754D2796C720F2081E773E4BDA63E310C2D632322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767658263, "uuid": "47c45302-460e-45f8-9c3a-296176c62e4c", "value": "c58a6fdd5514cc5114ad09dc07384b11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767658263, "uuid": "fc96c99e-c68c-48dc-ba31-ef82518632e6", "value": "196608:GBsyJKFfH88ywgcD9LRTC7XqKP1twOvt6FrISYAt:4kFfLywf9LY7N1N6FESzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767658263, "uuid": "8cc38662-cac0-4d49-bc01-269029576db5", "value": 9836138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767658263, "uuid": "5a29269c-0317-47ed-93a0-7aac59256979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767658263, "uuid": "4a5eb068-e690-4ab0-b7f5-8fede68c8633", "value": "Aegis Virus Scanner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63410259-eafc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767703016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703016, "uuid": "a6444b12-d2fc-4d19-b881-70986c414564", "comment": "Malware payload (Mirai)", "value": "5c5fa6c3deabfa10b722462edeeacb3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703016, "uuid": "bd0e98f4-cf63-4667-91d2-4b116f220123", "comment": "Malware payload (Mirai)", "value": "1d96abe06be1940c50930bb530be924a592da835b4de35a72c16a55b3f5a5b9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703016, "uuid": "eee11329-0eed-4626-9172-c5cd1bcefe6b", "comment": "Malware payload (Mirai)", "value": "fb242d668c373a833d9fc9b0dc4593ce9365dc0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703016, "uuid": "63142697-5b8e-44c9-81c8-2ce8da287fcd", "comment": "Malware payload (Mirai)", "value": "d8a1c01bd3acdded67278f7ed8c4fd367160ad8d0cc8a4ca0759830c119e3bfc7263425d8ab8793986708b4736d843fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703016, "uuid": "40bb7d71-d09b-47b1-be09-f37bb63ce908", "value": "T129D31B46FA409E13C0C61772FAAF414A3323D795E3EB33029D285BF43F86AA94E57615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703016, "uuid": "17cb4132-bf03-4db0-bf64-88b3c729dfe5", "value": "3072:WBAL1Xg3Td+21MyxBpuxAxKpEcYotAygkl4FHUIIM/9DAX6r:nL14rwAxKpEBouyjWFHUrM/9Dy6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767703016, "uuid": "648fec55-119b-47fc-a0f8-e76859196b4d", "value": 135750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767703016, "uuid": "e8494119-3e7b-4d69-93f7-c05bf707018e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703016, "uuid": "89aed4dd-a126-49a9-818a-dfacacfa4db8", "value": "Fantazy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf56395f-ead4-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1767686018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686018, "uuid": "cf672cdc-4ebc-40c8-bcfa-c0da9d010aa4", "comment": "Malware payload (RemcosRAT)", "value": "4ee6ac37f2c5aa8511523cc31a7e1d2b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686018, "uuid": "67d29268-cd83-4708-85bf-ed278458f397", "comment": "Malware payload (RemcosRAT)", "value": "1da392c740766d577b9c90edda753f04710798250ab6373ef07a095e1cb7a6ad", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686018, "uuid": "740de7d2-5bb6-4eb6-bf75-4620f071952e", "comment": "Malware payload (RemcosRAT)", "value": "2637d5e0e64f238d0b130d73507a6de5e9476009", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686018, "uuid": "2eb6763f-4d7f-4baa-9fb1-e9b35ae4cc5b", "comment": "Malware payload (RemcosRAT)", "value": "a11396ba0c87d81330dc1ec90ee93dd2e9b5cb6e789cbdf289aa16d43710895922044127b7c477e73a663b5e72f09f27", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686018, "uuid": "31010338-cd18-47a3-89ff-42257ee45a2d", "value": "T108457855DDB289117A8DE371093FCDB5A80BCD7B36EC07AAC3D026B05F14995980B8FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686018, "uuid": "fcd7852b-c283-41c7-a0a5-7a9242bc1f69", "value": "384:0iui2iui2iui2iui2iui2iui2iui2iui2iui2iui2iui2iui2iui2iui2iui2iuS:3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767686018, "uuid": "c46a4b9d-89ce-40ae-b6a8-683ca2d24402", "value": 1266006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767686018, "uuid": "de4bd6ad-2294-4043-9561-71b62300cd7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686018, "uuid": "b053d6a6-ee65-423a-af3e-2d2ed0566d11", "value": "Quotation-RFQ-556656.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37946a75-eb0d-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1767710244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710244, "uuid": "12a88c99-40be-41d2-9626-fa672076e7bf", "comment": "Malware payload (PureLogsStealer)", "value": "27d4c6b21fd7b40370bf3313033e03a0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710244, "uuid": "58749f50-94d4-4088-b400-c2f9057a97ac", "comment": "Malware payload (PureLogsStealer)", "value": "1dc3c1b3a129ff39aa9603c3ddd01590e4813224a25f5e350f05b3dab8801631", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710244, "uuid": "6b93e3c5-5c14-483e-a560-31dae5d0e026", "comment": "Malware payload (PureLogsStealer)", "value": "e530d0be19de4c98c841ff49e4d6a22f66f81d91", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710244, "uuid": "3edea7ee-3b91-46a7-8cf5-c7900958996a", "comment": "Malware payload (PureLogsStealer)", "value": "0bf58ee6617ddfb05a421bcbeb16596b016fdcfe0665e60526b6a9f14473127a1c42d0301b2dadb760fee12f0ffa888e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710244, "uuid": "d7307a6b-d3a5-481f-9871-3568717a6aad", "value": "T180F39D4A67E420A6E4BA57B498F203939A31BCB15B7486FF12C4D57E0E336D0A532F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710244, "uuid": "3bc570b6-f0f9-4cbd-a288-7d72ae877749", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710244, "uuid": "07b2ca1e-0568-4ce3-9873-dd0aa50fb063", "value": "3072:wahKyd2n31m5GWp1icKAArDZz4N9GhbkrNEk10OBT:wahO2p0yN90QE14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767710244, "uuid": "de81eb31-719b-488e-ac2f-c306a7d0e1af", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767710244, "uuid": "406edf7d-fa9b-460a-b13f-11f43ed73f5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710244, "uuid": "c1206b94-e9a2-4f6e-b1f5-25590c8c5207", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602b445b-ea9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767660920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660920, "uuid": "7ff00af0-8d93-44ef-b289-bc5f15a36fb9", "comment": "Malware payload (Mirai)", "value": "2ec23bc3180a9950de07d313e9d18e41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660920, "uuid": "bb423f1f-93a6-4a09-937e-cf7ec84ca452", "comment": "Malware payload (Mirai)", "value": "1f05e76c1a36000a676ec1bc7850fda0a0d91c5789ecc8d97a2e0e90cc4d552b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660920, "uuid": "04460bab-8331-4b4b-959d-fa3bbed0be9a", "comment": "Malware payload (Mirai)", "value": "545f5a973b7516e79da8ff9de4eb52a0cc73663d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660920, "uuid": "dc3add69-4adc-4d2f-b2f4-34d8dbbfb5a8", "comment": "Malware payload (Mirai)", "value": "6ae82fff2c23308c7cf929c709191fb4626dcff89054463f86d0f8bb06f1ff823cc0ed3ad4fbb76ef528770d158870d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660920, "uuid": "6fd3d3a4-c216-4898-9552-d0ba65336071", "value": "T1D783074AFD819F15D5D922BEFA1E018D335367A8E3EF72028D105F24778A92B0E77A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660920, "uuid": "0055ece2-92e1-4f11-b83a-02ba9d8c7488", "value": "1536:tRnR1eLRiI/SOqn5savHwe65CNbsfi8/OnmSkb4FNlHSiBWazP8mup7R:noR/xy5hvHwe65CNbsfi8/OnmSnFWaQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767660920, "uuid": "08de2f13-002b-434b-97d7-dda5a66a8722", "value": 83296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767660920, "uuid": "e08938f5-ce22-4319-887f-5b81bb226a81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660920, "uuid": "1b56a13c-8d22-46c9-86b5-a78a62437bab", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9c7e28-eb11-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1767712263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767712263, "uuid": "dd450274-108c-4fb5-9013-29965720e600", "comment": "Malware payload (RemcosRAT)", "value": "a0770e8da1aef7432ca6b2ffaeab57cb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767712263, "uuid": "39242ace-25e8-4124-ab5b-e2d8dd345d8b", "comment": "Malware payload (RemcosRAT)", "value": "202a990e53b83d04e82589bd7d448f5973d007fa7b07a72efbe7d5cb229df6e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767712263, "uuid": "73abec88-29a4-421b-aa84-bd21cba886fc", "comment": "Malware payload (RemcosRAT)", "value": "3c95070a913f731c6b9cc3c45d8f099dad286545", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767712263, "uuid": "b27e62b0-88a8-4325-8549-ebc93c509a3d", "comment": "Malware payload (RemcosRAT)", "value": "dc04da1f86d9454998f0fed857e9883a18ca7c29abed29575409a07d651e04226d6ad9de22dfbc2c3e1732912bc55c48", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767712263, "uuid": "ca1bf725-79ad-4f50-a358-0e42c9a16cee", "value": "T1C646B50D55E240A3F023BDFD5F3E36A0DD866D2B96E64CCA31A5385B34ACD98D620E35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767712263, "uuid": "bfcd3bd6-6abf-48b7-990b-ad809bdef427", "value": "49152:18KWr0flQt6+taZvhfEJZZVijsVUNpOdIjkBAOfsG+kbKwEGBX9VGlU:CKWKlQtNtaZqtXyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767712263, "uuid": "4f8404a2-9e71-4915-96ab-873f1a6569aa", "value": 5828814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767712263, "uuid": "d697af47-c8ff-4e6e-842e-d046df205144", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767712263, "uuid": "8002de20-1879-49cd-9fc8-6b63bf27bbc1", "value": "Purchase_Order_PO001405_Inter_Agenturer_AB_20260106_130406_PDF(~34 KB).JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33447914-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767720974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720974, "uuid": "984180a7-e9e1-4b55-9c8a-d36b886c1b97", "comment": "Malware payload (Mirai)", "value": "843678e988e7b94f20eabb8f6bbd2633", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720974, "uuid": "003dc6c7-4975-417f-843b-f8559fdac8bb", "comment": "Malware payload (Mirai)", "value": "2107c1a79e0cfa5d9b9a8f272c391de85b3ef6ff72a0d5529aa5af6d03e3e096", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720974, "uuid": "604594db-4361-4155-9c3b-29eb5b8b045e", "comment": "Malware payload (Mirai)", "value": "9314c3a83c94aa7f6809e7bdb367272661b77e82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720974, "uuid": "09dad729-2a08-4e9f-9706-71fc8d75a717", "comment": "Malware payload (Mirai)", "value": "35c1be6c2500b29422ec5bf56fdd280f672e7f6aa9c3077a424215abaacacede3481b25b1d5e8c56c12948d3bafa5b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720974, "uuid": "d07fc02c-7b51-43fc-b9ff-1d8ae720422e", "value": "T151149120FA0663B1CC720A38A7956E5A6E7B04559FEB26312D1F533DDE628509F30F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720974, "uuid": "849f255d-b982-47a6-842c-26d04a3f4ffa", "value": "3072:I8CUrCSw6UBNPFhwnKqofeJy3fPRxwum57UKd:vCUrZw/nNh8AHRXs4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767720974, "uuid": "01cd4e0b-aa44-4cf9-9e58-6728849930a4", "value": 193140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767720974, "uuid": "d7d77a9e-18aa-4a56-bccc-d8b10915241e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720974, "uuid": "4a9fddaf-8fd6-4b39-a5a0-fc6e3e3ee66b", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe980294-eb45-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767734630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734630, "uuid": "5836d510-ac67-403f-aab3-c1b964ec7334", "comment": "Malware payload", "value": "cbd21d3700ea97de71abb9be2321a1b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734630, "uuid": "039b1251-02a6-48a8-b7e3-d154a9fbd203", "comment": "Malware payload", "value": "2566d86ddc875b654d294e049c639a521e8af7960091ce21d5b366a20fe391a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734630, "uuid": "4a34f09f-c6e6-4ba1-a636-82b3294b9902", "comment": "Malware payload", "value": "11ebbc3d1b637ca17b678140f5727a9285a4685c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734630, "uuid": "67c3e6a9-d850-4090-8bad-dbf1b730252f", "comment": "Malware payload", "value": "35ccaf1938c4fd60041028d4672b18809ddaa8c8065d667737600643306b6e294b04f6902e1faa4ca1197e9193331e8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767734630, "uuid": "756f317e-f788-4ad5-aa99-149a9f41d568", "value": "T16AB48E59BA5E3C43E3CBE37D8F499361632B35E4E36392A23901031CD5D2E99CFA1952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767734630, "uuid": "c75cc96c-bea3-4105-9895-c8bc6ce48ed0", "value": "6144:mK/G0aXT0fThEcm/IHh26tMtBN5BPjH6XD/eJNYNdHo7g5a5wTM2uImK:N/XiT0NEZIqVfjHmD/aNWHo7g5auTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767734630, "uuid": "5e9a03b9-e3b4-4bff-8271-d55c844a3dfd", "value": 517000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767734630, "uuid": "54f64566-0680-403d-bc72-d2ce046a88ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767734630, "uuid": "b5c7bc59-55ea-48f8-9efa-34432363540e", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b80e80-eafc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767703124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703124, "uuid": "a4b1f917-e5f6-45b3-9340-c4240905f005", "comment": "Malware payload (Mirai)", "value": "49987042c72bf315f9ada806f1e5f254", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703124, "uuid": "fcf8a5b4-9374-429f-bc5c-f78166c1595e", "comment": "Malware payload (Mirai)", "value": "2670615d0049e7d4b6a5ffab94bc382d94e70b23940799a6eaf664e9519f3c8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703124, "uuid": "0b22fcb7-0798-4022-982c-b6d9717df3e6", "comment": "Malware payload (Mirai)", "value": "1e53ee202d929fe5c4b057c29a58f4af8ff253d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703124, "uuid": "cc3ce587-891d-4178-afe5-25e34f71c907", "comment": "Malware payload (Mirai)", "value": "e755e41aa5ec70727742c4cd1060c1fa5ea43289a48f09541e3b9a12bb8de8584ffe305c0248f60a6f77addf57baf4e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703124, "uuid": "a3302225-53be-4722-aa71-763b6f617930", "value": "T1BF33F8C6BC41EA2DD7C00A77EE5F10AE3340E7CCD1DA32429D2887A47A8ED4A5D56B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703124, "uuid": "9d9401b3-929a-4e48-8a7d-bed86e200b20", "value": "768:o4TDnMqvgrxBFlz0gLxxHzkQZo69ivA7u0hkermbANacd8UYyCQZydRU6SE4N0LW:pDME4Fl/Lv9fMv3fU2/qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767703124, "uuid": "20810984-b830-413e-b206-fe6b97d31193", "value": 54508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767703124, "uuid": "fe34c1dc-cacd-4c54-affe-02ec9ed84d57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703124, "uuid": "4081bc21-7f10-4084-bd10-5c4a65a2ce07", "value": "Fantazy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ed2ba6-eb0d-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1767710186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710186, "uuid": "26fbb439-1baf-46a1-8d36-d8020d59453f", "comment": "Malware payload (Phorpiex)", "value": "8a3f92b535c77dae22b6a84cd2203575", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710186, "uuid": "6811abee-603c-4cd4-b7d1-dfdab8a2ea10", "comment": "Malware payload (Phorpiex)", "value": "26b441b6ac06968d8029babb90fba7927e1d21c9cb84b0492c4890bca5dd2660", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710186, "uuid": "697fc4de-7788-4de2-8108-5f85a0d9883f", "comment": "Malware payload (Phorpiex)", "value": "5bca2bf7f5ffe4a3d5669853b30e18119ae5ee21", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710186, "uuid": "2a076366-04e0-4d4e-b076-ed251289255f", "comment": "Malware payload (Phorpiex)", "value": "6ad97539ab74c3cbab343d4cfb3253f16af68cdd795faf9338afcae08a4a4b0c8a92c61bb4ffd39f0bdb248199b55ce2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710186, "uuid": "bb32f399-08bc-4c73-8e0a-90c0ff6aa974", "value": "T175823B0BBC504139E4C144F85236AA7E8DB958BA378169EBF3C045CD89785D2F83A92F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710186, "uuid": "91b72cc3-88de-48f1-a15c-fcade61a55c8", "value": "51c161c9913a4b650517329371c6046d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710186, "uuid": "16779aaf-ef09-481b-b97b-6bd4ae7596b4", "value": "192:37wioLPXbeng7GQxN/vy4zTP6DcVD5xYQEZeaymJr1KUSh+zwzwUSJxTopHB9ctv:M5X/NScT3D5xlE4ayou+slScpHB9cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767710186, "uuid": "3246d7d3-da92-4336-b3e5-bf35705bedeb", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767710186, "uuid": "423632e7-18ad-4bdd-85b6-6c973b55f897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710186, "uuid": "5917cdca-a398-411d-aba3-58226d3b1127", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656e94b1-eb0d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767710321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710321, "uuid": "cf5f1797-f91d-4b3f-b4b9-bf8d6f5f7dfc", "comment": "Malware payload (Mirai)", "value": "1b2429ae110c4191b8948dbc8b5c8de9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710321, "uuid": "7b747ce3-ebd9-48a9-ae9e-83f13361d619", "comment": "Malware payload (Mirai)", "value": "26f076825580b723cc72d506e6a74bdb17084385d216463bfd50c1f655a3f668", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710321, "uuid": "c1d13575-9112-40bc-9256-b3f397e9bdae", "comment": "Malware payload (Mirai)", "value": "723853e5a139e42bcd9b7e070576be3ceea7b855", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710321, "uuid": "41df1726-207f-450e-9397-d22bfe7d119e", "comment": "Malware payload (Mirai)", "value": "a1ac848682cda7a45b3907effa65e152d7fbcac7265049b5970cea004ddf948c7fc45a287b8b570fd88f1385e4280dfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710321, "uuid": "c36bd677-4b70-4a71-89e2-44b7669e2acb", "value": "T1DE34738AAFA03FFFD85ECD334295DB09119C590A1288BFB66A74D504B68B10E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710321, "uuid": "0d013b86-2be5-4e27-8894-a77cb265d0c7", "value": "1536:VFfsAt6JNb4Yd/FhI7OC1i1EtVSf6MQrbDr4vwg0bSnlLkcxBJ8dysElg48n5Q56:VFtkb3/FhIDRM3qepBJ8Dn5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767710321, "uuid": "91008091-ed5a-4739-90a8-38015165a2b2", "value": 231704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767710321, "uuid": "2c948691-39da-49ee-853d-365a74422608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710321, "uuid": "ecebe1de-dd43-4514-b1ff-7ee887389c93", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2912c2ec-eb2b-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767723105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767723105, "uuid": "21876b48-7c29-423a-bcd2-4f9a031555bd", "comment": "Malware payload (QuasarRAT)", "value": "f7398df9b4a2f27568ded2f1b750e65e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767723105, "uuid": "f8a5e640-db6c-4753-8085-a7ac9953bac1", "comment": "Malware payload (QuasarRAT)", "value": "2ad6a919f8256c9100324af50c0894527bb71f344ecdfe1e1f00b4e708ff8481", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767723105, "uuid": "abe2e1bd-87a9-47b4-94f0-a9ad13330e98", "comment": "Malware payload (QuasarRAT)", "value": "b2d4805b29cd1f4fd7c2d7c0ceb21ab7c4e8340e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767723105, "uuid": "933291d9-cd57-49ed-8cb5-980d80b8b449", "comment": "Malware payload (QuasarRAT)", "value": "942e89269e593b83d87d4c09b5ad2d636e343cd61618c48df69d1f20e0a010c2acb20fcc7458f19d188149390a6d3ad3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767723105, "uuid": "c22184b8-9b38-43e3-93b5-19c6d4f8d374", "value": "T11E86332E94F2DBE8D6B9D4F616FC127E05E3781F31DFA1A967EA4511BA090C704380B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767723105, "uuid": "8d50d79d-a6ae-425a-add1-6443cc4d54c4", "value": "60559adcf3698c3eb3c69577ebf28413", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767723105, "uuid": "c9a88a2b-26e9-4922-8fe8-fea5307d00b4", "value": "196608:QMLJZvVtypBrzn7GMhO6c/iODP2m95RlltjP2JKYiHB:QOJZvVEnrT7lhO6cTDOE5/KJuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767723105, "uuid": "73da3b25-b98f-4ccb-8206-1521a96041d3", "value": 8110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767723105, "uuid": "c4bf4908-528b-4e19-8f84-178da82cd346", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767723105, "uuid": "b29e308b-3a05-4ebb-9814-0cda8e035629", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fdfe4bf-eae8-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767694367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767694367, "uuid": "f9520ded-1d29-4431-9dad-614ae9f2514a", "comment": "Malware payload (CoinMiner)", "value": "fa3a27b70958cf7cb052c37d0399c9b3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767694367, "uuid": "e1adac07-a33e-4a3c-a90c-a6a8d1883c7e", "comment": "Malware payload (CoinMiner)", "value": "2bbd691e69efca373365776e38c44d93c7ce075deca99d0abd79305b55c64444", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767694367, "uuid": "7a1d9488-d5f4-40d8-97a1-99c164f8bee8", "comment": "Malware payload (CoinMiner)", "value": "0611976e7afc08b469a8c66416c848f6e1f0a01e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767694367, "uuid": "ea29b23b-f6ec-4e99-8c8d-f4e55856e25a", "comment": "Malware payload (CoinMiner)", "value": "c76ef6d143e5528a801b14f95e18ea6fed38283eaf46501b9717ac59e74314534caf2fe95fafed5745d2c850d5d6ee32", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767694367, "uuid": "769c77fc-da3c-4b48-8055-aeb09032454a", "value": "T1F495337C8D2F81EED9817C3BB619F43904B28068D7C491A67CEB76E9D42506C72E4B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767694367, "uuid": "5f9e9331-bae2-4e4f-8b34-a216a4e2b391", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767694367, "uuid": "f6d1488d-d5f6-484e-9677-09355f565dcc", "value": "49152:FwvxxaN7B+rdEtrUanbuioy80uiVZ900vfOsfmxxG:FwvPa2rdYU6yk39Os+jG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767694367, "uuid": "10d3147d-44cb-411e-823a-e57a0dad0830", "value": 2041344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767694367, "uuid": "fbad84f4-93d3-4da9-bf78-268e05d41bf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767694367, "uuid": "324f8c05-fb92-4456-be16-87a992e5cf9b", "value": "WSSecurity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ab96a7-eb34-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767727206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767727206, "uuid": "649348a7-ee9a-43ae-a30a-c27cac5f416b", "comment": "Malware payload (CoinMiner)", "value": "81f683d92c04482a7672f563b7b1c8af", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767727206, "uuid": "40b80bd4-2c08-4896-8939-fee1aa7f5f01", "comment": "Malware payload (CoinMiner)", "value": "2c6ea46ba11179ea4638b19a54f7b846ecf760b117a6f0702686f965090a2046", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767727206, "uuid": "29886afb-4f60-4261-8aa8-cb3ad46b04fc", "comment": "Malware payload (CoinMiner)", "value": "9e5ae7f43948121babbd1a90d19eaa3c50823051", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767727206, "uuid": "81d2e640-4474-44b0-be75-5fbc81d5682a", "comment": "Malware payload (CoinMiner)", "value": "b5fc8ed8f9a3f4d800d91293fbc8eb0df415d459c39a4c66cddc3bdf7c16b2f2c31951a7847e951c6f9dc7c7e562dcb3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767727206, "uuid": "98314ee7-ed72-47fc-8dc8-757dee84bbd0", "value": "T1CEF53366D74474FCC6A3863E5273BE60723BFAA00B643DC327B12288B5594C6D770D9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767727206, "uuid": "af9a555c-4a21-4169-93c4-084ffce42ca6", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767727206, "uuid": "3ac54cd6-2b27-4d00-9b37-0b751b037c28", "value": "98304:hMOtjWWq1WZeJPnzsr/uyMS2OzM9SSqwT:hMOtjWWsJPnw/uyMLOzojqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767727206, "uuid": "937dea64-7ecd-4c87-a982-d9d95a4e14bd", "value": 3436344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767727206, "uuid": "c1632a58-c5d0-4f9b-81dc-2fd1776da609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767727206, "uuid": "07e5f8c6-2a96-4f08-a51c-58aad1f79a23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015e0c12-eb11-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767711871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711871, "uuid": "594c14ab-4816-444a-99c3-f28eb084e2b0", "comment": "Malware payload", "value": "da003d977945fd6d25c3073cf1944601", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711871, "uuid": "84612632-25d6-43fe-af80-69f68c05b816", "comment": "Malware payload", "value": "2d67b63f6e9fc47ffb790ef1db17bfdd71d7a85bbcb31d381c1feb210f5ad110", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711871, "uuid": "7130c8d6-00b1-4cd5-99a8-1f83c682c678", "comment": "Malware payload", "value": "81a153401f130a87a798785cae14a190b9b2a663", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711871, "uuid": "bb010ee6-ed5f-4122-8108-6cc53aaabd45", "comment": "Malware payload", "value": "10d3fa4b5b8387d795670381e25eb0d40eabb6d7572106a97b9114f548e694fb91ae26fd45f1b55cffef9ab8e98d4a90", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711871, "uuid": "b4b53da0-8344-4dec-add3-d3723b867159", "value": "T162A6010AACE21DEAC4A9A7318DB752967B71BC451F2223D72E90B3782F72BD05C35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711871, "uuid": "e4e29523-241d-401f-84bd-9cfee8f9db90", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711871, "uuid": "7432d477-eb76-4cbf-8b30-567cc9109a9d", "value": "49152:GfQDBHPJSP1WyspE5yNwi5dSXH0yh/MPVsEzn/W2wJTm4LQIzO0+mxdFwQkU0ZaC:G4DkRFFUgPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767711871, "uuid": "d4780d34-e5c6-4679-b12a-5da47c862e74", "value": 9677824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767711871, "uuid": "cbdfb64f-ed53-45c5-af18-b47631b7ab6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711871, "uuid": "ef19def7-6e40-4c6c-a162-e6bc960a97a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21673c0-eaa2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767664547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767664547, "uuid": "931ac220-898b-44c5-8c3f-854713814fa9", "comment": "Malware payload (Mirai)", "value": "d24e981f51efcdbde45924dfe3ca51b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767664547, "uuid": "7e806247-3ce8-4fdc-904a-b3bbc3a8881c", "comment": "Malware payload (Mirai)", "value": "2e65141a37f3721ce546b645965bf2beb4910c6fa8b418b114ac73f43a52b219", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767664547, "uuid": "c6e8899c-a0b5-4646-98d9-b698d157ab39", "comment": "Malware payload (Mirai)", "value": "47180caa5c30264b643d02a352aac040678b239c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767664547, "uuid": "a1e7dc9d-6d4b-470d-8f46-2ebb6037f82c", "comment": "Malware payload (Mirai)", "value": "d87d4a3e52237b5e27c05f59d52aca714feacda5c942e57440bd9c431bbf6d426bb8f36bfff3970405547194e0015123", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767664547, "uuid": "b7cd92fe-e6aa-4e25-b48e-921103490a0f", "value": "T1F243860E7E229FAEF66C863587774F20D79463D627E08681D26CF9045E7030DA45FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767664547, "uuid": "c388a532-f8b6-4dfb-bb5b-a09e00d1731a", "value": "1536:8NhbRlsZhWuMLWzdSkBbTUzTulzTTGLFwDVaMur7RXB:yoWuKW8FwDEMurRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767664547, "uuid": "64f28bd9-32b0-440c-ab3e-8fb3f00d9bba", "value": 58540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767664547, "uuid": "30c8f86f-6d30-4e82-8374-c59fd3947b5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767664547, "uuid": "c4aca609-8a9b-4eac-87cc-e263152cb5ec", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73622df1-ead5-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1767686293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686293, "uuid": "e4c49eb2-2f32-41eb-87a3-0f0c84dca76b", "comment": "Malware payload (VIPKeylogger)", "value": "ea9d473440707ef10a1473b63eabf3bb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686293, "uuid": "6c03f7eb-7579-4999-ba78-65d34511ed28", "comment": "Malware payload (VIPKeylogger)", "value": "2ff9adfc623f65da156245beb9a3b363f27e37cd3d09aa6a57b6a453849b5bbf", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686293, "uuid": "5ef3ca0f-445a-4c76-b99e-b8b953927075", "comment": "Malware payload (VIPKeylogger)", "value": "e6e33db73fd969f82fa43b445021ea3bb0b08481", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686293, "uuid": "ac909cbe-3dd4-4684-b063-475bf819812a", "comment": "Malware payload (VIPKeylogger)", "value": "aadf6a3bbf9bee38c022203c04d51d215a4fd151fa4927583327e097645a2f511a1a2e93915909676eaf0dc41cdc7449", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686293, "uuid": "b0b32211-cb6b-4400-a7ea-9733e2355401", "value": "T1AEE4023E044A90435CFEA8DE4FBCA8B5427DA7C7CC2E6902D55B11D7442AD6BCAF3129", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686293, "uuid": "3d0bc3bc-bd2f-417a-b43c-e27c439c38d0", "value": "1536:cKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKm:/nzk3yLg3DWZpV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767686293, "uuid": "2fb31f4f-cda6-4ad5-bf18-e4099e8e422e", "value": 707759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767686293, "uuid": "e65db596-0bd9-49f5-accc-887ba78a0a09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686293, "uuid": "5dc96f6e-1a26-4fb4-89c9-a805fdb8bdb6", "value": "DHL SHIPPING DETAILS_8878_IMG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda710bd-ea9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767662876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767662876, "uuid": "513034f2-59bf-46cc-af91-6876a26b439b", "comment": "Malware payload (Mirai)", "value": "10f33db1d31241235dacde16443c6f92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767662876, "uuid": "87e99645-d7be-4c0c-85f2-d7aa3918c5ac", "comment": "Malware payload (Mirai)", "value": "31138264fac5dc4b0e8d0196b36d787511cfdc267494c99b18afebbff088987e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767662876, "uuid": "ab57dcae-7ef6-49b3-9c99-4df60c1692df", "comment": "Malware payload (Mirai)", "value": "0c70144356879438af06fa01762cd64628d95a42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767662876, "uuid": "fd154833-4d00-4eec-853c-c7bc2761f5d7", "comment": "Malware payload (Mirai)", "value": "065eb3f055fb59956ff785e38ce9d9e1f886e2eee4a9d33ad36e5f1d3f8b7ae57cac20ab5950ff64d66c3c3aa1231628", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767662876, "uuid": "3e62bcc6-c0bb-4c9c-af29-4798e593059a", "value": "T1BF533AC9BA03D8F4EC1905752472F7325632F5761034FA9BEB94F936A853712F90A2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767662876, "uuid": "f1487595-8b40-4333-9b85-b4b1853d8760", "value": "1536:bHMP5pNUfhS0q2DBG2X/LdktlaAvuWKL7hZFInKL0rStYR:bHMxvUfhS92DX/LolaAvufL1sKoet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767662876, "uuid": "aa1310a3-a5a4-48a6-8e82-65878b6b095e", "value": 62096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767662876, "uuid": "4af55e3b-b2bd-4d2a-bd24-a29f051ab914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767662876, "uuid": "0e9bc098-db1b-420d-9c80-86ac78d930ee", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8747132-eb1c-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1767717010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717010, "uuid": "fdf7f754-1a20-4a55-a7e3-21948e35e2eb", "comment": "Malware payload (Stealc)", "value": "30bba08104d2aafc76919c2e5ef172cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717010, "uuid": "459294e6-3d5a-4d78-a602-85a620c921b6", "comment": "Malware payload (Stealc)", "value": "326c02eabd6a78785cb5b2a906b75ffa2ae1980f7991ee812310c7d38ab90010", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717010, "uuid": "96289ae0-df5d-4b84-9136-25e107832631", "comment": "Malware payload (Stealc)", "value": "125e9b34754febf183804434848457a757993341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717010, "uuid": "bca72533-b717-45da-a584-a0b1df0dc021", "comment": "Malware payload (Stealc)", "value": "f38170b188212b65edf5741dea8a7b2adf6cc927f5173597b7a7f1ce6b3f759680cd62754cccc5621b4d48ba754887ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717010, "uuid": "9bcdd83e-11e0-4138-a681-aaac6e1d6fa9", "value": "T15AF48C1AE3A602F9D4BFD178CA424552E7B278055330D7AF03E90AA91F376A45F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717010, "uuid": "63ccb339-5a93-42c6-9dc1-21e5eec76395", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717010, "uuid": "505db47c-4e37-44f0-8ee2-fa62360b6449", "value": "12288:NU8VHX4ZPBuvzkOkW7UE+YTRqwJ4/VJv3YZtF15kjH2A:NVH6BuvbkW7xXVVm/VB3gA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767717010, "uuid": "9111f8de-5686-4074-a25d-59eade23b7de", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767717010, "uuid": "c03483f2-2323-4fec-8e3b-78a279cf0c65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717010, "uuid": "ae9fb68a-0835-4609-bf22-8b0d69c73b8d", "value": "326c02eabd6a78785cb5b2a906b75ffa2ae1980f7991e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c9fd17-eafe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767704035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767704035, "uuid": "ca08b722-217a-4287-816a-993119049a9e", "comment": "Malware payload (Mirai)", "value": "ee23577d8b4765cf3674956426a97bfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767704035, "uuid": "c5ae95d9-3df6-4a68-9c46-3d5d842e5a27", "comment": "Malware payload (Mirai)", "value": "32f4bc34bb4a32437a3951f30178c617e45221b3964dc5a69131e90ce23e00f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767704035, "uuid": "83f6d07a-9d9c-416d-bea6-2b987b96b0e5", "comment": "Malware payload (Mirai)", "value": "508a2325e14cb548691de86d21dfceda29af746f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767704035, "uuid": "4edff634-92fa-490d-a253-3678c2c393c6", "comment": "Malware payload (Mirai)", "value": "0165d5df187b19c420952812fec43ccf4b38a141567e6a81e0d5234437bdcab1a7afd99792b2c2a5677f0150ffd5b3a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767704035, "uuid": "24b280d3-3328-4798-b91e-bdc5f323950e", "value": "T1F5633814BD691E27C0D8923E52F7C626F2EA730E1070826D7D391F8EBB44790E986376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767704035, "uuid": "24363d79-a8a9-458a-ac9b-21be94b24fc1", "value": "1536:RLbc9u4XICR4VU5EsuCccl7KGql/UtWJMj:RHURR4VU2CcclKVbJMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767704035, "uuid": "92f3b1f0-47f2-4128-87f2-970d59c0e8d7", "value": 66888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767704035, "uuid": "387244ff-8b91-4598-a239-ba27421956c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767704035, "uuid": "d542f05c-f142-4386-96ab-675dea44db41", "value": "Fantazy.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60fcad9-eb1f-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767718268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767718268, "uuid": "7f3f85e2-4f8b-40be-8cc7-d6449fcf5060", "comment": "Malware payload (AsyncRAT)", "value": "7c1184f84530315d38a07d285878634c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767718268, "uuid": "0788f736-96ed-4036-87f2-9f1cd9866bf7", "comment": "Malware payload (AsyncRAT)", "value": "333722c8cd0d94c34ed5c6964a09a1f7229e4ad0e620afc566607fccd140f1e6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767718268, "uuid": "4b0dc3e3-be59-4ace-b728-2ab4202d1611", "comment": "Malware payload (AsyncRAT)", "value": "c2edd5434676d6e83e3a829f845eca6d06872fb7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767718268, "uuid": "72f3a3df-c1b8-45da-b13f-0413df9da201", "comment": "Malware payload (AsyncRAT)", "value": "ee8e7791851d819ca680808aafd5047394968d663add75262ae6f62e48aade0a95b6bf881d26c1238e18e4ada586eb0f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767718268, "uuid": "bbb69f24-434d-48a4-9f0a-b83c09d03218", "value": "T1FB536C002798C966E1AE4BB8BCF2554006B5D5772102DA5E7CC810DB5B9FFCA4A237FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767718268, "uuid": "620111c4-3326-4560-99a9-44736a9f7b79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767718268, "uuid": "55587438-6100-4b71-aec5-bf409765e9ec", "value": "1536:imJlE1ECyUAAk/XwQtPbbxw5jZCGGrVclN:ihWCyjAkPvPbbx9hY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767718268, "uuid": "2768b9ed-676f-4ca7-921b-e71fce996bee", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767718268, "uuid": "51649bf4-a70d-4433-9d42-26831faf65e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767718268, "uuid": "92ba971a-13ed-4dba-9fd3-19b344f07f57", "value": "StakeForge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04372b19-eaa7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767666349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666349, "uuid": "da839b55-c6d6-4f92-8c83-d7132eb9b3d3", "comment": "Malware payload (Mirai)", "value": "90896d523159c34dc1c571780e1bec5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666349, "uuid": "fc10e6ba-5492-4622-89c0-8f6551dcd459", "comment": "Malware payload (Mirai)", "value": "362eee5c39a78841fa9a8cae033a518efe41d25cfea8c9fb554fffa9b11747e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666349, "uuid": "f435cb62-6ee4-429b-8ab9-c7a8beb94fef", "comment": "Malware payload (Mirai)", "value": "2270366361329e4fcb92d4bea251401af1d905aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666349, "uuid": "8268d6f9-124d-4dfe-804b-24bda60df577", "comment": "Malware payload (Mirai)", "value": "7b0db49a7e221bd91a64416657e1cb68f63efadd24fc06bca79d5f2b4460f3609a8b76fe16b48ea118671995b33c05d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666349, "uuid": "dbc35c46-16e0-44bc-8775-85286e69188a", "value": "T15CB31A96B8818A11C5D513BBFA2E01CE33126768E3DF7222DD105F2477CA92F0E7BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666349, "uuid": "1431024b-9df5-41fd-819c-cfda3089b557", "value": "3072:+j/swP7TIQYi5wCsqNKKtloM6TPzDTGzakY6A2TYW5T8by:u/swP7TIQYi5wCsqvl26zak/AEmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767666349, "uuid": "a0d73798-14c5-4200-97ec-3bcc2ce9a0a1", "value": 116020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767666349, "uuid": "540bdd84-abff-4ba6-b716-c23e0fdfea19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666349, "uuid": "cfe6a134-1f93-4a80-aef6-0f8cd6391dcf", "value": "UnHAnaAW.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbfc730-eaca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767681636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681636, "uuid": "834be2f8-c64a-4d9a-883f-0ca680d17716", "comment": "Malware payload", "value": "8384c5ec6484cbcf32f32d1ddbf66fe6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "Libya", "colour": "#251A80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681636, "uuid": "54947a71-d052-446a-bba9-ef60934861df", "comment": "Malware payload", "value": "3854c5a7c3c1bf1eb2662d1178365053d356e2160a5dd82eaf9da4a1faa29639", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "Libya", "colour": "#251A80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681636, "uuid": "aed44a1d-a5e9-4004-a25b-24c886ac69ea", "comment": "Malware payload", "value": "46ce1b0ebc88a827cfb55f1f866ebeb7f1726c5f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "Libya", "colour": "#251A80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681636, "uuid": "2d07b091-6de0-47d2-8404-d64e9e549c7e", "comment": "Malware payload", "value": "9161b06a3269b8fccc0ee845d33c7b575522de2449d41db5f5588273fffbf2759a8be84045f2ebb033bf1c17f3e7d5ef", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "Libya", "colour": "#251A80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681636, "uuid": "aea9f189-6279-47f2-a2fb-936fd952502b", "value": "T11C07CE63F244699ACDE6A231F4E313D032260D554783A76A571FF036FDB31DD8A26AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681636, "uuid": "3913b049-6ae8-462e-a8a8-076f67af48e2", "value": "393216:TXGuoUi61kebmlmKS5rrZNjiNUxVoukRz4r:vlN1keKe/jiW4/sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681636, "uuid": "e1e6fd9d-70c3-40be-8587-06b60acabefc", "value": 18227626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681636, "uuid": "8442ef82-2ed9-47dd-ad7b-849411965a10", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681636, "uuid": "b7de1134-9bf3-469f-a971-21c744511c82", "value": "2-Masrifi-Plus.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bddc55-eaa1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767663835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663835, "uuid": "3ca29b80-0c40-47f1-87e8-c59d0e91bb5a", "comment": "Malware payload (Mirai)", "value": "5f683dd2ef50e96ee6da7619d40f2766", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663835, "uuid": "5acec49e-f9dc-4ec4-bbb3-7535d091e124", "comment": "Malware payload (Mirai)", "value": "39320f704309cd4de196b7ba649a8ba06815d07b8a6218163e7a3787bad3b332", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663835, "uuid": "f4308338-9a51-469a-8e47-281037dfd5f2", "comment": "Malware payload (Mirai)", "value": "6841a57d32796f60323767b65c1b3c94803fbc57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663835, "uuid": "7217bb4f-0997-4ef5-b1b7-96ce63942b2d", "comment": "Malware payload (Mirai)", "value": "0c1c418a41c8b80ad276f6c05b1eb8224ce1c2ed038acc7684f83e5b1bd916ceeadf5eb6d9d6d72b61cfb54ddcd540aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663835, "uuid": "57b105c1-693c-49c9-9dfe-f957e733b5c2", "value": "T124F48E6377218FA4E325D7B005F38A529B9422A20AF394C1937DD6147A50B6E2C1FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663835, "uuid": "d32f8863-d0ec-4475-8d73-67532cef462e", "value": "12288:4l4rwVAZnLQjcHIHMZSELpKIgpZlZes0z:4lVA1uHsSEIgs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767663835, "uuid": "ee1eebd2-614f-40fa-8f08-4940e8a0a89b", "value": 730136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767663835, "uuid": "80330da6-8a27-4a29-b07e-d816b742ab7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663835, "uuid": "e5d60ebc-b519-475a-8601-94f3eabc3da6", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86360cca-eae5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767693196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767693196, "uuid": "efac3e4c-b2c0-4302-a27d-e426532971b3", "comment": "Malware payload", "value": "f813b0b70d666d375a8d19ffc08868e8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767693196, "uuid": "1c59e1c3-8d12-4003-ab2e-851da6b7ad76", "comment": "Malware payload", "value": "39a5ea40acb8b2690a25020735d756896f25e87c50de9818a1e15c2e21566cb4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767693196, "uuid": "cf396234-f28a-42f8-825a-7e4b10ecb03d", "comment": "Malware payload", "value": "874312ac063a806265f8492fbe087c4196803b7c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767693196, "uuid": "3a2645c5-336d-44cd-b7e6-45ce91702cd3", "comment": "Malware payload", "value": "bb8fb70e18fd00cccfb0bc36727c25b425a77863c9bc4e707914be61e2df52aaebc446491dc6ff24c2a96efe98cad6d5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767693196, "uuid": "a99878e2-b3fc-4a28-bf48-3eb9f4b4e7a1", "value": "T11CE07D794A0C0EE2E3A3913468304A330701F9937538FA5359299451ED1BDB48E0036D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767693196, "uuid": "e9c603ab-3cf7-4742-bb6a-79bbcf2395fd", "value": "6:5jYpbkRDMIRvctaZv6/ifKwXzbJFg6RWN6UiRx0V3LpbQt+la:5jckA8BfhjlFs6j32xQtaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767693196, "uuid": "3556986e-87bd-4e7d-aeea-3239412597fc", "value": 344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767693196, "uuid": "d94258c1-179c-4fb2-af79-dc5d20cd4c9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767693196, "uuid": "8d898bc3-7175-4805-94c4-4e6dfcf31325", "value": "Rbc_document2026.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00afd655-eaa7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767666344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666344, "uuid": "e156f386-e448-4429-a2d0-27d86195970b", "comment": "Malware payload (Mirai)", "value": "b1f29697146cd964ab3d6c899e7f4033", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666344, "uuid": "f5f8568c-064c-4c31-9cf5-b02cdfcc0456", "comment": "Malware payload (Mirai)", "value": "3a5c4b184cf97a14200bd3ffd5749b142f2aef2784ec0b51260cb30b19c25a15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666344, "uuid": "1471331a-7de3-44a5-b8e8-22c1c07b660e", "comment": "Malware payload (Mirai)", "value": "cad846bb48de179d17b08194db0fc007c19b9f1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666344, "uuid": "cf96e8b0-9e64-4451-b974-569686af7a69", "comment": "Malware payload (Mirai)", "value": "686b0f3df21fd7148decef6e102b8d670b940b8b5378ecb9aeb4edd4f58d4414c5af65a32e38deeb96884f8dbf262d96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666344, "uuid": "51126f23-3920-453a-97e1-6621de2d481c", "value": "T1B1A34B4272280A47D5D31AB0253F1BE083BFE99024F4BA88784FDB568675E7B1586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666344, "uuid": "85dc8d65-f008-4f89-9375-00ba5dc0ae50", "value": "1536:SvBuOnwL9Y1+vY2sYktZ6mBPAF1zGNbWgjDUtuYIKWHdOH3S4uWz:Sj2VMZlHhYIhHwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767666344, "uuid": "fd5735c3-135e-4806-a0e9-d4889ae8b11b", "value": 100396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767666344, "uuid": "0fab8183-090c-473e-9673-2a4050db1ba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666344, "uuid": "f78faf57-c021-463a-85dd-a53245df65a5", "value": "UnHAnaAW.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203e9e72-eb11-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767711923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711923, "uuid": "0eb65b68-6084-401e-8682-5d0a67a5a82f", "comment": "Malware payload (SalatStealer)", "value": "39f46e57b88f6804b040f0ddf57d0f61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711923, "uuid": "223dec48-2e9e-449a-8655-d4ba4bca6211", "comment": "Malware payload (SalatStealer)", "value": "3aa7183d6d223a343a79db110fa4735b74820c38ac123cbdf28e1481b1027d60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711923, "uuid": "b07b82a2-dda6-4dfe-a015-cf1b7bbb9be9", "comment": "Malware payload (SalatStealer)", "value": "71abae997803a8a316f7f5c1a7d1d81a4e315989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711923, "uuid": "81bb54ae-7674-4605-8c38-3e3a11dae8ab", "comment": "Malware payload (SalatStealer)", "value": "966ed137f75c11eab154427a48732b7ee38f6c9c6e2b592329aa12f4ff040e46f005197bc7fbbf5b793c6c150c181f11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711923, "uuid": "dac8460e-9575-4637-9a64-a7b3cba0b2fd", "value": "T111C66A11FA8B54F5E9031839405BB23F67315E048B28DBDBFB543B6AFC77682192760A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711923, "uuid": "62307e1a-23d8-4c5a-9323-b6539a2b0d94", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711923, "uuid": "214f10b7-c9b4-4045-8ee9-4d2ffaa13bb3", "value": "49152:VOMrGn8NPGCh/QkJbiu/OkiulrEe0XCN2GIJWf3GZRNM+6f0RaUR5kIsErhA3h8F:8MGnaPMko3hQ4v32hS4IqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767711923, "uuid": "8aa7ef55-1976-45c3-83a1-f484b8d8b0de", "value": 11658752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767711923, "uuid": "f0483013-feeb-455f-ad03-9459e422d4c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711923, "uuid": "a22263da-aa17-4847-b52a-4e0388dd24d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff407c6f-eaa6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767666341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666341, "uuid": "87618114-a5b6-458c-8fca-5f3238fa9419", "comment": "Malware payload (Mirai)", "value": "987dc9e0eef92020cb110fe291ef570c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666341, "uuid": "fac5bab2-317f-4bb7-8df0-928f693ba7b5", "comment": "Malware payload (Mirai)", "value": "3bea19c9f4138766162ee56a5e35d78b0674a4b4aa750303e467ecfd47db0876", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666341, "uuid": "25cb126c-d270-478d-8e80-05f82cc40f2c", "comment": "Malware payload (Mirai)", "value": "e70987ecb8007c1394b9afe12cdb7a0375885035", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666341, "uuid": "d2627581-9a27-4209-afa0-5e92d84e9890", "comment": "Malware payload (Mirai)", "value": "fe26862edd5d915244f1d2959dc7371cd9a03cd60d26ed80157f7cbbc2ad02d864e9a52b2bb4716ad299e79315b1156b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666341, "uuid": "8d273d37-9f12-4bff-8eef-d91811b01318", "value": "T17593BFF2D469BED4C0804678F4F6BA751B53F00981631EB7A9C181A5508BEECFA293F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666341, "uuid": "fd591e55-52c5-4c14-a0e1-264a2427f6f5", "value": "1536:2aovb+klG+ZOwtAZmUytrF4/NjefXt7tKY3Ex7MFQCpMVNH3S4aj:2lXlG+ZOspactQYgMFQdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767666341, "uuid": "d0bac2c1-9a3e-4ca5-8bf5-7ec479ea2552", "value": 93096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767666341, "uuid": "398d55ba-4fcf-483c-b0d0-22a92197ff25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666341, "uuid": "60e069e8-f479-4ad6-bec7-b146f1630b9b", "value": "UnHAnaAW.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba68293-eb0b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767709500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709500, "uuid": "f2f73225-b616-4046-8454-686af9f0eee8", "comment": "Malware payload", "value": "447444a4e04d4f5e4894775b9dd56ba8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709500, "uuid": "0d3834d8-5379-400f-9807-b9bb2ccce9b4", "comment": "Malware payload", "value": "3c1245985e66da40a44cf1bb93fc2c7ff31a82127e946f8a8999031c648ba1e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709500, "uuid": "bd9e6147-44ae-4c45-8931-2b1377b827ee", "comment": "Malware payload", "value": "48d6d4d7b1db386ee6550ebe0e2636ace6ddc0e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709500, "uuid": "53b593d6-2cc5-40a4-b574-a874cefcb27f", "comment": "Malware payload", "value": "d4fb2c962f19db4448a409e4507fc54fed412b54a9599f5a20ba5bdceda1bbaff3115af33d99282b4eeafdb6be19542a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709500, "uuid": "2cff4fa7-a407-42ce-8941-1aee33d36b66", "value": "T16907725F464313BDA4A205B60AB6895BBCEBA9D23311ECE34C3A051A13D84F5C6FE5CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709500, "uuid": "bd41858f-41c6-4c2a-85c9-68ef1db54f87", "value": "2c9d6639101a1bf4d4ecf578834d31f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709500, "uuid": "4e9accc7-9564-40ea-8651-a00bf3f67464", "value": "49152:rz4+QrIqSn8MaAeoWFO7s1BQTtGuQ+9dEdnsfuph7xH7kAr/2XjHrpK7w3+6CWt4:lGpsMh3yznlL3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767709500, "uuid": "6611c513-58d5-430f-838d-366fc7174f65", "value": 17530880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767709500, "uuid": "3527aa2c-4dd0-4941-a2c6-99098d0d509f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709500, "uuid": "70baa2b0-69d8-4c69-8e0f-3897cc99902d", "value": "DeltaClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18e450c-ead7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767687256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767687256, "uuid": "7ab0f7aa-1025-4649-928b-5eecd2ed3ab6", "comment": "Malware payload", "value": "e346638891371b1b4820e0c1ace2c3e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767687256, "uuid": "43e4141e-609c-41af-93b9-0afff8fc9e6b", "comment": "Malware payload", "value": "3e60d9f6ed6039445aa0ab2e8c6a759fc786e78c1446a58ffb9efd7243560643", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767687256, "uuid": "07a8553d-5978-4ba3-8e08-ea5c85841411", "comment": "Malware payload", "value": "2e912dbe8dc8424ca1a6d58c877ece3b6d29cded", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767687256, "uuid": "1ccb4205-b004-40fa-9797-f5951af12a08", "comment": "Malware payload", "value": "e220fa56b4141e1945b928a3a3258f84d1660720ac6310db3d3b6236a10312445b1fd25a1352d895168c461c2e9249cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767687256, "uuid": "ed182dbf-e425-4fc6-a837-009de60a7ba6", "value": "T142E42388F8CB7C56C6FF48EEA249521A4343E894D448E4E2321BEFB07962D3CF917954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767687256, "uuid": "94adc45f-2e2e-459d-9e2b-8d2a9a2386dd", "value": "12288:YIUUmia0LNqvEOnewhragUjKXGgbsmmhSZzlH9c7/fIpsFNb1lCqTpbsIuioa/z/:VC3SCD5aVjKXpb9KyHK7nIgJtTpYIHz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767687256, "uuid": "850525df-470b-4d88-a23f-da4e1ea01a72", "value": 718727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767687256, "uuid": "f7e9b1b2-cff1-4691-9035-f768d51285a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767687256, "uuid": "9202de03-7154-4994-b118-5ebb5ad28e0b", "value": "bizy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e496f6-eac9-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767681041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681041, "uuid": "a0b5b5bf-eb81-421c-ad71-9fc812da9145", "comment": "Malware payload (SalatStealer)", "value": "b3e66b8877af22ca72aa202c78042bba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681041, "uuid": "2b2197c7-43b8-4a31-bf35-8bb377a1007e", "comment": "Malware payload (SalatStealer)", "value": "3f2c463e14339a12ca2b46331758af5f7baeeb7d0e02e2008052387f4c620aab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681041, "uuid": "91f5b423-87b0-4b09-84e5-26b612869a44", "comment": "Malware payload (SalatStealer)", "value": "7c5e2aa6cd5d162268a78dd1797f3bddcb24627d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681041, "uuid": "f35ed552-f610-4954-a311-ca00eeef79a1", "comment": "Malware payload (SalatStealer)", "value": "3f98dfd1c2988432b6b5a63c1750968f790e614543b3d61633ad902ff1e5cf232bebf6903838ad58250653953d53d402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681041, "uuid": "2dd1cb63-9efc-4ef9-bb63-6686e9a90701", "value": "T189C65A01FA8B64F1E9075871416BB23F23305C048B28DBE7EB587E6AFC776A11936749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681041, "uuid": "8d8015ca-3d5c-4d37-a6e5-8c58e3cd3e7f", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681041, "uuid": "d1428468-b4db-4b66-aaef-345acae40224", "value": "98304:VSrT/csWYAevaanoJJDt168B16CBNJ9EJpQbz6G:ecs7nsT6U16CPkJpQbz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681041, "uuid": "156c8e99-8d18-4e97-bd2c-a236dd79dba2", "value": 12472320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681041, "uuid": "425847d8-706c-4fd1-b969-1608a676c4fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681041, "uuid": "2aa596cb-5bc6-4574-99e7-1efd9702b2c0", "value": "start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4d80f7-ead9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767688217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767688217, "uuid": "4eaf7fd1-a038-4c1b-9bab-f3fab18593dc", "comment": "Malware payload", "value": "95fba7c318d846837b9fe14e86d7cb2a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767688217, "uuid": "1f96dfec-4475-4c75-ab03-3f045c3eeea1", "comment": "Malware payload", "value": "3f711f010ee63dd3a089cff847c5443a0bdd5d63c49e956e4d3bc5cb922f9462", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767688217, "uuid": "5546a027-2129-46fd-8659-9eab61e3bae7", "comment": "Malware payload", "value": "f4f6b3315740a55969b17bb5824880c1943e16e9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767688217, "uuid": "35fd227d-85a5-4226-9620-b763c884ff06", "comment": "Malware payload", "value": "6b417bcfc21a49bb856fa2499711a1ac43559f7d435b28d4b8434dc265b401dda4a63dced0525c3ea0ac8fd81616a726", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767688217, "uuid": "8319e8de-b5b0-4ad3-aabb-4140e09bf94d", "value": "T1A227CE77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767688217, "uuid": "8ff46b9c-7c71-4e95-8f2b-9b03c9ec21fa", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQw:cqYUQuVDt0TZEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767688217, "uuid": "00697317-d0b2-4efe-aaab-3afdb67cd53b", "value": 21135360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767688217, "uuid": "60ca1e9b-c6c7-4d2d-be97-fadaac9fe8e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767688217, "uuid": "d979109e-d2f5-4e49-a767-895840237088", "value": "tmpbv4iy9ka.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac64331-eafa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767702170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767702170, "uuid": "12de50a1-1af3-41cd-8e75-f4484b7c3826", "comment": "Malware payload (Mirai)", "value": "144f43f07829e7f9efc583d8b0d6e039", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767702170, "uuid": "b596a44d-9da7-4046-b52b-f64d23fd6fc1", "comment": "Malware payload (Mirai)", "value": "413b6ea96fcb76d4a00f67b35d63d0823b36fdf18fc18a8a8c5aadb2c357a08f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767702170, "uuid": "7164b531-e4d3-44dc-89f8-664f9f906c6e", "comment": "Malware payload (Mirai)", "value": "ededc71eae8a4f9d80502d3fc24eded0edda5829", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767702170, "uuid": "caef9ee0-3108-4e3e-ac9e-877efb057209", "comment": "Malware payload (Mirai)", "value": "ee14c783fc6918afe88798403a5bbe744a662ac3db75d66df9bbcd286dfcb59588023eb41b259cca9da20e088aa6928d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767702170, "uuid": "c616bc35-c34f-4d80-bd56-bc1296a5cf07", "value": "T118434A0073588D43F4AA1EF6283F17D483BFFE4112E5E0456E0EAA4A8236E735956F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767702170, "uuid": "51b1d859-bc02-4db9-93f0-854025e8665c", "value": "768:8Z7mYHm6RK0+PFaXgqkM+3xiWXRdIw33H5JTFYrPZV8rF6GHR1b03Ey20o:evHm6R+ANDRWhKwHZdFUdGHR1bGlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767702170, "uuid": "c3c6a193-1324-4188-9372-37c6d9d85240", "value": 58960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767702170, "uuid": "0e020e14-29d8-4db8-8a4a-962067b4c4e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767702170, "uuid": "9295d5f8-d435-4cc6-bd40-62478e5eca30", "value": "Fantazy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a696a41-ead6-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767686546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686546, "uuid": "61b4a78b-4d08-4e8a-8c21-93a45cb97c73", "comment": "Malware payload (AsyncRAT)", "value": "3de1e6b8f92bda6da1dd6c521710fd13", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686546, "uuid": "4c8358c0-35a8-4b06-a701-32d050fa8c69", "comment": "Malware payload (AsyncRAT)", "value": "41d28144eed4029547adcd484aed803beee6313dba18e1b6154c46bd08d4d13e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686546, "uuid": "8f852522-8d8f-42fe-b587-83cb3e855419", "comment": "Malware payload (AsyncRAT)", "value": "8bbbf46760e739cacbaa453547e6cf28c3f04886", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686546, "uuid": "91260842-9fd5-4117-a9f7-2a48333401ed", "comment": "Malware payload (AsyncRAT)", "value": "846861276090120b8623fe2f429daa993558603153d60abe0bc5eacd48f49a5acfe4cb7e9e76447ad3dbc46f6de10351", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686546, "uuid": "b039e82b-3039-4851-b9f7-f4a539327203", "value": "T196C21A0473F48262D1EC4BBE48339604D375E58B5D13DB9F6EC494AD2A23BCD8A25BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686546, "uuid": "3cd4e087-6f49-401b-81e0-4aade141b086", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686546, "uuid": "df5d2dcd-873f-4126-bd3a-52f559799d51", "value": "384:LQaA9XyfjjzgeRSQkeKwMymrJhxYHqqbuUsJQxnCJf+BWfXWi/fu+:LQzMjjE9Qke3MyCJhx+FbHBFByu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767686546, "uuid": "e2ac0db9-28a7-4e54-a157-1a15e414c2d6", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767686546, "uuid": "1f448915-bf87-498f-90a5-f2b50471b7a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686546, "uuid": "1e1cfb0e-4d30-495b-8f90-3e4be144e724", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9392af0f-eac1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767677757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677757, "uuid": "340d18b7-9373-4e24-997d-cd372374ba39", "comment": "Malware payload (Mirai)", "value": "3d4b0ea5b280fd3c4e199e7ad4ae0f86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677757, "uuid": "ab8019b4-f4cf-48ec-9208-b24b1db7eb0f", "comment": "Malware payload (Mirai)", "value": "44ae17d47e7923fa97ef43e7909f912448613e5517c403b77c73f3f6a80008e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677757, "uuid": "16883c07-d6e6-4aa6-bae2-87a90cbc6492", "comment": "Malware payload (Mirai)", "value": "ae5bde2f4fc94936db61338b3f65856caa17b378", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677757, "uuid": "e5de660c-2d6e-4b29-9429-cc12adb03d6b", "comment": "Malware payload (Mirai)", "value": "6535ffa4d935e6f26677eb0811304fef694daf82c492aed2791cac5289aed7128b7b09c00e8b8abca2bc9a8cad36cc72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677757, "uuid": "4c7202d8-8dd9-4ffe-a85b-e06afe7914d0", "value": "T1DBD35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677757, "uuid": "781d6c0f-795a-4961-b0ca-9f48c626a863", "value": "3072:79eSuygEPjt6qkWq2dKmDnYMb0gBd/gQyVGsdqml6uaj:79eSuygEPjt6qkWqNeH2laua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767677757, "uuid": "9517ba75-afc8-45a4-b0ff-00b644faf881", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767677757, "uuid": "04c10186-c902-489e-a98e-608b7c696001", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677757, "uuid": "9b2b51d1-c9da-4204-a901-6b700630c91a", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd925598-eb40-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767732427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732427, "uuid": "28fb7ff2-5a71-4d0c-84ce-2293c6527435", "comment": "Malware payload", "value": "08a67e17638002501b63b4e6a85ec3f4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732427, "uuid": "623e1b6d-9499-4f58-8e7c-c75f5a9f8436", "comment": "Malware payload", "value": "44eb3156de223938888a1ec48027555ee643d654bebaf6f79e17581f57a4086e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732427, "uuid": "c0488e7c-6a91-4796-b067-0ffd98a4ca0c", "comment": "Malware payload", "value": "795e7d70c3656f6cfffbf3a1a4f2240a99e04083", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732427, "uuid": "6f683f84-70c1-4b4f-a4b4-a0435290ac55", "comment": "Malware payload", "value": "144c740c15636d09fb9ac057ccd1b6ad9628b0f19c228c7f06c07761b50c9ac4e5da5db149270e3ce0eb29fe42ef827b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732427, "uuid": "3186711c-a01a-4317-b482-f9379ab9db75", "value": "T1AF852308B1D1C6B3C4F7053159A24AA59EBB30731B6664D3B7D853BA3F603D6937228E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732427, "uuid": "7a3a2420-79b4-4e3a-83b4-cb8589fc1010", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732427, "uuid": "13f636a4-e268-454a-af46-f5c6aa4ae7e5", "value": "49152:wkQTAdl/fiVOPaTdBTVc/Gf0cqH70ocKv35E3g:wadIV4edBTN0rHgu3WQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767732427, "uuid": "9c9fbfeb-1657-4e6e-be40-cbad42b61946", "value": 1824768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767732427, "uuid": "e156039a-d7b0-4dfb-9418-4526271dbef9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732427, "uuid": "8e39aa2b-5ae4-48c0-91c3-9a2ac11a8be1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385464a5-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767720983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720983, "uuid": "b1f73b6d-9b53-4bcb-b8d1-c5cf2571b194", "comment": "Malware payload (Mirai)", "value": "3487477662372f98a99654e4739d7a78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720983, "uuid": "263e31fa-b3bb-4eaf-9a71-cd15541ba3ac", "comment": "Malware payload (Mirai)", "value": "452d365314d50251d703517e2a94715132ba64756f1cf0b59a49ba313bf1d700", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720983, "uuid": "aed74628-5086-41e4-a32f-125a39b3a7e4", "comment": "Malware payload (Mirai)", "value": "9219d81a73f5d9df8c7851446c18a973616804ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720983, "uuid": "050d045e-9d39-4975-b85e-cecef84b520a", "comment": "Malware payload (Mirai)", "value": "f60f631e4c3cb0f8395f6434acefc2292c1e6573f36a42e10db63bedaf95d6bb683681556de07bf3c85325e50c0bbe4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720983, "uuid": "b5ef2228-df14-4a7c-8917-f6ccd2711598", "value": "T1E2F3292F358191F0FA411B746BCBD3A76C690BBF10A991DF6B416329B6E0B77A02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720983, "uuid": "431078e5-ddec-4c67-8fc0-dd749b443297", "value": "3072:ndEEHPByB9efe10gcNbYKcjUpFSdjh1l6KrOzNgsQmNdWySq655GQUXv:nujgYcgdtapGedGq650x/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767720983, "uuid": "9b6c482f-34f4-40a8-ae58-3ab8bfa342a3", "value": 172628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767720983, "uuid": "73fd7688-f9cb-4a7f-b7bb-8ca3119eba21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720983, "uuid": "299de803-c9de-49fe-9023-9dd6130a610c", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478b31be-eaa7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767666462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666462, "uuid": "fd9b08b5-1ca1-491a-b293-857ac3a81168", "comment": "Malware payload (Mirai)", "value": "b771baef856f6d022561a9af2ad03efd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666462, "uuid": "1691db57-4863-4418-bba1-f86d7cf1394c", "comment": "Malware payload (Mirai)", "value": "48fa95f97f8898326e7a8c5e1eedd0f7c6b5d1d854b57a26f5274c187ecd53e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666462, "uuid": "e1d85c6a-786f-422d-8144-14cb4f77cd0d", "comment": "Malware payload (Mirai)", "value": "390cd0aad1788e3ae93b275a7125a1a26faac4e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666462, "uuid": "aea0b69c-c345-4939-8f71-7704f498bff4", "comment": "Malware payload (Mirai)", "value": "d2b954ecc07a0ae98c53889ee5e435cb73d4af855f734e79ac1bb15a8f2ceac2e557cfc99497819cbb26b4df34a61dbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666462, "uuid": "b77bf479-52b4-4282-b318-f26005e8e0fb", "value": "T153045D42EA818A13C4D527BAFAAF01893332A754D3DB730699186FB43FC6B5E0D77605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666462, "uuid": "95c35bb9-0a0f-4243-aced-34aa8093661a", "value": "3072:Vhs23AUhRy9f8iyPhjQeQ42cvK4uwW+aaMPXnpVFYrXcCKTEnwzbsaM/9JwtVnL:VK23AUhRy9f8iyPh/QKBaaMPXnpVerMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767666462, "uuid": "25c607e1-474e-4c22-aad0-1fc20bba981f", "value": 189524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767666462, "uuid": "6784facf-2f48-46d4-8872-1d00f64a2a8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666462, "uuid": "a7b66e05-4b6a-45b2-acdf-cfb4364933c8", "value": "UnHAnaAW.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54fbddac-ea96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767659184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659184, "uuid": "2a3f9bf8-61ff-4a4e-af39-ce658cb357fc", "comment": "Malware payload (Mirai)", "value": "9c985f4cbb8fd78859c5de34cd266972", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659184, "uuid": "6bd81ea6-dd4c-4f11-a830-daab9ace61f5", "comment": "Malware payload (Mirai)", "value": "4b00825c4a597557b2abec74c5a03434fd226563db5f779871d5b7a79b60fe40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659184, "uuid": "4d5cd416-1076-42ba-a8f1-e59b74de1c14", "comment": "Malware payload (Mirai)", "value": "86473b00911424a5fdae8470ffaf8009f5774398", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659184, "uuid": "2633a8c3-484b-4a6c-81a5-e57d41287da2", "comment": "Malware payload (Mirai)", "value": "23229bd937f09e389c751dfcbe274f5ba4ad94fd5a85f767a1b922c520f0c4e2aa1aaf9aadec09ba73b786f5050bc4a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659184, "uuid": "42e8194e-4a9a-43f9-97ed-ec7583499602", "value": "T12713E889BC95CA56C6C55177BF0E42CC372603A8E2EE73439D19AF66765F82B0E3B440", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659184, "uuid": "73dd6288-a1e1-4fce-bff0-91ea0853d2c6", "value": "768:45xHpB3rNqW2gFynNIEmNThd8BipeAJtxnvJur7R:8HXdFAuBh18Khur7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767659184, "uuid": "92b74581-f50c-4f8b-be92-78923f45c191", "value": 42836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767659184, "uuid": "8b0ee602-eb6d-4503-9750-81600ed1e411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659184, "uuid": "89becdda-3f24-45ba-9ac7-a3d2da2c98a0", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712ad0cb-eb0c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767709911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709911, "uuid": "43297c27-1b9b-43b5-abad-d4aea21b502d", "comment": "Malware payload", "value": "6f411e6f43e363666d611f2ee4188b16", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709911, "uuid": "302cc2f0-c69a-4b97-8ad2-317f06b265d8", "comment": "Malware payload", "value": "4b82f29b17b977a42f08d4f47a505740a31be273ecd76f9655643ed5ce44bb86", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709911, "uuid": "a78bb4ce-b1fa-45bf-b658-140b2bf2169e", "comment": "Malware payload", "value": "34b4de93d8d3e5c405720b7e13d18708bfd3fe46", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709911, "uuid": "fcfcd610-f5c8-4851-8f2b-2781f6c6f55c", "comment": "Malware payload", "value": "0d58510be53b248759a917f8f9af3c54bb8f22353bbeaf49ab7b4643329a0bad247fe98ac5fd82ddefeadc62e766b51d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709911, "uuid": "eb8abcad-8513-4e1b-9ed6-22c0852596b2", "value": "T1213533916C5726F73FE3980F8E782E04EA899BB9D046F6EAD31BE45305E12185CD14CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709911, "uuid": "3bb54081-f16b-4660-83ff-a72a05096993", "value": "24576:hlnr6mUvxavY2MTNjzkPzlmmY+6bZCT2zblqoYyrtRl:hlnrdUvxZB6zlmmKdrdYyrtRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767709911, "uuid": "a79119f2-c97a-4b5c-b5d8-bb6171b3e6f8", "value": 1154644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767709911, "uuid": "2c207a7c-7ce7-45ee-86cb-b34bcc24b7ce", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709911, "uuid": "6d2aecc4-df2b-450d-a846-cf66f96f426a", "value": "Free 2026 Osint Tools.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80237aa-eb04-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767706567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706567, "uuid": "9fc7d690-1c6a-4326-97e5-b9a6d4ba71c9", "comment": "Malware payload (Mirai)", "value": "ed96585f649ce152d1eee3f6b1df47b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706567, "uuid": "d0f80d24-edd7-4bde-aef7-ef01a4392b46", "comment": "Malware payload (Mirai)", "value": "4dd95b2c87b7290050c038b98f1f87ce25d54c0d8b6509cb1fba146e9f662e74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706567, "uuid": "802c800e-5dee-4b47-96d8-ccf74c01b001", "comment": "Malware payload (Mirai)", "value": "0b6ef8c1d0a7e4d53d57ee235bee86a18999633c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706567, "uuid": "6f0866d1-bed0-4eb6-b818-e394a380e252", "comment": "Malware payload (Mirai)", "value": "e9950ff4a182d847c3a40338510c803e301ec9c85b808d6f707c849cce9edfa86c1e9aab74909bdb342c839d2b8be943", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706567, "uuid": "3007337f-8244-432b-a785-6cf0aeae22d9", "value": "T12ED47E9CFE4E3C42E2C7E2789E4E87E1B22771E0D72391A37582520CD5CA9D9CBE1915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706567, "uuid": "e46e4708-8ea1-4074-bcb6-a7eb420d809c", "value": "12288:EaSiWaYQTgMn4Z8EgUCMvwZSNZy1neDEJgEG8/V8SORXw5kXF8AT:EaxxYQThQCMvwZSXy1ysBu7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767706567, "uuid": "d2a976f7-3642-4d71-bac6-8bcaec571cb2", "value": 639952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767706567, "uuid": "6537e61f-1c17-4a02-b269-332c4030a2d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706567, "uuid": "25b13421-d3af-480e-98fd-476eaa0cabac", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0f213a-eb02-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767705714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705714, "uuid": "eaef14de-88e2-4225-85f7-02ad0f2e3ad8", "comment": "Malware payload", "value": "87cbc10054bc930e33c36a7427e0385a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705714, "uuid": "006454e2-5895-47ce-ad3f-801e9b73e5a7", "comment": "Malware payload", "value": "4de00dae20cc17858656e7d3a9ffb6d7991eb39679673fe7786cccb1555c2d59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705714, "uuid": "1879e86f-16ba-4db1-b335-2bf2a7cca8e8", "comment": "Malware payload", "value": "a7ef90ae35582a5be10ea92047be819dbba520cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705714, "uuid": "48099c33-c106-4e5c-a7cf-d4dc267418bc", "comment": "Malware payload", "value": "4c92a5ed04c314fccddb59068aa663276b2f5bcd0721f9a4bd4a79f570c15cb098c13355acda92f94ade3063792f3c77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705714, "uuid": "a7c35470-2372-456d-b23a-22e17fe6965f", "value": "T142123047A2D0CE3FC8D953384467122472B794BEDF629713064815B63F427E81E6EB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705714, "uuid": "34f31bc9-9a58-40e4-8b96-8740a2a290a3", "value": "96:GqTVJWWGXzS6SH5ML09V1J9G8Ymp+hrsrwegVekrf7mxaamBFBp8sBRnsH5vZAC:GqnWWHBZMWT1YmUhrsnurfjTr8sbnsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767705714, "uuid": "ef1d6e4e-2101-4bdb-93a5-4fc1a4fcad15", "value": 9800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767705714, "uuid": "ea32b4fa-a70f-4792-bafd-07fafae97295", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705714, "uuid": "2d67ef7e-d075-4ce2-b837-6cb3a20dc739", "value": "x65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a2699b-eb5b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767743829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767743829, "uuid": "1056ceeb-806e-40aa-935e-bd52d0092e41", "comment": "Malware payload", "value": "2e83025f040683fbe6b0b832e82984bd", "object_relation": "md5", "Tag": [ { "name": "cheat", "colour": "#4D0D0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767743829, "uuid": "005e3b19-347b-43cc-8c9c-2cedf04fa084", "comment": "Malware payload", "value": "500168c75e509c029f60d89f41a4ca7692c8d84d372dadb453044ac76c1c9fe7", "object_relation": "sha256", "Tag": [ { "name": "cheat", "colour": "#4D0D0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767743829, "uuid": "7c83ea38-7a04-4406-b46e-e05a73846ee5", "comment": "Malware payload", "value": "3f2b071d78180b9a034aa15bf79fc5353ad9263b", "object_relation": "sha1", "Tag": [ { "name": "cheat", "colour": "#4D0D0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767743829, "uuid": "bab9e52b-1013-4be1-8aba-1e0a32cc9d68", "comment": "Malware payload", "value": "002d4bd63bc2d7499aece77b154522dd474bb5218326136dc396e3576ba27239b1b09be7c10370415b486bc1254f8fcc", "object_relation": "sha3-384", "Tag": [ { "name": "cheat", "colour": "#4D0D0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767743829, "uuid": "7a67da7c-918e-4094-9a9b-bde0d4ef17ae", "value": "T1C4086C4262EB04C4F9F7DA759AE66617C673BC122F3095CF221C17291F336E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767743829, "uuid": "7c635793-4417-4f5b-bafb-022c1314cd1d", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767743829, "uuid": "d1d453b3-4ed4-44dc-bb97-db554fab803f", "value": "393216:by84WHCQTas4MEMMurULlv9iaVZhLqJvHoNYusIyNOnS0B4AycWMCY+m3TIuMHPF:bUcTyuSsJYqlA4oe5rs3wb31Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767743829, "uuid": "0c5e2bef-cb90-4b52-b502-0436e0ad44bd", "value": 83146342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767743829, "uuid": "c4a14cda-6a93-4a9a-8bb9-b0f604f720ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767743829, "uuid": "7ef47225-7624-42b1-bfec-e40a29bcbc98", "value": "Fireshoocik_GameHub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97451c17-eac1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767677763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677763, "uuid": "69e80f90-e15c-4d90-bd0d-b57539aa7a82", "comment": "Malware payload (Mirai)", "value": "05d5f1ac703f087f5bef2875cde34762", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677763, "uuid": "e29c2062-8bad-43d9-b60f-8a7115c49401", "comment": "Malware payload (Mirai)", "value": "518014dcfa5c71c360a464743c489a2fcc368ffa9ce73585a0dd4de2a183c225", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677763, "uuid": "ddfdefd9-6794-4206-8eee-83a194e7ab66", "comment": "Malware payload (Mirai)", "value": "825502f4ac1cdb01924f7ad53d6a3e2dd7173084", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677763, "uuid": "634faebf-5ee2-42e6-9747-799079454430", "comment": "Malware payload (Mirai)", "value": "39aefafeeaece5afd631ade147a67a3e5ad39b5e6b777c60e50ccce1ccfcebb64784cd0a5f7717c156d87b1d56c91dca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677763, "uuid": "1390a854-5158-434c-aab2-c277c594713a", "value": "T125042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677763, "uuid": "34f9c1bf-d609-4da6-aa8a-d24f43ec129e", "value": "3072:OzeSvtfD84oALv2eEQakGzORuGMzw99L5d38YhTfYo+M/RM+FDhdLn:2eSvJvoA7TEQakGzORuBGL5d38+x+M/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767677763, "uuid": "facd107b-6c98-47ee-8ea3-9094a4ee7cb6", "value": 181466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767677763, "uuid": "da0d7283-beb3-4413-839c-7465fdc8315e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677763, "uuid": "0de63d9f-9852-4a74-a26f-11c9b351f103", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1c1ce2-ead9-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1767687920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767687920, "uuid": "2232a65f-4437-45c5-b531-ff692421b131", "comment": "Malware payload (njrat)", "value": "833368e3029a38a4f87207acd537070e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767687920, "uuid": "92a1d046-fc22-469e-aee9-f0ed3bf80fa4", "comment": "Malware payload (njrat)", "value": "51fdd83b3737add7f3832bd0ad0b56863c0a8f7cf9bcc16fd787d1ae4b403ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767687920, "uuid": "67c98914-0872-47e2-ac2d-27cb2f2b3af9", "comment": "Malware payload (njrat)", "value": "599f80a79efdc584c70f4f763c663b06d432393c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767687920, "uuid": "eaeff739-c9b6-4516-ba84-91145c13b264", "comment": "Malware payload (njrat)", "value": "7753c7b12199e2869964ddb6b6a5fbf64132b5670cf548aa058a999b483dde088b41a8b13461d62e17399331d3a2d31f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767687920, "uuid": "59c9b479-6e00-45d1-8c50-f9e99b1654b8", "value": "T1AAB65B32F254AA77C09E173980AB8A301338825A4B13CBC756D499FDFD56AC23F7564B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767687920, "uuid": "38e9b4cb-db15-43a8-9146-e5b079306e3e", "value": "b41ac626c7b6ae6ac604f7789254aa7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767687920, "uuid": "1e72eb9a-52fc-43ef-b903-7aac40dfe7a3", "value": "98304:MLo4G2x0j6035YeeldVFR6Av3Nssa7kZGmm610wpDDAdj14:CocgTefNsxoMm53DIjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767687920, "uuid": "7433aa5c-1303-4bbb-a8dd-ca74a74d8735", "value": 10495856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767687920, "uuid": "6f78387b-f60b-4c88-8b8b-e307681a6134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767687920, "uuid": "d66d5813-6c97-4df5-a0fc-fd987d18325c", "value": "ComprovantePDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5d2a74-eb11-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767712103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767712103, "uuid": "83b9c40b-43b3-48df-b236-942b99ad20d4", "comment": "Malware payload (AsyncRAT)", "value": "b52e3c2679a8d70af276072f3b2790f5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767712103, "uuid": "861da8da-370a-456b-b84a-a276f2a74d30", "comment": "Malware payload (AsyncRAT)", "value": "5264ae16a10a482f4f9680d7bf96943c7e03d03f99497037dd70ee0ff27ef86b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767712103, "uuid": "0f2d9cc3-a631-4514-a245-556afca18000", "comment": "Malware payload (AsyncRAT)", "value": "661407bdeacc2e087e372de30aa2710a5591365b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767712103, "uuid": "70340f4b-254a-4fd3-af65-aca01dc74b27", "comment": "Malware payload (AsyncRAT)", "value": "61cc477a81ffc919d2ea73ba7b79df319285c5ec4795e75a1f8d72d1e0c274ba58055e51b3a6a4d3dabe7c65a0d1555f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767712103, "uuid": "50b29c1d-6724-4ffe-a904-c416d28a610b", "value": "T118C21B0873F48265D1ED4BBE48329200E375E58B5D13DB9F5EC494AE2A337CD8625BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767712103, "uuid": "a58e0d22-1ef6-43e3-b1d7-f4aa47f32246", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767712103, "uuid": "5dfd88c4-ba3c-45ec-9d3a-b6ed676715d2", "value": "768:kL5O5OXTv9nM19EBQkCMyCJhx2FbHBFBfu+:k160v9nM1QQXtIYFbhF9u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767712103, "uuid": "2a0046ea-fef6-47f4-9dcc-5faaacfdc40d", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767712103, "uuid": "2723187c-3ac4-4362-b61a-816ff9c7b758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767712103, "uuid": "b850f583-5879-4901-9e4c-0ead7cc22983", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8512fc01-ead4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767685893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685893, "uuid": "6be818a1-5104-45be-a5c1-1a526c3fb1ee", "comment": "Malware payload", "value": "e7fc1f913b8f9ca6c1ec09a8b09f5317", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685893, "uuid": "fd61669f-ddfd-4088-b0ed-50647f1579bc", "comment": "Malware payload", "value": "52c8dbdbb49a1df98c8b79b8e268e8e7c8c9c05aee6bf3fc5aecc0093e8627b0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685893, "uuid": "6636476e-f65f-4cd9-b261-29409101fbdc", "comment": "Malware payload", "value": "cd1be7c6d1b90ac9dd65d68c74848c196e153db9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685893, "uuid": "aadb1ecf-31c4-481f-a629-e217e8b8fed2", "comment": "Malware payload", "value": "bf27107750ecbb58a1196f1d0ce9d1a83122c9d85bde6ef042382865e7145c285bdca8b5b27c1891ea577f89c9216d9b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685893, "uuid": "1bbb4e5c-758e-43e5-bf1d-f9164b4d6071", "value": "T16AF02697C62DD1171797809C217514F8CD47E24DF0096825C590740F6C350F0EF80786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685893, "uuid": "53f45cfc-85cf-4da7-a05f-c5531f80319e", "value": "12:SQvDzYHYNWQTuGHHppLsd8XIP4lFPbGVvGHDh8O8XIYAHpwo8b:SQA4buGHJB24lFTXHDCfJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767685893, "uuid": "ed17baf6-65d6-40f6-8074-b18b7082720d", "value": 574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767685893, "uuid": "71c75a77-c34b-4ac5-8ecc-0ed84e1d4d6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685893, "uuid": "ea87c249-43e5-41d7-a600-123182b3cbe7", "value": "3.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf59bd4-eafb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767702655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767702655, "uuid": "c44a9b91-8ddd-436b-a865-f391af6b65b6", "comment": "Malware payload (Mirai)", "value": "ec287864f3989a2ffc43264b73740984", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767702655, "uuid": "6e5f42ab-c14d-485c-90af-82733ee066bb", "comment": "Malware payload (Mirai)", "value": "53248a1af7b93af8cc9f13867fef08e6f16712837f9ca5e2aeac8f24fbfe9bc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767702655, "uuid": "2da4829e-42d5-4d9f-bfce-5a69c1ca0bb0", "comment": "Malware payload (Mirai)", "value": "70ff02febdfb1e1ddcd6ce6397acb79a666cee87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767702655, "uuid": "b0f47205-7b36-4fa4-9e1f-2941b274daf8", "comment": "Malware payload (Mirai)", "value": "417090b168e676d384e3241174b0d50c0588d941129179ae3d512072856e2ff5153bbef4dca2870ddc52f3ebe80a4b2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767702655, "uuid": "9650f3a4-eec8-40c2-a292-38d611bbbb28", "value": "T1A35317C6BC40EA25C7C00677FE5F109E3715A7C8E1EA32029D296FA47A8FD1B0D5A619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767702655, "uuid": "5bcfabb3-ea28-43d3-98fe-1f0adbcb63f8", "value": "768:NFfIafP4LTH7zml/6jrA7u0hkermbANacd8UYyCQZydRU6SE4N0L3rOCd0RSBneb:f/34Lvi5mr3fU2/bhBpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767702655, "uuid": "915b336e-e5a0-456b-be9a-25318a6accca", "value": 62468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767702655, "uuid": "415b3783-0b11-4a5f-b0e4-b555528a269e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767702655, "uuid": "3c62bebd-a8c9-4166-b4f6-c2151fb81c0b", "value": "Fantazy.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89dc8b41-eae5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767693202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767693202, "uuid": "40510901-2b06-4511-8939-9e8a9cbbfa8a", "comment": "Malware payload", "value": "b2656c359c3aacba0dd7a7837c64fff2", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767693202, "uuid": "b2764c96-afa1-4c12-85f5-a5664794fcb5", "comment": "Malware payload", "value": "5332c97ca2df5c63bf5f63559b612216f4a4748e6e5fb19e5b98eefef9bba9c3", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767693202, "uuid": "636dc4fc-bb53-4073-9b96-feb5cf5ece28", "comment": "Malware payload", "value": "379a664413828e852c418d59760de1bbb794a8b6", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767693202, "uuid": "739ef75c-801e-4fa5-86a7-95cae4767eae", "comment": "Malware payload", "value": "e6cf7545ea0cb21cb0c7e0736b15401ac0b77ac0b2e68544e7e3405ec6f4e652c636f15bf733d835f1f399441ccdf4c9", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767693202, "uuid": "053ef75e-e9ae-459c-a938-c2b2402804ab", "value": "T1C5E012788241C04ED9723E3ABDE0BA11551DBEB548D3BB4C14A1D85619D11A6B44479E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767693202, "uuid": "44617211-9663-412f-a741-c78253f33a43", "value": "6:HRYFVmyAojGqsK1QBI6sBBArSDxDXt2YwGE54vVG/4xHy:HRYFVmtoj51QYBBArSlXtJfVW4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767693202, "uuid": "25a864fc-5c7c-4c9c-92ef-9972d921c759", "value": 296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767693202, "uuid": "49277a50-b03e-44b1-a4e3-5fbec6550521", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767693202, "uuid": "4083f78a-85e5-4712-838d-54188f3c16a1", "value": "Rbc_document2026.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f2106eb-ead5-11f0-a129-42010a9c0007", "comment": "Malware payload (SparkRAT)", "timestamp": 1767686205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686205, "uuid": "676add70-4e34-4ef0-9868-f55ff43c16a8", "comment": "Malware payload (SparkRAT)", "value": "e076cfc63a2ce972bf8db0f708551972", "object_relation": "md5", "Tag": [ { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686205, "uuid": "6bfc9e52-8654-46b9-8814-79688db2189c", "comment": "Malware payload (SparkRAT)", "value": "53635c2b43f8d87aa8305a1906b2b25dfb204637101bef51d7f734289d5513f1", "object_relation": "sha256", "Tag": [ { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686205, "uuid": "7b08a872-c751-4e5b-a5a8-5a3a6fa85f66", "comment": "Malware payload (SparkRAT)", "value": "396f4db4affbead9f8ed333d18937d290fa3a777", "object_relation": "sha1", "Tag": [ { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686205, "uuid": "f3f63fe5-e5b4-4030-bff0-ec8e61d30a55", "comment": "Malware payload (SparkRAT)", "value": "2d9b1cfff9638e613655773eab78c940d248f8a5c20dd31274d84fab65fa2276c5c284fc61b3e8b796ad5178c9801e16", "object_relation": "sha3-384", "Tag": [ { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686205, "uuid": "c56c074b-1dac-4001-b288-863db7b6ba0a", "value": "T18512444FFB431671D9738764A659680FE8B841630C780859F89C48A63F33799E6E09FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686205, "uuid": "02811c4e-788f-442f-ae9c-15afcc104d99", "value": "192:d6aWTcCvH0V/hnZ6/ii3/3r/bx/N/+k/hJjq/+I/V/9x60l/0FEW/0RVp+/+hFVC:d6aWP/0DZkiivhj10CEvVpDVrEYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767686205, "uuid": "f3ecafee-2d64-4d13-a0f8-043c93a300b8", "value": 9572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767686205, "uuid": "758891e2-6922-4447-ba64-57e097de3c3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686205, "uuid": "af6d68cb-8f02-4db3-8ed7-7fbd69224ef7", "value": "main.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1dc0f1-ead3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767685259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685259, "uuid": "82d9c900-2960-4044-b9d5-b8463c868fe3", "comment": "Malware payload", "value": "906097941c43c2bf916865cc390e95c7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685259, "uuid": "570ba019-e1f7-41d1-8325-8a019a731491", "comment": "Malware payload", "value": "551dc7bf7685563d5cb1ec9ef0027975dd76df49331148a346b636c5a565c083", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685259, "uuid": "ac1a9e73-1f91-409f-a91a-cc1b3957ed81", "comment": "Malware payload", "value": "e497b8f1d806c17328cffbb1d36eee85b3253a2e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685259, "uuid": "eba08422-9de6-4224-879a-88073387337c", "comment": "Malware payload", "value": "e314c8222b31c4a11871833b63f8b557b841280329e3caa71f51301002303815cfb9c9400bc1c81a3b20d88fa00b2788", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685259, "uuid": "ebec662c-fff9-4cf8-bfd2-88aa462e257b", "value": "T13B261854027EE3F8A53E515AED06625EFE2DB02E19A6084EB47F27C8CB15134CD13BE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685259, "uuid": "77eb064b-01fc-42e1-b302-b23e7dad2e54", "value": "192:W3CxYnYpkYC1YK7JWnEaAqOGSYsfl/+UJj4gYNjAD25YhY1Y1mdzfiYpY99SFNYn:5iB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767685259, "uuid": "3afa1a2d-cab7-4f01-ad58-04bc0b617ae4", "value": 4657379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767685259, "uuid": "2d7987fd-b955-4e6b-a0fb-1e935b349b28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685259, "uuid": "8fb1522f-58b2-4370-b97e-70ebb4791472", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3092a6-eb15-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1767713800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767713800, "uuid": "46c8bc2d-65cf-42dc-b3db-dda7eb144295", "comment": "Malware payload (Phorpiex)", "value": "659ae706a868b3f0aa9da9995fe5e24f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767713800, "uuid": "6f9b3592-0dfa-47e4-bc62-890a5c6ac7ad", "comment": "Malware payload (Phorpiex)", "value": "553972250e6766defd1125152eef38c0b8024e9ba2d65c5ca83ef1d04a1685eb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767713800, "uuid": "1cde6c3e-8e58-40fd-858a-380d5fd49594", "comment": "Malware payload (Phorpiex)", "value": "2f95d21b5f46da40ab387a78faa2291f33eb7f41", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767713800, "uuid": "e001035e-f083-4356-8b62-8a2deb1671cb", "comment": "Malware payload (Phorpiex)", "value": "08a051f7b985772202f2329a4f4d3aca6c747e818d1e3ab80a690dcd00f06b3c5ad910c88c9eb2110c33f5dc81ce8928", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767713800, "uuid": "3f422273-334f-421e-acd8-d9ca5c1e3dae", "value": "T1CFA2D7867609021FD0905A3FFEDDF7E6476817686290D0D3F6B264D905B878BBB2E04B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767713800, "uuid": "c7668190-62a7-4f43-b734-f229948333bc", "value": "ca5592c42b764400102051895df05794", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767713800, "uuid": "758a40e9-cff3-4fab-9b3e-ba4015cf1651", "value": "384:A+bmhnevgpWIZ/QKAZcUZI78u9zI2VRmgav8U9c+b:0PZ/TAbZI799Vmga0U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767713800, "uuid": "32cf92ba-6ba6-44c5-ad9f-7a80e37c6ac2", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767713800, "uuid": "d77e0526-a5a4-493e-adf6-88229705a5c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767713800, "uuid": "272ee696-83dd-4474-85be-3b3a3066293e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25910fe5-ead4-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1767685733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685733, "uuid": "c57acae6-266c-47d5-9f79-e2d733972dd0", "comment": "Malware payload (ConnectWise)", "value": "a340c3bb18af62843a9d4df711a9c39a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685733, "uuid": "2cfcd8ef-c468-4e19-b40e-9bdaf06bbfdb", "comment": "Malware payload (ConnectWise)", "value": "5b17f943852a6387ff38d516e94d9c42e5f8f54a37b5f55932edcd3f01c22a50", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685733, "uuid": "19385fcd-53e9-4931-ba4a-739bc0b77636", "comment": "Malware payload (ConnectWise)", "value": "f21f9e9dcd7cc7b14bc85e1c97ebc56cd9ed3183", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685733, "uuid": "7e44b592-2683-4d09-bc2d-5879a2f67909", "comment": "Malware payload (ConnectWise)", "value": "4b18f05620976bbb069995887e6e9c82ffcafdace72cf1ed58e269604256bb054eb7716730b777b5e09932d3ce38be30", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685733, "uuid": "53809e09-e795-492c-a733-6c843916a66b", "value": "T158C08C671DA8507608502A00A068EC8CF48FDE3A0458E40A70972D42C81707388273A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685733, "uuid": "5fab3510-38ea-41ea-956e-50a3aa9a090a", "value": "3:VUbvgbpV1OmIssssOjDETXI+D8UU0nGsUs+lNWEdKI1hHgCh2HAvs+0yHbn:ovgbpaNNEBKfnGss40RhHgFX+0Ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767685733, "uuid": "e6adffc5-28c6-45bc-8598-2d1772ac0289", "value": 173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767685733, "uuid": "971a7d9a-b385-4484-bba4-fc2952e98bf7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685733, "uuid": "ea3402f5-82e9-4ea5-bf29-8c388a17a3ef", "value": "Document_File-20260105104535.WsF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b01f3c-ea98-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767660072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660072, "uuid": "6f6d6dc6-c127-474a-bb8e-b88d5fb9d68e", "comment": "Malware payload (Mirai)", "value": "f33a7d57f03f2fe9e4b470a384986ce8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660072, "uuid": "dffd0010-0b64-44fb-89f3-3612c29bdcdb", "comment": "Malware payload (Mirai)", "value": "5c91b81cea3d4b735af6d386f4ab7df60c9c3276a4b6c3eb00fabd3918d6e4c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660072, "uuid": "f1625cba-a960-41fe-8947-bdeff6a6f0b2", "comment": "Malware payload (Mirai)", "value": "6029e54b6c18d7d074df1b326136ab345d9cfb9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660072, "uuid": "582b8e60-cb13-41c6-9f8a-869981c43f7a", "comment": "Malware payload (Mirai)", "value": "14914fc01c4e316aef9749a271ffd90990eb48685684a792ac57eb6e2db055705cd6605e1e21844a6902b6e7f084a23a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660072, "uuid": "203450c7-2094-4c4f-bf1d-a11a8885354d", "value": "T1CA233C99A401AE3CF94AE67F84134A08F631774521D30B3BA7BBFDC32D722945D56E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660072, "uuid": "e58d62fc-efc8-4ee9-9475-cac94ca2a239", "value": "768:2seiGH7iWe5MQbtpRRM9lblLaXfxXPAajT8zRGH:dTGfe5ftpRRoll4fxX4ajT8zAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767660072, "uuid": "efd9d65e-c255-4829-8709-0da1df585448", "value": 49352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767660072, "uuid": "ecaf31b3-0459-4399-bbf0-3a062dd1f158", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660072, "uuid": "b7f5670b-9f4b-4cb6-a78c-5f2499b351f4", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40f5133-eb22-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1767719580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767719580, "uuid": "5061bce4-592f-4503-bcf8-5a6df6a5b12b", "comment": "Malware payload (DCRat)", "value": "906179b55a6365636286b77544c056c8", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767719580, "uuid": "fa91c6cd-65bd-40bf-9334-d52ffea1d2eb", "comment": "Malware payload (DCRat)", "value": "5da9c9a1226470e8c0277dbe887edb326a3f02969d4c448e8c869099bcb350a6", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767719580, "uuid": "eb692da6-4f3d-462f-a3a7-669be83fafdf", "comment": "Malware payload (DCRat)", "value": "2e2a176fc8bfb176945f01ae49e9507138ae0260", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767719580, "uuid": "822ad0a0-2175-46f4-be0b-8ec291fc22d0", "comment": "Malware payload (DCRat)", "value": "fe32259798fe2d597d96589b3cab9081283309c989b3824d38bb59457841fd33810efa7c46785b2a686586ceb6b3d2b2", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767719580, "uuid": "0014ffde-4286-46c7-adc2-18580f43501c", "value": "T135535B002798C925E1AD4AF8ADF2954106B5DA772112DB1E7CC404DF6B9FFCA4A123FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767719580, "uuid": "718a9c7b-eb22-4209-80cf-01fa40a701c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767719580, "uuid": "4e55cb95-457e-4e88-8840-b485f8ca8737", "value": "768:S9gRaaZPiP9GBi49J5wJhi4N4lhMy7rM1+ZSCv7mqb2nGpwH1oM8Ko+5I8GxZVcD:SkZECUniltHM/GbbPwP3ZGxZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767719580, "uuid": "45ebb53a-a98d-42e2-9f13-3f4e6885c447", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767719580, "uuid": "114cf5ac-60f3-413f-bcc9-7066b1d1ee0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767719580, "uuid": "bc71a002-2a13-4b5d-82fc-341824920fd3", "value": "Stakelynx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f3cab9-eae5-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1767693307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767693307, "uuid": "cf68c279-de5d-4cc0-961d-2f47c2b968e2", "comment": "Malware payload (ValleyRAT)", "value": "97161661da86395c54721fdfb5ac5e12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767693307, "uuid": "b3df84c7-c4d3-4849-827b-7022886e7fa7", "comment": "Malware payload (ValleyRAT)", "value": "5e30bba83c9011b8078e7cadc05a9fc8892b1fe096b3895f92ee2ebfbf75008b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767693307, "uuid": "c3fefbf4-b93c-4134-b7f3-50ec8e13b35f", "comment": "Malware payload (ValleyRAT)", "value": "7c88192bc4ea3b31e633df40f1266bb30b1667d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767693307, "uuid": "d8675251-5f14-42d3-b68f-dc234d17a9bd", "comment": "Malware payload (ValleyRAT)", "value": "57015eaed0ba4798561a90b9c71473b0494b0d0af7b6712327a2bc84d4f1199479c6bf4a7ac7d83d5fc60cfa3656449d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767693307, "uuid": "ff7f093a-84f9-4700-9c36-0c27933cbb48", "value": "T1B1036B3738C68477C58285F1A8B4CF5B9F7F929503758893AA80A90A2D315F0E67E387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767693307, "uuid": "297b7e4e-37fc-4adb-9f50-f18db8a34f67", "value": "f4830b54a37d2b87187ae0df15d32cf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767693307, "uuid": "b2a5ab36-8c45-4ecd-98c9-a67e21948566", "value": "384:AzTn0EWb85YACaTANEUOetnYjLw3CPfVXywaJ6S5zd2thw6:mr0EWbdACaMnd4wyh6JJ552t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767693307, "uuid": "e99e0d6a-8d1e-46fa-8320-b1036260552a", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767693307, "uuid": "d6c22ba3-6490-4a13-83ba-0e57ffd7aa32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767693307, "uuid": "ebf38ddf-bd31-4ae0-9627-771898c47d2d", "value": "5e30bba83c9011b8078e7cadc05a9fc8892b1fe096b38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058d27fa-eaa7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767666352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666352, "uuid": "7df5e2b2-4875-457d-a8bc-9e55553d2c62", "comment": "Malware payload (Mirai)", "value": "907e705222da56a13399572fb8908346", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666352, "uuid": "2db0c815-fb71-41c3-b6ed-adfbb6859a5a", "comment": "Malware payload (Mirai)", "value": "5f036000c152c496bde24b3d8a639f89af2278300d4b7b65f6465d177e10ba9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666352, "uuid": "88ff3f00-6567-416d-9ea4-e8a569efa6c1", "comment": "Malware payload (Mirai)", "value": "855a88575c0ceb70273443ae1865975bb50b3df0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666352, "uuid": "f95433fd-592a-4940-9c29-5c8cf739c99b", "comment": "Malware payload (Mirai)", "value": "7a292758c8a2f972417cd48854ba2a18de1d71ceef8b1b7dee77ff9dac07e7d6f8a34c9deabad439c8468d343731af46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666352, "uuid": "494b8ed2-f57b-4ec8-b907-7583ab533191", "value": "T1B1A36B3279393A17C1E0A47E12B34B60B2F1575E25E8C51E7E720E4EFF24A502517AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666352, "uuid": "6a794b26-2530-4f13-90d4-187f391e1bf9", "value": "1536:q+TNNTsdVlV3Y3Aa5Uky0Sb6Nb3r+536Z6Y3tnNOKjPtkBkHCiqT5XtpHHiI5Rk:xWb6Njip23NNZ7HCxNRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767666352, "uuid": "02771bcd-cae1-49c6-ba11-707f38086848", "value": 104800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767666352, "uuid": "765c82f1-df40-4562-8f69-7bf234bba410", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666352, "uuid": "ab5ba33b-089a-4a4e-a681-cb2168563700", "value": "UnHAnaAW.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559d906f-ea96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767659185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659185, "uuid": "2d3ca72a-5619-4407-ab4a-e56be10c6edc", "comment": "Malware payload (Mirai)", "value": "6dd25f93be08af566b598ef1355ddfc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659185, "uuid": "73c1cba0-404b-47e1-bd7e-be18eb6ac954", "comment": "Malware payload (Mirai)", "value": "61230b763066a11fa837162bba2aaaaaef0bc62baec876d161b7eaa0cefc79b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659185, "uuid": "8075ed0a-159a-4520-a0f9-c0901e46f7af", "comment": "Malware payload (Mirai)", "value": "ae8c09403108592eeb668449dd2f0e3379e6aa95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659185, "uuid": "ba1bc1f6-1c3a-4182-80c1-4cbcb2d45088", "comment": "Malware payload (Mirai)", "value": "7b2b4b4a04181269a77a4e705e308157c166a813d85b7e1d5d599a9e77a0cab223de32c3bec7a85a1e7af7329e5a6121", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659185, "uuid": "cb4e90bd-2b37-4090-a51b-e7b75c83ff2f", "value": "T1EA337D6BC5B9EDE8D18C45B4A8228AB42B93B204D6171EBB1E85C9654043EBCF60D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659185, "uuid": "fcfea7c1-51c0-41ca-a074-cd236baee54b", "value": "1536:IafwtSv1o0ZemEdMkkT2kQUEzAiCl2up7R:IIP1l14MkkT2uEzAijup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767659185, "uuid": "0811264b-5e3d-4c9d-9ad9-b45ded2f6ebd", "value": 54136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767659185, "uuid": "26ca368f-95c9-4017-ad1f-86f345b6a847", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659185, "uuid": "11b3139a-799a-4334-8a27-d638b3dc981d", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92dde7ed-eac1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767677756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677756, "uuid": "cd13b037-97f1-4495-8d42-b1dc81b827b5", "comment": "Malware payload (Mirai)", "value": "6497278c0a76b3e73b8d5db76f2e896c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677756, "uuid": "592a25be-06b8-428d-b59d-f2b834a5cacc", "comment": "Malware payload (Mirai)", "value": "612e5efd070fe89073a2b5488049d8fa124b05778839a030eca74160443750ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677756, "uuid": "32843141-f354-4b8c-a48e-2f87d903d310", "comment": "Malware payload (Mirai)", "value": "61520833640fe4678e6c7cab669725d7df604b1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677756, "uuid": "4d6b9225-2889-4dea-8443-c4561793cb87", "comment": "Malware payload (Mirai)", "value": "288dc11463335c1795fa421ec5f6f1ee67881f244484fde147fd3d687112bd46f71de708f1af89f2271a0688bf64f8b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677756, "uuid": "e3f684de-5003-4149-8c4b-6640d7eb7be5", "value": "T133B36BB3CC26AF98C655D074B0B18FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677756, "uuid": "70679fcb-e875-41d2-8e5d-a0f7a918192b", "value": "1536:WTW/VCxsHZusj2Li62C8XiKTRpP/PVmAVoWWczTW+A1P7j:WytCxsjx62N1TbVmFWWMTbWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767677756, "uuid": "541628ba-697f-4fa6-8989-c95645a0dd9b", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767677756, "uuid": "99554155-5271-4381-9fcb-c21d7b43e374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677756, "uuid": "89cc3d5e-4d34-46b3-a412-2ab5799c3e25", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae8096c-eb41-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Generic)", "timestamp": 1767732664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732664, "uuid": "401ae7c3-fff5-40d0-b2ef-6e60685ac2d9", "comment": "Malware payload (Adware.Generic)", "value": "264b960e45aac8c12e51826a959df43c", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732664, "uuid": "acc88597-6841-4133-8164-c19ea74b0dde", "comment": "Malware payload (Adware.Generic)", "value": "6133ff53816061a7769b5dd2f0003f638ec89b33b2650173a9aa8b67323efba9", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732664, "uuid": "745282e3-d1ea-43c5-9b76-538a611b901f", "comment": "Malware payload (Adware.Generic)", "value": "69fb4f2d6b57f6b427519bd18417c74e7f011830", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732664, "uuid": "ec04cb6e-181c-4ed8-b874-e197f0882cdf", "comment": "Malware payload (Adware.Generic)", "value": "492c6eead6be15ec5c59feb3a194788dd9b1b2f63d6535ffd1ff13ac6049e8e451b15dec1941dff0023d9ac8a6adc251", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732664, "uuid": "c1a70bfc-1df3-4c64-94c4-77fc513c3b31", "value": "T1FDE633A17D0CEFAF18213764C3419E77138B29B4C40569A99D082AB2BEE2CCDB57DD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732664, "uuid": "552e527e-22c9-4d1f-833b-262068c2e6a5", "value": "393216:OLngi2qON/kdz6ePiRA1nl2TdSjdMnVEYe0QFn6:IVaN/o2bRgudSjfXPn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767732664, "uuid": "21211df1-7318-4482-9129-60b43c89bbb8", "value": 14700133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767732664, "uuid": "ca5b6f58-eec7-45be-bca3-622b23451425", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732664, "uuid": "b5057442-e7af-43c7-9018-b6f27e2c39db", "value": "SSA_Annual_Review_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3930d989-eaa4-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767665150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767665150, "uuid": "0dae664b-8497-4ea5-b30c-5046f11a2929", "comment": "Malware payload (AsyncRAT)", "value": "e9a7943474633ec31267d959e22734ea", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Net", "colour": "#889405", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767665150, "uuid": "a37fd36b-ef8a-421e-9712-6ed0232db356", "comment": "Malware payload (AsyncRAT)", "value": "6173f089ad3738d51f8df09d9e59bb732b01925f9192ca5c0c68cee2a09a994c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Net", "colour": "#889405", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767665150, "uuid": "7f3d7919-64f5-4ba1-a1dd-748da745a498", "comment": "Malware payload (AsyncRAT)", "value": "c6677d16c744f174b58a17fc35b740392626c4cb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Net", "colour": "#889405", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767665150, "uuid": "48c27425-da43-4973-8902-4131ec4df61f", "comment": "Malware payload (AsyncRAT)", "value": "82ce0bf1495a8b3e7ac109914738e2d8600e137b8bb0fbb4ff3996cc6b7850a112722013171cf5c2155049b04e7c26be", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Net", "colour": "#889405", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767665150, "uuid": "4a6d243f-85ae-455b-ae27-ebfe98f6d4df", "value": "T194535A002798C965E1AD4AB4BCF294400AB5D9772112DA5EBCC814CF6B9EFC649137FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767665150, "uuid": "77761491-0057-4460-b7f9-69946ba90fb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767665150, "uuid": "a51ced48-6c5b-46b6-98ba-419339dd1a9c", "value": "768:uyHAmMvlXiPhZ2i59JWoL1PaUzR3/C/refe1+KZSCv7mqb2nGpwH1oa0zKC8GPe2:uy0l8XvPzheZMGbbpwhiKvGPKYsVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767665150, "uuid": "e12eef09-16cc-42b1-a4d6-8efd4fb452dd", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767665150, "uuid": "4534caae-ba2c-48db-a287-a6b01412ee1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767665150, "uuid": "93f3d48a-1f46-43a7-913b-18f734b4d68d", "value": "AtlasNetworkFortress.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3818f9-eb44-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767733900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767733900, "uuid": "b6327493-04fb-4520-b06a-ef992285516c", "comment": "Malware payload", "value": "999069a4c0bd35dc009e07f9f03fb7a4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767733900, "uuid": "4be6404e-9894-4a6c-8c74-00630b8465a8", "comment": "Malware payload", "value": "62bb9eaee6544f7c7679d284dadf0e85eb228faf527171ddc524ea87baf63aa2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767733900, "uuid": "ce1e0b8d-d28b-4c1a-800a-70c6658ab772", "comment": "Malware payload", "value": "b4ef41376523fc7abf1dd57c32ad1b3eb91828cf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767733900, "uuid": "0945c985-6a47-45df-901e-3b0f1d5ec2ae", "comment": "Malware payload", "value": "2ef93d728ad2f24d08a8b6ac15771941ba6b554b7c80495e3afb8bbf3373568207fc3743d2b9acdf12e57207e52035f3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767733900, "uuid": "1f710e9e-c241-4321-a49c-8196af9515f2", "value": "T1BFB46D6AE2961A95E39363B0846EB6B6CF00F53C4873B6FAFF07D64658B30D05125387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767733900, "uuid": "47e70f9d-4578-449e-861b-cfb410b757f3", "value": "f32c33f4e17661770a68996cd0563e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767733900, "uuid": "4db70a48-dbca-4943-95fe-3d2810e02ce5", "value": "6144:dm32ADBHTUxzK4faRf6KGUa7jtJFipf+DRQqlR5vD+N+kxzMbC2EZU8JfA:dWxUxzK4faRf6KOZCpf+7U+kxz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767733900, "uuid": "711ce208-9b32-4c0b-b9a4-079c64fb734f", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767733900, "uuid": "082435c5-7d40-4ad0-a268-ad17cea8812e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767733900, "uuid": "51e7007d-f3c9-42c2-bf6f-2be9c4109084", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd7ad72-ea96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767659306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659306, "uuid": "89a7efee-a17c-49f6-8732-ecfb310fc1eb", "comment": "Malware payload (Mirai)", "value": "9293796b4ac40f21575c494d9995f57c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659306, "uuid": "83da41cb-9fa9-484a-9fe7-ecea110a9c2d", "comment": "Malware payload (Mirai)", "value": "63b39477f1d244c1298c088803bcfaa2794013b52c4a8f5c7be729f3269c3b38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659306, "uuid": "1f3fab05-6f91-4f48-8bd5-4c2a06ccd377", "comment": "Malware payload (Mirai)", "value": "d0b7a2929894a0c66dd60be363709d015b5187c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659306, "uuid": "e39e9f5d-5922-410e-b49d-f3ee088ff8ca", "comment": "Malware payload (Mirai)", "value": "68c0ae29e12ca37672f3fdea4e09b8e295297a67e45a438d71cff8b778dcece9779b93ec9090bc4a3c79aa66e43af4c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659306, "uuid": "12cef676-dac3-4494-9de0-c2598329e90d", "value": "T19783B71A7E22DF6DFB68863587B78F30D798239226E0C641D16CF9045D6434EA41FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659306, "uuid": "34e7fd4e-da4a-445c-a206-0c93e6cf4e13", "value": "1536:qpzqc2hc1Cp9j7hNxq+BlpYi5DUYo9fSTc/Tl9/TTmGUKFFxkur7R0wr:8qhhh3q+CixovUKF7kurxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767659306, "uuid": "8318842f-abce-4192-9893-bf21e6b2fe45", "value": 85132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767659306, "uuid": "c176fef5-3ddd-4385-acc2-1012ca75db24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659306, "uuid": "00e0743d-16f5-4493-b16b-617fe7da8804", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568fa8e5-eb04-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767706431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706431, "uuid": "a5f946f1-c887-4565-9ad0-aa70414ef6a6", "comment": "Malware payload (Mirai)", "value": "b39421359b8d03bc34ec9c185ae587aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706431, "uuid": "bdfdc34e-ea7b-4d78-9c52-c4c89c84a150", "comment": "Malware payload (Mirai)", "value": "643a0e670a950589b77ce40e752229a2771a43ffb62182562b6c7e83ce1a8651", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706431, "uuid": "fdc8c308-0b8e-4669-8bbc-816b9c5738e5", "comment": "Malware payload (Mirai)", "value": "36856b2ecc25a97274b320dc82ba3ead532cdcb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706431, "uuid": "627ef3bb-8ead-458b-9509-1347548a91f8", "comment": "Malware payload (Mirai)", "value": "b75c207e0dd1269f91d62e130ee3d3c22c8c2196bbf437868394dba9009c31f92f37f83cb38fe36bccea8e91a067f2d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706431, "uuid": "823189cf-8a4f-4c87-aa81-505b989c09e3", "value": "T13C433A07AD8486FEC0D9E17816BF7232D162F4BE2375764B27C4FE2A7908EA11B0D509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706431, "uuid": "7e4220c6-ab0d-4521-89e3-70da9eefb905", "value": "1536:CxnNmgDnnCMheFX2UOimBQ9gOSrFFIBgs:CxnJUXdOiIOaFIBgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767706431, "uuid": "c07a722a-f0f5-435d-ab1c-624b2dabcb9c", "value": 60192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767706431, "uuid": "44ee2996-5669-4037-9e21-e110c83385c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706431, "uuid": "1334c678-b122-4880-b610-407439e823fb", "value": "Fantazy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312f2542-eb46-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1767734715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734715, "uuid": "4746e02e-4ca0-4760-bf43-7ac4557b306f", "comment": "Malware payload (Stealc)", "value": "80d8096f22b764560687fe598837d826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734715, "uuid": "c1bbc096-d78c-403d-a69d-6d27b84dc23f", "comment": "Malware payload (Stealc)", "value": "65170a027c2050be22fc06e635694d410f2a4afe0c38bf3787d283a564f9ef95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734715, "uuid": "f4acce79-5c49-4dcb-9abf-0f6cedd960a5", "comment": "Malware payload (Stealc)", "value": "5b7444b829631367ce2e95921abd0764d73dc0c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734715, "uuid": "a6fa7950-d944-4b18-aab5-2979317ce933", "comment": "Malware payload (Stealc)", "value": "1747ed820b4c24ec590cc90dd61e71e87ec0508e029d6f01cf446ed48724339cdbf53f16d8b714c5d978b966bdeac479", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767734715, "uuid": "935ba7b9-09cf-4a92-97dc-53196a779ecd", "value": "T17BF48D1AE3A502F8D1BBC178CA626552E7B278055370978F03E15AA51F377A0DF3EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767734715, "uuid": "b167b036-f925-4640-a17e-cb6a828549bd", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767734715, "uuid": "7f04bdc1-386b-4375-8fd8-cad96c89eeb8", "value": "12288:qU8VHX4ZPBuvzkOkW7UE+YTRqwJ48Rv3YZtF15kjHeA:wVH6BuvbkW7xXVVm8J34A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767734715, "uuid": "aa750e7c-14c8-4a04-99cc-e26ab24ab8b7", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767734715, "uuid": "418ea96c-ee34-43b6-a4e4-34730093c73e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767734715, "uuid": "01c2b1b3-c480-46ea-b3e5-09d5b2d299d1", "value": "65170a027c2050be22fc06e635694d410f2a4afe0c38b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e371f726-ea96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767659423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659423, "uuid": "01bc5cb1-6da5-4182-9812-fc32e992d3f1", "comment": "Malware payload (Mirai)", "value": "c046898ef01d9768a0080f62892a92a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659423, "uuid": "83ba16b1-e9f9-4ab0-916e-e6b95be7983d", "comment": "Malware payload (Mirai)", "value": "66d07a3fd1dca4b6be646f74cca228674978489fce11f0b35c5732ec956cf499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659423, "uuid": "e667acb8-8fc9-4aa0-a288-2ea1ecdc8146", "comment": "Malware payload (Mirai)", "value": "912295635bc17e52065a4501db7af13ebf397419", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659423, "uuid": "159301e5-22b9-46f1-b49a-c1b02f6dfbc4", "comment": "Malware payload (Mirai)", "value": "5d6a669fcb054987f31664cb013f0f4a86ad977c5f73550284c2db52e25ce44231640f30e0f2ae76413c459cec295592", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659423, "uuid": "9076ee20-4b6c-4544-a751-63bafe885897", "value": "T1CE536E4232084A57D1E60AB02D3F1BF193FB99A021F4B7C9654FAB598276E331486FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659423, "uuid": "249e112c-14e3-45e5-a78a-149f4ec71597", "value": "1536:bPkQGUS+cxUfe/7z0YmYy9CD0Bz+oeF/vur7R6:Ef/XS9ioeFHuro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767659423, "uuid": "efaec49c-0c27-4bf0-b1bc-c41d10ccf519", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767659423, "uuid": "69f4b1c4-30dd-4445-9be7-adffa11ef00e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659423, "uuid": "ea65cd94-4861-480d-9b9c-0cfe7725e802", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270c5b4b-eaf8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767701197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767701197, "uuid": "de7da425-6538-4867-abfd-619db08e0c12", "comment": "Malware payload", "value": "ebc284b677b4022427321a4e69c2168f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767701197, "uuid": "37ec7aee-f639-4b9e-870f-3d79b1805491", "comment": "Malware payload", "value": "67b284aa3f121b963765d60fa5bd2ca4e9b12115f3bcf09251228ca154991451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767701197, "uuid": "fbe098d7-d4bb-4c74-998f-4e12868b7175", "comment": "Malware payload", "value": "cb45a16c1a736f62f687b41348cd08075b651b06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767701197, "uuid": "263d35f5-99c5-4cab-8bd7-8c9ed6326cf7", "comment": "Malware payload", "value": "3ec1f91585aacbe8092abba23a3b874369f6b817ab09230d796d88c8cfa309981698987067b5105712552518e7f6f69d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767701197, "uuid": "7c623c12-56df-4b07-bd59-569abe75773f", "value": "T1C33319953648C22EC26F0B7CA86247444E70DE429903EB9A3D8C78DFAFB7B054D5179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767701197, "uuid": "bd3db788-3b03-4be8-b635-a5f37206543c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767701197, "uuid": "3c8958dc-723d-4e90-b87a-a2f7d4b528ac", "value": "768:vCnWZWFTwL7wuikjZOqJdXzObf/dEgq14HYVXbYC1rkmOb9Thw9K:vOpwLXz/I32VeHYBbSmOb9Thn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767701197, "uuid": "7aeb8fa9-9c1f-4839-b93f-b41a4431d797", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767701197, "uuid": "d5b5cadf-8ab0-4385-a9d4-dba2fe15515c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767701197, "uuid": "b4608849-7cd7-4c94-afad-5ff3bf38c639", "value": "eszja_1.3.0_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e5699d-ead4-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1767686002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686002, "uuid": "f681a45b-bcb1-4b5b-a922-524700b74a56", "comment": "Malware payload (Joker)", "value": "2545e59681333cf4022b560cb1e91fbb", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686002, "uuid": "850b13f8-4211-463c-b9a9-d962ac7e5795", "comment": "Malware payload (Joker)", "value": "6807488f480f7eea7b9fbbe83040425125f5bfa63c1aa60271a1a4086185c86b", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686002, "uuid": "f8871ef7-73d9-400c-9a7c-c31e34daf446", "comment": "Malware payload (Joker)", "value": "4d57eca1045ecb8b6b67d973228b8bafb40ff2ff", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686002, "uuid": "d017852b-b7f9-459d-bfc2-7574ea49b783", "comment": "Malware payload (Joker)", "value": "04c9754b15376abb23506a8d3e17bc04db3334fcd767edefe9b5212cbc186d0c80b22872a424664195571bcb66bc9ef4", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686002, "uuid": "aa82bb49-fe41-4e80-9743-83cc38f8ae58", "value": "T1E1E612ABF38CA92BC43710B7CDA66132919E4E655F439B136508731C3AB35D48F6ABC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686002, "uuid": "436e2c84-a69c-45d7-835b-12efb83b1505", "value": "196608:VPCqDg3nNYCH5oObmYXrUFWW5WItW74m/+2lU9WV3eozzw9yrcQ3BMakSA70TF4Z:VPLgXNYe5/pUFW0tWsI+5nyWVSwvPeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767686002, "uuid": "3c4d0a8e-0d35-4c90-9da0-aa4f6f915ec2", "value": 15213587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767686002, "uuid": "fad364be-b30f-45ca-bce2-69f6a1ddca25", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686002, "uuid": "391101e1-39aa-4cab-a5f6-f0ae047a6df7", "value": "Battery+Widget+Reborn_6.1.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb85248-ead0-11f0-a129-42010a9c0007", "comment": "Malware payload (PureCrypter)", "timestamp": 1767684351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684351, "uuid": "4fbd8894-60ae-4281-949b-ae7e8f5ad0e7", "comment": "Malware payload (PureCrypter)", "value": "38a8e9fd90a1c263799e977af292673c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684351, "uuid": "3e3f0cdf-5cad-47c9-b0e9-bdbfa31ff12d", "comment": "Malware payload (PureCrypter)", "value": "68c44a84ed86a73471c5f238d8cf5896a1cf6ff10811e3670e4a8916eba534e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684351, "uuid": "7374bc53-956d-4cc4-8730-84ae87d1af52", "comment": "Malware payload (PureCrypter)", "value": "130e061919585bf5958d4f9342a6269992df1eed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684351, "uuid": "2822c2bb-4a8e-4cc3-806f-2afe3a2f2cf0", "comment": "Malware payload (PureCrypter)", "value": "ab92d0d97fbc45d18c375b83b35e58a01a51c132d252c0f7e4e8ac9f5bf1cb4ba150097b9e74fb78152ff96f0b8597f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684351, "uuid": "af786c60-e9f2-4934-9e67-579223b2acfe", "value": "T100742215E21C8E72C5C0CF3699EAE189657C632114A3E62FF91E037A1493B54CB9DEB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684351, "uuid": "95561004-7c58-4bfc-8a6f-b37b843eccfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684351, "uuid": "f2b5b594-541a-4c2e-b547-01930a011023", "value": "6144:mJdMpTyYmIZLRVQ4G7vLLBkDbx0CpciLnLVCsuSjhjGElB/VGgX++7cVjfc:GCGYmI1nOPBqxYaCMjMElBdGgXgfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767684351, "uuid": "135ec243-eba2-4c60-ae69-8c1e72478e5b", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767684351, "uuid": "ee781cd2-7ba3-407f-bc4a-cc50e406900a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684351, "uuid": "77907531-f8d0-4910-8a4c-af70394ae37b", "value": "38a8e9fd90a1c263799e977af292673c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7ff007-ea9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767662392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767662392, "uuid": "3c2894ae-1adc-45fc-acbb-9eef2483ff5b", "comment": "Malware payload (Mirai)", "value": "31b4343e7b9e85fe038a77e877371d60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767662392, "uuid": "ae5f6270-639f-48ea-bfc9-999eec770d04", "comment": "Malware payload (Mirai)", "value": "6ad50f7b647edbe81f003a8b5b1a29c70991dc82e456d70021bfbc6c32e89dad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767662392, "uuid": "e2ee12b4-60c8-4627-9d11-f516c5568847", "comment": "Malware payload (Mirai)", "value": "c10327b96c7946fdab1113c0598f73fa2d13ab3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767662392, "uuid": "976ad926-30a3-4abe-b05a-89fa7589b8f7", "comment": "Malware payload (Mirai)", "value": "a5930d11651fc5067cb29ab87da5296c19b95ca2c537fd758b71565dc9f1b5305e1629d45158ec67b5126b48577e96e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767662392, "uuid": "2c3726ad-4c53-43b6-9d6d-7c79502f8b3f", "value": "T18563E74AFD81DB15D5D525BAFF0E528C33535BA8E3EA72029E146F25678A82B0F3B401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767662392, "uuid": "0745ea72-49f1-4b13-91ea-b2190ecd56f4", "value": "1536:EJn56qdg/sFzLOHwe9dT151dbAzHoP+qdllroiTTNty5GRur7R6:kvdg/euHwePT1ZbAzHoPBTty4RurQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767662392, "uuid": "31b70e64-5ada-4c6c-867b-c8880e35798e", "value": 68000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767662392, "uuid": "c87d5bd3-501e-4792-becc-a3d410759ecc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767662392, "uuid": "f3e89519-cf43-4590-bcf4-6c488bbfcc56", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607d6118-ea9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767662639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767662639, "uuid": "ecd5eece-17a8-4656-b928-7fda16118f4c", "comment": "Malware payload (Mirai)", "value": "7dfb56482ab28e86ef638d5bc303ecb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767662639, "uuid": "64162cd8-9bf2-4571-bc29-700f4a46b7d9", "comment": "Malware payload (Mirai)", "value": "6afc4b419da0a95536ba1f34fe3fd37710434dfaadf337dd15e7fb2f4ff0834a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767662639, "uuid": "cd567fc3-24e2-4e08-b647-ffd80c8c3731", "comment": "Malware payload (Mirai)", "value": "c4ecf36a79e26dd9d69f6b0fc778a8bc96322e6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767662639, "uuid": "afd1d053-7092-4886-b7b9-809e2dae6dfc", "comment": "Malware payload (Mirai)", "value": "ab7619b65407c5606c18e5b4873fe25aef839932418f2a5ef30eccd44f33188a68d0262cd38c7fa145748bd3555cdb2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767662639, "uuid": "80634041-db7d-46b6-941f-02c18710cd62", "value": "T1A8930849FC819B15D5E922BEFE1E018D33535BA8E3EE72029D105F25378A92B0F7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767662639, "uuid": "b77cb4e9-4015-4dd9-a959-b2450bafa872", "value": "1536:IRnYCILxAw+j4WyzmqyGgs6DHwexuMc8wBAGSfmPSs3lNlWCiFGPIjXour7R:00xAf07yGgFDHwexuMc8oAGSfmPS/RGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767662639, "uuid": "3ee53af5-8b8b-4638-b643-3f829d3803af", "value": 91488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767662639, "uuid": "fe08737c-ec45-4e73-b193-6dee8ef6d07b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767662639, "uuid": "f6c9d60e-b56f-46f6-957f-ccf1784319aa", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02250da8-eaa7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767666346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666346, "uuid": "ff661bd0-6a9c-4b37-a6b2-4cc62ac8e0e3", "comment": "Malware payload (Mirai)", "value": "f76243521fe2d3aef38b02ffa7eb9ece", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666346, "uuid": "597e2898-eb5c-4a0d-8a60-5172530c9b21", "comment": "Malware payload (Mirai)", "value": "6d72c7a6415b4e2a36cb62a61e7745b3496b0eece8aa6b3a49c236c4ef0509ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666346, "uuid": "c76026b1-e78a-406a-9a1a-76036806fb5c", "comment": "Malware payload (Mirai)", "value": "3bf3c77af1135aa332a896e85b3b431182106554", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666346, "uuid": "f983e55e-5434-416c-a9e1-b17595191a93", "comment": "Malware payload (Mirai)", "value": "942ae77f2e27b7aabca966dfc88e99c007165d13c8295811f7a80bf1b73588463f6e24e0d7c20819d0b638011f058bc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666346, "uuid": "11a98e4d-2daf-48a0-9248-049e1d1fce22", "value": "T1B763E89278815A2BC6E023BAFABE51CD336167A8D2DF3127CC211B1577C951F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666346, "uuid": "6b21d3c8-5c03-481e-993a-b0681da1011f", "value": "1536:dMv9SClMtIFyfk19X98alMRF6SdZbsvyHIx/rEkHh2+IEkRH3S4:dMv9S5tB/Avx/4uh1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767666346, "uuid": "e9df35b3-7745-4139-a1b7-83ab09108404", "value": 72144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767666346, "uuid": "89d88c29-6ed6-4d6d-b83a-66ebced98fba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666346, "uuid": "d6ebcded-84bb-446a-9f09-6994a918cdd8", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770dc1ea-eb41-11f0-a129-42010a9c0007", "comment": "Malware payload (DattoRMM)", "timestamp": 1767732685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732685, "uuid": "f2774e44-406d-45c1-ace2-3abc1917b77c", "comment": "Malware payload (DattoRMM)", "value": "706d8a43ddce04eb7557a148a049be4e", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732685, "uuid": "d8650657-9dcc-40ab-ac42-aa0ea774bffa", "comment": "Malware payload (DattoRMM)", "value": "6dbd8948e140f172f5cafdd06ff22f6eba57fd9fcccc0916be69781de4bd314e", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732685, "uuid": "b2a3a29a-6d6a-4e36-93a5-37dc2d1ed31d", "comment": "Malware payload (DattoRMM)", "value": "2bb2a4696444ef997f3cf486aef36c7fade54a1b", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732685, "uuid": "02acfb85-9e7b-4e77-bc2a-5649a53ddf02", "comment": "Malware payload (DattoRMM)", "value": "5afca74791e9d7728e05cba4799ffd06d5db6592aba6ed14af10cf37ad9a607b7174d5004682b837edf296514d970741", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732685, "uuid": "bd00602f-9cd3-4828-9b4b-85466f985e08", "value": "T1EFB6330BED7B8EE4CB23077894A31907AB5341195C6BF08AF089623951D6CFEC9797C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732685, "uuid": "c23e17e9-74ea-496c-a498-d3c67e1795c7", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732685, "uuid": "23e157ae-2b79-432f-b781-8390cfeb450a", "value": "196608:paZk+wUNX02MyR1sn3+cvXR2sPFOsti7A95lGsFp29XaIT030Hy0RNN:NnUNX02xrmhvE7ANZp29qIT04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767732685, "uuid": "9183b6ac-7d11-4ca2-bf24-5de547eba81d", "value": 11056000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767732685, "uuid": "f05b099b-ebed-4bf7-9ed6-e989979907c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732685, "uuid": "a9b7f42e-4cf6-41ec-b830-7b92fe606ef8", "value": "PartyCardViewer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bc09a0-eac9-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767681012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681012, "uuid": "650d9b81-6125-40ee-b68d-7541af90c1fc", "comment": "Malware payload (SalatStealer)", "value": "0eef573a4cb83c5045013f43299f2538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681012, "uuid": "2e65ad23-3372-462f-8d22-643adfba92fb", "comment": "Malware payload (SalatStealer)", "value": "6f1b3efe7e7ba8f895fc9f25f269313ff0b83b4965bbf5d128fead17dd5f844f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681012, "uuid": "c3b26fb5-9c55-4492-abc5-74d20049c466", "comment": "Malware payload (SalatStealer)", "value": "6955e2f1e88f028ee14d422d2c968dffcf61e229", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681012, "uuid": "641ea62f-4d76-426d-90a8-110d6b40995b", "comment": "Malware payload (SalatStealer)", "value": "ab4914688cc061e23eb05855a096ba9f6b25481cf5d26d86fd0830f1718ce7e9a5e704d5c4b9eee04a6239607a30b69d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681012, "uuid": "125e163d-b09f-48c6-b3f1-7df3b9dc3d94", "value": "T17FE53387D17321ABF22D59F0AF87D384CEE7605DE387CA55C8E2790AB2FED566401A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681012, "uuid": "f781e7b3-7a4b-4c59-9d7a-a40f678f93d2", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681012, "uuid": "184e5f07-cae9-4475-9caf-4be1c4c4a829", "value": "98304:B61jHt2Guu2AhrWUVKVlNiult9lLYw/zj05In6x5zEiwG+zZ:s1rtj24MLz9ZYw0xx5zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681012, "uuid": "1c9a5b35-c15b-4bf3-a8d3-958a62f94cd4", "value": 3292160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681012, "uuid": "acf5cc6b-5da0-4d53-afce-f5350c03cc1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681012, "uuid": "53f4e4e5-a6d5-4bfb-9a13-17baacaa0f08", "value": "0eef573a4cb83c5045013f43299f2538.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7597d3-eac9-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767681018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681018, "uuid": "3d314a8c-48e8-421b-ad2f-a94f1a16ab54", "comment": "Malware payload (SalatStealer)", "value": "2261d16cc059c6495872cae7799826cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681018, "uuid": "2f06af5f-811f-4545-b033-9eb6fa4898c2", "comment": "Malware payload (SalatStealer)", "value": "6f39be5d98a3e9b0d1c3ef7874d9ca7a26c0ab25026ad220e8246bf0e515dde6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681018, "uuid": "fa19bb5b-1b64-49d7-9a8a-c1be956d10c3", "comment": "Malware payload (SalatStealer)", "value": "e03c41e337e430dba0a0027389845d56e8d05994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681018, "uuid": "e2542b71-0f9d-4132-9988-dbdeeab18f18", "comment": "Malware payload (SalatStealer)", "value": "ddbe32328273b9a7277dd69410c5da003c218335cffd2902d742680fe078efb1e51c0952a6b502e0f16ebd3b346d05a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681018, "uuid": "3c613e4d-fbba-43b5-86bb-54ce7c2c778c", "value": "T198F53326CD211F27EBB50632C5EBA5A698FA4E48475AD180D0BC4F38ADFC3D749BC064", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681018, "uuid": "e42bf2b6-3c9b-40b6-a353-ed8c4f5bce84", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681018, "uuid": "1b669a95-69bb-4ac1-b464-ef2826e3ce01", "value": "49152:oeUK9RomgfnN1ECiHh899gTJYGtmfpmCeWhoAuZjmCkTE+Cip3U6xWxDJqBZeVJe:nUerEnNdusmYsmf7R8AHw07G8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681018, "uuid": "a8f7805d-2046-4820-9be2-a0ae04292a4e", "value": 3559424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681018, "uuid": "ef5b29aa-aec8-45b2-9e06-86a66fa4c98f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681018, "uuid": "ad47b621-6cac-43e9-9504-ab14680904c1", "value": "start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593f900f-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767721038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721038, "uuid": "4a67bb38-c81d-4a63-afcc-d38f1224e70c", "comment": "Malware payload (Mirai)", "value": "7687708071dfbf05250d51e3452c984d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721038, "uuid": "bd695505-386b-40c3-9851-ea73ae97994b", "comment": "Malware payload (Mirai)", "value": "6f7b7083771c5ef38f5bf80cdf9fad56497b605d973b7f636c7a05adf6ce2fd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721038, "uuid": "3dbb3e81-a655-4a50-ab97-612bca22441f", "comment": "Malware payload (Mirai)", "value": "1697f8c4a30ff3173ee95dd20f578efa9f67ebdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721038, "uuid": "ff9c80e5-507f-49ce-89cf-92da46a2ed63", "comment": "Malware payload (Mirai)", "value": "362c666428075c2de3bea3d3593a78675b70b6f51e07e624e6ad20d458f9e35900659d8bdcd984a99aa70eec7b10042a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721038, "uuid": "64af6184-061b-4bbe-8da1-1ea99bb8ce27", "value": "T18DC34B0A78D230FCC287D131566EDF61AA36749C42183DBB9387AE711D36EE12E16F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721038, "uuid": "4c99ce4f-720e-4b0d-b1ec-84c065d0c524", "value": "1536:vKYP3dUXwT5hfLBjeOuR0YgsQkdVT7u+OHey1/HjxHPYMbVSl6/HBxnc3oJKCc9U:CYlBLFeBdzdxuL+y1Pj9Rc+yE1yVSAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767721038, "uuid": "da580690-d845-4568-8160-fcbe98a4a8b4", "value": 127904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767721038, "uuid": "da062b75-64ad-486f-bc7c-908b1b1e7842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721038, "uuid": "453334f6-6851-4d2d-a7bd-037ee02269be", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c677337-ea96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767659062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659062, "uuid": "f89f629d-e6b2-4410-b5b9-3e258de493a1", "comment": "Malware payload (Mirai)", "value": "e979cfedc6b995c6c87b5cd0633e194c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659062, "uuid": "57cecaa7-2eca-4938-aefa-effa55bc43bd", "comment": "Malware payload (Mirai)", "value": "6fbcb4518077ee6d9d7aaf141f510fa5f3891c256b042b91abaab7c74ad7df47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659062, "uuid": "32bb08cc-8ab8-413d-b8a0-7d061146c69a", "comment": "Malware payload (Mirai)", "value": "79453bfdd5a129fa0cbea7a372fe2d98ce0eb73b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659062, "uuid": "ea331a2c-4952-4665-b6b0-ad48aa2f5f6e", "comment": "Malware payload (Mirai)", "value": "79c7dfbb9ff22525ab1851760e728dde84e4333bf011d8bfaf7f95c6620897aec8798c6151dd5479831afdfed2ae5d65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659062, "uuid": "2df221c7-8740-4f5a-8c34-e6eda2c735d6", "value": "T1FE1329C59E83C8F1EC0A0976147BF73216F5E5795078FA9BDB95E931AD12302B20A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659062, "uuid": "40a61904-d224-4a63-b10f-246b794d8b66", "value": "768:gcZi+Fr7TgboQpAK7JC3KBS6+SpO6GdIEOx/BL5OQYR:RoITeoQ2KC3cB+SzGdIEONp5OQYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767659062, "uuid": "8805a332-3a74-4ea3-96d3-0e2288d71e31", "value": 41600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767659062, "uuid": "845167ff-ee97-4b32-a140-1ed392df794f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659062, "uuid": "b8cdbf9c-9894-4081-8098-74369993039e", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54baf26b-ead4-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1767685812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685812, "uuid": "d8278c65-9b21-42b2-8bd1-9f4ef5e602f1", "comment": "Malware payload (Phorpiex)", "value": "8bf379efd813e2b19e3c0abf2dc08f05", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685812, "uuid": "bd7d980d-8f39-46dc-8aea-4b384260ce42", "comment": "Malware payload (Phorpiex)", "value": "70a4afab44d6a9ecd7f42ab77972be074dec8383a47a2011eb0133a230a4fae3", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685812, "uuid": "30f1dc0e-943e-4ebc-ab6c-35b88233e208", "comment": "Malware payload (Phorpiex)", "value": "74c021250ef2c027deb141d8f8b35329de082209", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685812, "uuid": "ab682b61-86f8-44fc-a5d2-dfcb5b913ff1", "comment": "Malware payload (Phorpiex)", "value": "d23360295fc181a14491206c2988763bb9903d63f3723269340e2393e67e7ecfcd18fbd6bf396daf526265c713de4de5", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685812, "uuid": "f69e5bb8-65c0-4e4b-bb34-42540a98226b", "value": "T12541C1161BD64725D3F84E3AE8BBE71099A97C1AFB138F5D0181929818516149C68F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685812, "uuid": "33b12d36-e5d5-4a77-a547-e6dfb16ca98f", "value": "24:8VVJqMFXuvawAgqx+/ntSy9kerUMkWI9wCc5QgkgVBS9ZmT:8VemaquoyOerHypgkgVw9ZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767685812, "uuid": "c4913e6f-09c1-4d91-a970-fbb7d43ef79b", "value": 2067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767685812, "uuid": "fb67d5c9-9cda-462f-9717-babead33f6ba", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685812, "uuid": "4dbb1325-d273-4ac7-87c2-2c236e1c6a2b", "value": "Document.doc.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5086d9-eaca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767681447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681447, "uuid": "f75ea8e1-2846-4ead-abdf-ade36b30651e", "comment": "Malware payload (Mirai)", "value": "fac34fdebb0106839a8c7af5e66d9996", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681447, "uuid": "1195fa4c-b8a4-4fb0-a8eb-0be20571c2cc", "comment": "Malware payload (Mirai)", "value": "718079bef1b30346b6fe360894f06fb27557429fc05cd39ee09c9c534f90d7f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681447, "uuid": "e474803f-dbd3-498c-bd7a-26d9838b0a96", "comment": "Malware payload (Mirai)", "value": "604e54061175efcf74a466f19251a5d45d9f2232", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681447, "uuid": "1c28b6e1-eb3b-4bcf-a59b-8cab44110c5e", "comment": "Malware payload (Mirai)", "value": "58375082da80fe6a9c6894380e15df92f9cdf3a376e9e6fad4fded66fff28e4d5bfdbb22a8db2a67cc18bb00a7d065ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681447, "uuid": "9939c4b5-3c0e-4bc0-bb92-d0310c1a1ebf", "value": "T13B23F791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681447, "uuid": "830252b0-97c2-4351-9c34-90265390550a", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9TH+:5DmKF7Gxyk8cqoHAmWurAufsG5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681447, "uuid": "bd0fa4c4-3ad4-45cb-afec-41b6ce6aa564", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681447, "uuid": "02d3d7a0-cd75-4f5c-87fb-799c2d657fa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681447, "uuid": "c7f64a5b-31f7-4fd5-9c3c-b48f0bb190bd", "value": "d758ae90211a20ddbb11830dd76c46a6bb086354649e92b82e9a5d59a378fc49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a302c788-eafc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767703123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703123, "uuid": "2c1d934b-75c4-40da-a3c8-24b59063c9ac", "comment": "Malware payload (Mirai)", "value": "196d789c76a8863a9c366894523fb5dc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703123, "uuid": "f85a205d-06ba-47ba-9f6e-86fe4ef6b22c", "comment": "Malware payload (Mirai)", "value": "72aeae614832e86a2cee09e1077aefeb064a28c48c44f3acdeea9da94050b5be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703123, "uuid": "812ecb65-acf1-4035-a31c-1154e8a9ad43", "comment": "Malware payload (Mirai)", "value": "57d0bd116685ec0305722c1e5c5a4e6f79725c50", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703123, "uuid": "b90ef1e0-6738-4119-9751-3595317d52c4", "comment": "Malware payload (Mirai)", "value": "0e6ae90c5dc6b250ccd33d3844dd942f86afcd59db9c2df098eb5e6bb7513940421063ee342d1d40e245b748575667cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703123, "uuid": "01773410-081e-488f-8359-ee4827b86b9a", "value": "T10E01F989213634F37AE6D8DB4B332C1830E7546F3DA66CB87D65F8C612A5C01F0A2099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703123, "uuid": "22784801-307e-46b9-8ab4-993ed23e0600", "value": "24:ZDkH/FbxHFPHFuHFWCFX/FM5gFfKCF1/FMDgFfWeD:hOFbx9sDPPRW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767703123, "uuid": "cbee68c7-1cfc-4245-9da6-f61bb3f08473", "value": 771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767703123, "uuid": "aa118c4b-5885-4c10-aac9-6eaf0a6f9360", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703123, "uuid": "b03fd8c1-dd6b-4360-9745-bb52ce355ac2", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396fc825-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767720985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720985, "uuid": "2149d314-66bc-4508-8584-40155c1880a2", "comment": "Malware payload (Mirai)", "value": "e20d891bf895b7e38fe9483e9cae2ea1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720985, "uuid": "5acb12fc-7510-40f0-a706-dab9f9c7a37b", "comment": "Malware payload (Mirai)", "value": "734932c1c9858fb03d93db4910277ce092184aa5f83765e5a12c629472e957a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720985, "uuid": "b5793249-70d8-4ec4-b965-51c68057f0ad", "comment": "Malware payload (Mirai)", "value": "b0d6744be4655b1aaa6efe67e8d780f2f485cf6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720985, "uuid": "6f0d8d17-b777-4afb-b9d8-8ae117838ac2", "comment": "Malware payload (Mirai)", "value": "cc31e1d5b15b535c32be619f0d83be18d12f2ecccad0169cdf8009eedafb37e113fe4d6fa11fa3c11eaf975e99ba794c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720985, "uuid": "79268c82-4c8a-47e2-835f-f1dad91e1214", "value": "T15463011CA096B03BDE945CB5607826CEB3708804B0D7ACC1E26F7799A600DA756DD7FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720985, "uuid": "32db9043-6a10-4a77-bd9e-0f60950c4f21", "value": "1536:IxgCthwo69W9ZW6pxyiBILOS+H1szjKYMAaArPG:Iptt69WnW6pxrBw9IE2YMPArPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767720985, "uuid": "18993a4e-3055-4a47-8b66-fa4c4ac888b6", "value": 67540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767720985, "uuid": "2b19ef98-9dd3-4c5a-86f1-b4d119f8a5e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720985, "uuid": "98279fec-e32c-4da1-9d78-f080d439db3c", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0167cdfd-eaa7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767666345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666345, "uuid": "f340b361-e8fb-4514-89fb-8bb7fa58d6a7", "comment": "Malware payload (Mirai)", "value": "8ac5206d5f93b3fa10da133237f13037", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666345, "uuid": "74d340d0-64d3-414a-834a-81519621457b", "comment": "Malware payload (Mirai)", "value": "7359bd7fd183f1960ff6a7c19bbde0d6cc885cf8a122ab4af0aaf0f6f7f507d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666345, "uuid": "3e18ba1e-0042-434d-8755-04d1ced79b96", "comment": "Malware payload (Mirai)", "value": "9c41ad42ae54a060e86df524a6d62e02ff0a7b35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666345, "uuid": "4a989a3c-eb98-4b00-b3ae-51774e32b5db", "comment": "Malware payload (Mirai)", "value": "cdfc4dfe14ee360dbc881e42e2bc687e8cd97502234a5825eda86b4d84087ba540c04e57fcf83fa1bc88b03f7a4af217", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666345, "uuid": "4b18af34-bc65-4c5f-bf4c-23bddae8dd7b", "value": "T109A35DD6B8019D7CF85FDABB84230A09F524935246D30F3BA25AFD937C731A85E16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666345, "uuid": "31283137-b54a-491c-a5cd-122f08b5e1e4", "value": "1536:5176LVFAo7GLyI1xgv8A5oPNDFeGJZ9IbSXukpwV3MqqYKe:5176Uo7GLyAxglrGX92bUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767666345, "uuid": "0d9ae648-a058-4470-bf9b-53193a546336", "value": 104928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767666345, "uuid": "8d56aa68-6bf8-420c-b6f0-1ef5cc528ddb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666345, "uuid": "a743f259-6ad5-436b-abff-fff909a91f95", "value": "UnHAnaAW.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8aca24-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767721040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721040, "uuid": "ec56c92b-0a18-4151-8dd3-bdb2abeb9fa4", "comment": "Malware payload (Mirai)", "value": "a5e2e7d228e57fc2f1a500b29e3192e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721040, "uuid": "6f551491-a8bc-46a5-9459-29ade5120a52", "comment": "Malware payload (Mirai)", "value": "7410b22883fad7b0c57062e948116f4f028816fd002db5854e32a9c069078617", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721040, "uuid": "523725d9-30b8-43b9-b16f-4502332ae713", "comment": "Malware payload (Mirai)", "value": "69cb25efc4e016e4d1ae5fd8ec1353e5cb1c4f7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721040, "uuid": "360c4218-89db-43aa-9eba-fb806f722207", "comment": "Malware payload (Mirai)", "value": "0476bc670cd747c7c5bb734d9cfa05965e4e5ee83d33429a5fb2ce4b333385986b55416e017c32b0bb36428c7a746eb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721040, "uuid": "222c48cd-f7a2-40e5-9e05-c48531947aeb", "value": "T104146A16FB0C0463CA931CF04E3F4BF9A3621A9104F59112650C7F5A2A76D77A68BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721040, "uuid": "4d05573e-6ee8-4535-8ec0-22a0fe204598", "value": "3072:zHcoHahXmNMURpFtAs5OI3eQysit78ZF2UE0L/zBE+fkwfnq6UaS:Qc7MoOIuTftwZF2kzbswfu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767721040, "uuid": "6f0811c7-df9e-4b49-8262-c666483ae41b", "value": 197320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767721040, "uuid": "a9629036-2413-4fdd-ba3d-a389559a9a08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721040, "uuid": "49b0c684-4f9a-41d7-81d3-6beeb153b880", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4ad7fc-eb4e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767738274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767738274, "uuid": "c9496622-dae7-4bb7-8c43-c43e1b1dacf9", "comment": "Malware payload (SalatStealer)", "value": "db7542ecd65ae6a53d51dfc8a985b054", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767738274, "uuid": "b8db7aba-5e28-4044-8bd3-a4af38cede6b", "comment": "Malware payload (SalatStealer)", "value": "7549a0328d8872c55332338ae17f93fdeefcef00de72ceb946105c53b53ca662", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767738274, "uuid": "b63b9306-a67d-418b-a1ea-a6c278386984", "comment": "Malware payload (SalatStealer)", "value": "a9ee9f843f834e6b97bd512d2130dc2202e2d317", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767738274, "uuid": "2f5a4a34-1f7a-4255-aa43-6aa39a0cec4d", "comment": "Malware payload (SalatStealer)", "value": "bdc1282ebf2a7b8e580a4dccf6059d2021271c2cee9c9a981d255892c3f2f79a7e7245398dcb6630db850f7b4bbf9ad5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767738274, "uuid": "56720f43-326d-4b16-a011-712c49ec19a8", "value": "T145E533A9475220C0EFEA07F76A3BF9B4F23549A5DC4019E1004BB9FF905696EE379089", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767738274, "uuid": "7d33b6b8-bf70-4d1f-a2d8-5dd228f8dd18", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767738274, "uuid": "fd15d352-afae-4011-9ccd-210fa534a931", "value": "49152:2b7NVcN4gCo+x/ZDS/xXc7PR40DOU1eWrEVwKDD8BeW0qxI44XHoue2RnN5Lp3E:MhmNBCP4dcBDO1WrEVR8/01IufFhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767738274, "uuid": "28ae9124-a57a-4a8e-878f-d67258e5f450", "value": 3290112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767738274, "uuid": "bd99d01c-c508-456b-af98-92c415cf4cc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767738274, "uuid": "bcf242f6-c074-470b-ab28-8c94535c850a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec78a53-ead0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767684299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684299, "uuid": "7e12815c-a79f-4209-90e7-9730058878dc", "comment": "Malware payload", "value": "848f082c5bb18f2f00c085cfef949dd5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Credit Card", "colour": "#18719C", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "i", "colour": "#579900", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684299, "uuid": "f614f1e0-9f40-498a-bec6-8d8d4420488e", "comment": "Malware payload", "value": "76044f9de20943bae608b29a0f738a5406b4c108e2d402fbc3341af7e96e90a6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Credit Card", "colour": "#18719C", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "i", "colour": "#579900", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684299, "uuid": "b54243f3-100d-4b68-b266-2a2cd649191c", "comment": "Malware payload", "value": "6aad25032fea8dc87f92c841890edcdd8920038f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Credit Card", "colour": "#18719C", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "i", "colour": "#579900", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684299, "uuid": "f5e83b6b-4e76-4101-8b06-5995224573ae", "comment": "Malware payload", "value": "3df4e798dd434f78b652aa61ce0d97a32e901576bd20dac92e1e5a8a6c3eb52756a5a9412ee97a53d3a3af38ae878086", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Credit Card", "colour": "#18719C", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "i", "colour": "#579900", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684299, "uuid": "59428026-fc79-4e32-9108-e0c541a8467f", "value": "T1E917CF63F244699ACDE6A231E4E313D032260D514783A76A571FF136FDB31DD8E26AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684299, "uuid": "3271f27f-58ee-4ddb-91f8-fbcaeabd12e3", "value": "393216:PF4o7L+P+m/2Dq+v9Xo88mXJErpCudLQ70:R7S/qqG9Xo88oSrocLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767684299, "uuid": "843284ae-56be-498b-9ec8-fe4d9d8e7d7d", "value": 18674070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767684299, "uuid": "9859725e-ccf6-4322-897f-10abe0bb55ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684299, "uuid": "aeee2f5c-9f49-4e4f-82d3-86b7be6d5c7b", "value": "sbi bank credit card.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf13e1e-eb02-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767705715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705715, "uuid": "441dab67-88b8-4ab1-a950-6c3a98e4de70", "comment": "Malware payload", "value": "498555250698a9ebb1a77754f5b6f394", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705715, "uuid": "d16cd291-1882-4093-bc69-cf03b9ce5f9a", "comment": "Malware payload", "value": "76f233bbbaa94ebc815fc7f44de05a1ee2c3a7757cc841fa3b90897a6cdfe4eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705715, "uuid": "133b10bc-aa9b-4c5e-89a7-9ea3241ba310", "comment": "Malware payload", "value": "ef2de56fdf55558ae51ac5def9cab5f40b9d2774", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705715, "uuid": "55607347-ddc2-4fd3-a1e8-49904285b61e", "comment": "Malware payload", "value": "23cac6897dd1df867605c697095d38cbffc0dcd9f6a9192d2fbb0c4539f1a9b1c2ecda1871371df7220fbe0fb2c28bc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705715, "uuid": "f0ab6574-745d-40d1-bad0-25fb2cfe415f", "value": "T1FED533EA5FC606F093E37B5E43AA976197D38F531010016AB3CE5AB4183FBB76266311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705715, "uuid": "252ed75f-7046-4f2b-ad8e-19ee5f92be97", "value": "49152:sM/6zyU33rlPEvfJmowGoIiqaXVxvvIiQu4fABBVYEQVPDv:t693rlPefCGoIipXnnQhfABMZV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767705715, "uuid": "3ea0e665-41e9-43ef-9243-98cad5ca0ca8", "value": 2877372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767705715, "uuid": "8d66780f-4f0a-4d3d-ab2b-8649350f561c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705715, "uuid": "e222e3f1-73c4-47b0-aec7-6fa9ca58fbf6", "value": "x99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4025c7d-eafc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767703259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703259, "uuid": "56c14fa9-c154-4f10-b7b8-805e312d13a5", "comment": "Malware payload (Mirai)", "value": "75516c84b1dd5fc4536fb049bd636605", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703259, "uuid": "03be8d87-27ce-4057-ad86-2c0584d12bd8", "comment": "Malware payload (Mirai)", "value": "773fcfca925a9d6b311fc3f8d6f817b293ab7fce9b4371e9f18020f69be1a45c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703259, "uuid": "daab919d-b786-4322-a46c-bebe645f6874", "comment": "Malware payload (Mirai)", "value": "0e576a5220209950d2187c3e28d1a48fd3b8a219", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703259, "uuid": "f774c8f8-9fe3-42e0-8735-9bc0d46f4add", "comment": "Malware payload (Mirai)", "value": "dbb3eca416f8faa683ea8d17a0900ce63b7d8a1453c742306c1fa49d8c7a3ea60d2cb199577c331b4f2fefbf39e879ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703259, "uuid": "715aa27e-c703-4d72-a13d-8eb11d921608", "value": "T195434B782405F2ECF5A84178F4075DE52E2206253EEDE1E3B4435136BE76F88B86DE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703259, "uuid": "c6ab4a42-7e61-4482-8cdf-c7518c8a0ed8", "value": "1536:Lznro6bN0xPbiySVBIVCCfy0K9AVHD5y:LP7G5bMurVj5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767703259, "uuid": "29e37997-9a70-454f-bb52-bbd0932e585e", "value": 58756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767703259, "uuid": "270991d2-3396-4402-a1ed-5173cff95b52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703259, "uuid": "462a15fb-729f-4d7b-8c12-2129ce8e2192", "value": "Fantazy.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef824edd-eb2d-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1767724297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767724297, "uuid": "27531edc-6f98-49ca-9c4a-6d809b57446a", "comment": "Malware payload (GoToResolve)", "value": "11c4be3afdb16bfffb843567d74846cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767724297, "uuid": "2bb342f0-9659-41d8-8171-8d26339666d2", "comment": "Malware payload (GoToResolve)", "value": "77e22f4e1af7758d6f7284f32a92539ea36a527fa89c8c6765f10a3f98a8d13e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767724297, "uuid": "8e92a514-3e86-4af4-8c40-e789a4467b09", "comment": "Malware payload (GoToResolve)", "value": "b478f2279777f5b399d733c01e6ac49526e736bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767724297, "uuid": "f6554cea-65c7-4224-b962-7c9e9dd704cf", "comment": "Malware payload (GoToResolve)", "value": "c4426e9d834a7628842a264d98b0e1e0f6778d3280d3cba01afcdd18ab89e01fca80d95ba787bd623d8fc1ce4cb99b28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767724297, "uuid": "7125b64c-125a-4a1e-9e5b-a5b68139c26f", "value": "T11D37333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767724297, "uuid": "4f0fee65-a76d-4ef3-a8cb-33bfb42faa00", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767724297, "uuid": "dce74eb2-99d3-41ba-9e7d-26b29f02c7ae", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpD:q9WtLzgOTbjZvk/ekS/mcpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767724297, "uuid": "e079194b-fbf0-4fcb-aadb-766ba57f7701", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767724297, "uuid": "a315f8f2-bc53-4e1d-b413-220d839412e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767724297, "uuid": "fc7ae5a8-50fc-4ba4-8382-65f1af6aa347", "value": "PicturesPreview.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295780c7-ead0-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1767684021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684021, "uuid": "4c6a5aee-66b3-46b0-8074-bf890065ab1f", "comment": "Malware payload (PureLogsStealer)", "value": "230ef2f814ec1801036975f4c5859bf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684021, "uuid": "240f2ea6-bbfd-4e77-9b5a-28017de02651", "comment": "Malware payload (PureLogsStealer)", "value": "781b6211fe7e291d52cf690e3bbb508714f4608aa879cedc2a61199312dff91a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684021, "uuid": "987208b7-8397-4b86-bc86-f0152af65b5b", "comment": "Malware payload (PureLogsStealer)", "value": "b8d4aaf4ca26ab5feae6d3119a6a97172458b44c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684021, "uuid": "334593eb-8780-4bbd-b0ad-24a10aaf5dd2", "comment": "Malware payload (PureLogsStealer)", "value": "0a2cc7e5fa306cd0265ddfc53004596f46b08db79fbf58200e5d139d0baaf1b1f471f5741a43f108f4032d857a9b7dca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684021, "uuid": "5726dfd1-5a18-4588-aa6e-125ace27cdc1", "value": "T1B525282439FB501AB173EEA65FE8B89ADA6FB7333B07645A105103874723D81DE8153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684021, "uuid": "aedf9a1b-638b-41eb-a138-071184dda6e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684021, "uuid": "64d4993f-bd2a-49a1-acdf-0ec84b91b864", "value": "12288:deKjWIZubTzCEtAGcVdweMQMhIW7m+eJnIbqaP7C4Dq5MIm+3sdIF2zyYxVCOsq3:wWEtE8qUmPsZ2yxtFTrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767684021, "uuid": "d0b0d83f-f05f-4256-943d-afff5c162cd0", "value": 993792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767684021, "uuid": "d9cc39d3-2767-4732-a9c6-a5acc467eb87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684021, "uuid": "40a30721-05e2-4313-8197-7267bac982ee", "value": "230ef2f814ec1801036975f4c5859bf0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4cbb86-eb1d-11f0-a129-42010a9c0007", "comment": "Malware payload (PureHVNC)", "timestamp": 1767717341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717341, "uuid": "972418d2-1814-4021-af87-ffd0b203ad49", "comment": "Malware payload (PureHVNC)", "value": "c32a8f3e9f14984d2c76e62fa6c0b922", "object_relation": "md5", "Tag": [ { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "trojan.mikey", "colour": "#D7DF90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717341, "uuid": "f8319e38-549f-48f7-8bd1-1dc05fa717a4", "comment": "Malware payload (PureHVNC)", "value": "78812235341c0d2ef4c15c73c4f67284ebe05030a24e566e8ff911fe5d99d655", "object_relation": "sha256", "Tag": [ { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "trojan.mikey", "colour": "#D7DF90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717341, "uuid": "699e350b-2263-495f-9364-d336976d0eb0", "comment": "Malware payload (PureHVNC)", "value": "d860eab8baf649a7f8b6999f9c18e744f9cecd33", "object_relation": "sha1", "Tag": [ { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "trojan.mikey", "colour": "#D7DF90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717341, "uuid": "b3d86b10-82f6-466f-a87a-0f2da84890b7", "comment": "Malware payload (PureHVNC)", "value": "abceea9128679279191a418c629fb56e8942e289a2618ff7b916f8244956cf570d93214d5b896ea5841549a439c26a62", "object_relation": "sha3-384", "Tag": [ { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "trojan.mikey", "colour": "#D7DF90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717341, "uuid": "94d2b8e7-98f6-4e8f-ab31-daba4d102725", "value": "T1720633826EBD349BD03714B1B682C6E5659DA52C273EBD10EE58DE03B9FF284D316C06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717341, "uuid": "b438c107-c62e-4fe8-b569-5f34aca54e17", "value": "98304:RPsVfqHcdaxqT37zFb+t1xTH2hDN3DfRq6cY5QZRba:RPifqEagLzZ47SNN3bRfcY58Rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767717341, "uuid": "4ca67d72-cfbe-4166-befb-8fb21543b51a", "value": 4001612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767717341, "uuid": "f1407a33-e1b6-4bb4-89db-223a12cc887d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717341, "uuid": "cf58597b-d9e9-48c7-8723-b39a0dbd6e18", "value": "VOUCHER DE PAGO A LA FECHA_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a16082-eb0b-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1767709624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709624, "uuid": "e24a277f-c1a6-4478-83fd-0d163376dcef", "comment": "Malware payload (DCRat)", "value": "8c764fb55c98dedc1d19cc9ca8e7fab4", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709624, "uuid": "2c69f243-3132-4ce2-a1c6-c25ab040fada", "comment": "Malware payload (DCRat)", "value": "7938e7b6dfe01efb34a4186ea425fb5003c67b0637e6919800ed246e3e57f7f4", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709624, "uuid": "5ad9f6e1-3d16-43ac-a191-b9e0d845d428", "comment": "Malware payload (DCRat)", "value": "be1c42a5172d2c9dc6ecb101f8e92a8a29df46ff", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709624, "uuid": "e6d8fc59-31f7-4386-a085-36dfeab99c97", "comment": "Malware payload (DCRat)", "value": "d6a4e9c0d6f9ac29c8602f3677a2c22105fe6d408ef07646acc32d4ba09ba4a43c2d7fb245daf8b16256b0dfa0ae2985", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709624, "uuid": "824a5b21-c538-45d3-b944-31b4424b83c0", "value": "T182536B002BD8C961E1AD4AF8ACF2554046B1D5372116DA5E7CC804DBAB9FFCA0A137FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709624, "uuid": "a4c32002-4f4f-4791-9a0d-00bfa64dd99f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709624, "uuid": "19d65aae-790b-45c4-814f-a1a38bb8e203", "value": "768:rlmX5sI9iPcbhis9J8K9wUFw9BZba41+nwCv7mqb2nhpwH1ohZLCb8GHPzVc6KN:rRI+uH9Pe3b7xGbbOwwZeYGvzVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767709624, "uuid": "d0aebf33-a647-4945-96f7-1a782a92c13e", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767709624, "uuid": "45714a8c-02b0-44a3-8c9a-eef506cebd6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709624, "uuid": "d037c52f-96e3-48b9-9f2e-9eb2820e79f8", "value": "qq8875.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa950ddf-ea95-11f0-a129-42010a9c0007", "comment": "Malware payload (QuirkyLoader)", "timestamp": 1767659032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659032, "uuid": "6e0ed17f-9212-4d6e-a6ed-fddbc293d790", "comment": "Malware payload (QuirkyLoader)", "value": "c2aad31f818efa75e4afedc4ac65ba03", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659032, "uuid": "7e1134cc-3ab8-45cf-b1dd-6a4b68c3daf2", "comment": "Malware payload (QuirkyLoader)", "value": "793f8b08735a6c828bb689cc4af846eba66f5ae99263159c93d782cd53d85223", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659032, "uuid": "b4ef1da0-2293-4e63-8960-6ae0a106fa89", "comment": "Malware payload (QuirkyLoader)", "value": "4c8255847b112d56385add806653e2630d8f8937", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659032, "uuid": "da0e6ec9-2e22-4107-8d86-7bedf5acb00d", "comment": "Malware payload (QuirkyLoader)", "value": "6c31762679cd91a7e61d20fb40dc93825d7be3b1543af1824ab7fe46dd268254e40d799a90f07eca36dcd63e520ff1e2", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659032, "uuid": "40cb211d-7817-4919-88d1-7bc797ce0b8d", "value": "T1B655AE16A29811A8DD27D6788A626232C6737E074F78B1CF4659F3041E33AD6DB3F319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659032, "uuid": "226c1bf5-b6d6-44ec-a720-e600e9817550", "value": "079c0849227ef5aa7b4d20314b125612", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659032, "uuid": "8b731f30-802e-48b8-84bb-71fbf256460e", "value": "24576:cbXYPt7L0D0DZAsUsn0fnsPb81UU81jh+2Rg0GbWMvbeGq+3/iX:GXYPt7LUK2sUsn04Ktb5yGPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767659032, "uuid": "2a19c636-53b2-4c02-95f0-835fe4812186", "value": 1406976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767659032, "uuid": "fedaacc7-bf8b-4ac1-878b-0e996d301bdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659032, "uuid": "166a12fa-b261-4750-85b0-21c54c91b11a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34dfabc8-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767720977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720977, "uuid": "18cf87ad-a45d-4348-b1c8-594c1ff7d175", "comment": "Malware payload (Mirai)", "value": "0751401fdf31f0ba708a162c378e8f18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720977, "uuid": "392c0afa-46ad-4efb-9fc6-8849590e652a", "comment": "Malware payload (Mirai)", "value": "79497e3e24159102f108f6b5cf549764a1e3c3d5c15fc8fa0c4f7bbfc4c5d766", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720977, "uuid": "a2f92357-d7d4-4e0d-963d-9d961873293a", "comment": "Malware payload (Mirai)", "value": "c3b66af5c9f38e382111db9556168a8f399103a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720977, "uuid": "101a2fd5-301c-45b8-a787-ff616ec0dd1b", "comment": "Malware payload (Mirai)", "value": "aa2306822557d57b0c734c283ac74a84984d9b0c732bd32e220f70d7b76fa7b79551bf64bd7b91812bb74da2ff8a6c3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720977, "uuid": "9782ffac-498a-4494-8616-541983e33bd3", "value": "T103B35B42E6A3E0F0E28701701157F3EA8935EA305556CEDAEFA93D70EC71A825D9B71C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720977, "uuid": "f1d581d2-eaa8-4d11-afcb-95a5c5d94413", "value": "1536:l8WlFnRC8FzEoj1ds6vdCA0sQe4NiBa7+P9kRCAzUg4GMAIE4r931SBxJgC2Y7Rf:aWrRCji1Cr1sIexAUPAIE4rZ1SSCLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767720977, "uuid": "87e7c4d4-5eb8-4636-a513-ac54d6bb939e", "value": 115356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767720977, "uuid": "2f1952a7-a8e7-4c9f-9b97-ea52c42179c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720977, "uuid": "b773eb27-0ac1-4b04-9062-b1853f2b446f", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9cc5fc-ea93-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767658151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767658151, "uuid": "848bb936-d26a-4c67-acdf-93ab8fac1419", "comment": "Malware payload", "value": "97348f219723a4af9da409aa592b1bca", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767658151, "uuid": "93a240da-cd9b-4ec4-83bc-db4d3971a917", "comment": "Malware payload", "value": "7a09f8979f1c1acee848d8f5e316d285ac6805da6ba9ee276fca948e79b87e63", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767658151, "uuid": "fe4ebdf4-bb7b-4856-8731-b7f1d737ee83", "comment": "Malware payload", "value": "3acaec4c1f480e4b31568496f1bb8ec17cd53ab2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767658151, "uuid": "9f6139fa-69cf-408a-baf2-2aa95491274d", "comment": "Malware payload", "value": "de00fd342045ce276cad5130715e37929297a113a35de22f8a16705107c2888ed3a5ae974996e2b1ff1a15dd127a9cdf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767658151, "uuid": "fd7b84e3-9f3d-4ca6-a809-aaf643c5fb33", "value": "T1CBC63368A26084DDF8E3D23B694150D2B7F2B4245B31CADF07A852993F57BF24D3CA49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767658151, "uuid": "3dd4ffe1-21bf-42cd-9b6d-f5843000e825", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767658151, "uuid": "46bd3558-f24d-4949-8f34-9778bd2349a7", "value": "196608:5dUhg+2gTSJIeRo+jFgaIAjNyMzEltbW897GGr1LDsBTG9WdvWQ4a/R6:52g+4uSfdjcMo1N3sB15WQzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767658151, "uuid": "6c1e85f6-664c-4d7a-8efc-d56e41df6738", "value": 12226119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767658151, "uuid": "c74da098-df31-4601-87d2-696dc85e60ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767658151, "uuid": "e8296815-d6f3-4376-a019-74e9f4904ed5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e9e6b2-eb41-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1767732703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732703, "uuid": "3504ad3e-b7a9-4a19-aaeb-92cf5cfa4082", "comment": "Malware payload (ConnectWise)", "value": "26e110e15b0276b6b332788934234b29", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732703, "uuid": "397acb7d-b8ed-4e7c-9279-b6cde4c373f2", "comment": "Malware payload (ConnectWise)", "value": "7a959e76e2b253ab56cb02ecc6a1baf3f5135e09d1f133b776f094dae395de66", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732703, "uuid": "3fa29db8-7573-42d4-856b-b9fdd8d6a9f8", "comment": "Malware payload (ConnectWise)", "value": "06928e75b6a5690630782c82c7369994347bd247", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732703, "uuid": "e53bdd35-5cd9-4e59-a714-35ef4e239351", "comment": "Malware payload (ConnectWise)", "value": "c4e8c2c27840fd798be7c50a737a79f8193c7e995a57124d2269955b5269752bc71f912756c62b64929c82da3a5df9a4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732703, "uuid": "409264ad-737a-470c-a6b1-889dadaee14c", "value": "T18BA6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732703, "uuid": "5b416fc7-6ff7-4ae6-a8ea-19453ac4edf9", "value": "196608:JKaLNkbgmi4QEKaLNkbgRKaLNkbgpKaLNkbg:tWgmiH6Wg1WgNWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767732703, "uuid": "41276009-21dc-4bae-b6a1-8319fa5531f9", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767732703, "uuid": "6c23c37f-03c0-43bd-8db9-9f062e4c6590", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732703, "uuid": "414aa61a-9900-4909-801b-6d605bc82f34", "value": "partyinvite.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd11b94d-eae0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767691141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691141, "uuid": "659a1d05-2841-4d86-b56f-62263796d3ce", "comment": "Malware payload (Mirai)", "value": "f85b619d5f4df18d1c38899ef535cf18", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691141, "uuid": "3b67c8ff-03f1-4357-9702-99f354bad76d", "comment": "Malware payload (Mirai)", "value": "7ce7d4666f0a7e9d8ff6376471a9401833c9121ee61e883c408e31769e0f708e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691141, "uuid": "53940b77-0001-48f0-a05e-d08464c00985", "comment": "Malware payload (Mirai)", "value": "061a9f3511622891b6f1c709579c2902eda0c622", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691141, "uuid": "542f453d-708f-40fc-b452-b87b82f90553", "comment": "Malware payload (Mirai)", "value": "762adb60a31b426cc0b177b87174c0e4f37c3e2783b812b1a1f407897e2c9669ba41dcc888e00454b8c4377f9dcd6c8e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691141, "uuid": "80f848fa-3079-4339-8d24-459abc698e58", "value": "T156012EEF70505622168C8F8062B39028F94588E1AAB11F6D6E9C08F15FC6B28775DAB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691141, "uuid": "67e9d3fb-c8d1-40db-8cbb-b99ac760d135", "value": "12:cgyOgy3JBgyhNIlvgyq0LKLkgAObdgkbgW0gjcgWtTgD9gMygUCA:cROR3JBRhNIVRxKYbanbZ0CcLtTGlyKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767691141, "uuid": "f8eb79f2-b8e5-48cc-b8c5-754f0456950c", "value": 853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767691141, "uuid": "33494338-26df-4ff2-baf4-9906edcf87ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691141, "uuid": "0425bcbd-456f-4a4d-b224-7c8b7ba02578", "value": "7ce7d4666f0a7e9d8ff6376471a9401833c9121ee61e883c408e31769e0f708e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03869490-eaa7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767666348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666348, "uuid": "e10befc4-ab8a-4340-bdaf-8ea301db4874", "comment": "Malware payload (Mirai)", "value": "179cedbb1821c69732b13de4cf8adf23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666348, "uuid": "26d9f9df-8092-49cb-a03b-b0b791170e08", "comment": "Malware payload (Mirai)", "value": "7d5ee1b8c726f814b974ce4e2926c5869c75f1d2bd17ca38178b4000e55652e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666348, "uuid": "63d99a1d-50b8-49c4-bc70-28641432d62f", "comment": "Malware payload (Mirai)", "value": "9c1d4cdeb596ba59583a7e7db109747e5f16a8a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666348, "uuid": "80200342-a3e0-4a67-a674-96c5bda6ca62", "comment": "Malware payload (Mirai)", "value": "5715684173f05143141ccc11b35b8d3a87c853d68efeb48ef390b040e9aa0a0edd5d96f42dd5ded35029f67418cc91fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666348, "uuid": "068288e1-d16b-4b81-a0a5-8f1f46656e0e", "value": "T1C7936CC1A643E9F5DC0606B62173FB3786B7F07A1129DD87E398AD23BC51A41940B2DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666348, "uuid": "c5d135b5-8180-4ecb-851e-6b26ba636aad", "value": "1536:705KPx7BQclXXKqgTiWiUNShnOPLtI4gRViUc/kSt5CvveXSsvljarbwQm3WC435:7JptLZnOPLtI4gRViU6kSt5CvmXBvysY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767666348, "uuid": "fcb80f71-a4ff-46c0-8cbf-2e410546cc63", "value": 91216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767666348, "uuid": "976884d5-72d2-4d51-b612-cc5d00f1a20f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666348, "uuid": "6e874046-1cd0-4cc7-8789-d6a047cf63a9", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d469ea-ead3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767685279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685279, "uuid": "0c0a1276-16d6-49d2-98f3-60c0d580f139", "comment": "Malware payload", "value": "2c6fcdd23df98f7d47ff318e70c8a905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685279, "uuid": "aa26d30f-9142-4d20-9dd0-17cf5e3bcb1d", "comment": "Malware payload", "value": "7e058d5f5323a0ffd516b829a9a90ded0f7864301b59d0426060f3f2aaaf6b2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685279, "uuid": "f06f656d-4876-4b47-ab8a-3741ac12a234", "comment": "Malware payload", "value": "2b3919205d4a721eb79a6d9e434ab33ef038f39e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685279, "uuid": "7d37f4df-1e4f-4bd6-8143-ba9460c70dec", "comment": "Malware payload", "value": "a82eb98d739619fb4be7258ce0da366ccd551efb64f99e0f3bd4fc43c77125425055558f433a0aad8aedb96b83c6c8c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685279, "uuid": "7bbb7156-3e5e-48b7-9417-ee9d4ff27353", "value": "T1CEE269B4E6D5D0F1FA4541F006AA27F7B17DEA329358A8D3C7725CB09812BFA417908C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685279, "uuid": "a8a38cf9-c7d3-45da-90fb-4e9b60251788", "value": "768:cdm0jKJM6UnEK7oT6C7elyRyZfooQreF/XRFJIKKTkszKU:oi0T66fUydlX/yK0ksF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767685279, "uuid": "d94cdec1-14b1-4de3-913a-0ea46d194206", "value": 33944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767685279, "uuid": "2c172410-a106-4c8c-82f2-01e8ac542978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685279, "uuid": "d262f597-1770-40a2-b34b-3eff0a1bcf2f", "value": "Video.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0dce568-eb0a-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767709159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709159, "uuid": "f96f8884-ddcb-4a23-9487-8b93c36fbed5", "comment": "Malware payload (SalatStealer)", "value": "779b2ac33de34bf493b03a09da653552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709159, "uuid": "6e0b442e-4f61-484c-a7f2-680ba9fbe04a", "comment": "Malware payload (SalatStealer)", "value": "8195866ec567435d173a518b069c861fb3ef0e2fb8e8c37d33f6e898d1c37c7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709159, "uuid": "2f3c3b4d-34dd-4cb6-9a80-a7ae361cf126", "comment": "Malware payload (SalatStealer)", "value": "00e9b27eb40307ca8a0c10f5529349d2f2a9a228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709159, "uuid": "02eba928-20ac-4500-85d3-120f734830d8", "comment": "Malware payload (SalatStealer)", "value": "334f6d3f03c4e32813a62b00029daba26e21a54bd08257112f7cd622ef709f40acaaf7d4ca3f5b91351b71fb3fe62e5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709159, "uuid": "f09e0aa7-7f61-4251-bb6b-683198f9747a", "value": "T144C65A51FACB54F5E903583180ABB23F23705D048B28DBDBEB547B2AFC776821967249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709159, "uuid": "dfee89cb-2c20-457c-82c3-3c89879fd2e4", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709159, "uuid": "c805d87e-73d3-4b3c-9be7-7cf4eb5c4a4f", "value": "49152:qy84/IKRUrISEVX6h17nIEcogQUP9+YPPptyz+9QJyNU1TUohQqAZ548fku4ifAm:RD/IcUcXCc/5i+NHYEkEhKoUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767709159, "uuid": "715dba72-52bf-4daa-bd22-a84be2d28c72", "value": 11657216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767709159, "uuid": "3a243210-2490-41f2-bcd8-ec946ca63e96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709159, "uuid": "75813691-90eb-4819-ba59-6d8bf38475f8", "value": "SecuriteInfo.com.Trojan.PWS.Salat.332.27008.14008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9ec034-eaca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767681394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681394, "uuid": "d530e716-cddc-4991-9a38-3ac3e80eb3f6", "comment": "Malware payload (Mirai)", "value": "1a841b271fcb58d1b4e57761bcb3cbc7", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681394, "uuid": "040be9f3-6a49-4c55-a76d-a84f392c0dfc", "comment": "Malware payload (Mirai)", "value": "8204be1119875b1c8ec9b145d9fcbe0fe0c5439fbe8a0b5d061a367da37b67d3", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681394, "uuid": "2185151f-c901-475c-8a3c-1eff642866f8", "comment": "Malware payload (Mirai)", "value": "a2a2bbd6355d7f3d1afa9f478a7882443fecf1af", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681394, "uuid": "53c52965-272b-4243-a7c5-3ff219003ca1", "comment": "Malware payload (Mirai)", "value": "1be6f5efb645b7fdf5d13c1e148eb7d93e44aded8882045e0498ebdeade75643235655544920408cb62e741acc0245a9", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681394, "uuid": "9de763ea-94f1-4691-b378-15b62165c0d5", "value": "T1E6A2E11572632E56F3ED1C3DC86A8357F9A71BFC90F5327679441620C90D24A2E38A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681394, "uuid": "20ea98a2-d980-42f7-8827-2a9f7d541bcc", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj4lwhymdGUop5he:TvQn4j+ZO5fKAlxWws3UozI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681394, "uuid": "1f05b46d-3a3e-4b60-88b1-41d4696d46c7", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681394, "uuid": "67cfcc9d-3dcb-45f3-968f-38e51c6ac995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681394, "uuid": "58b20c48-62dd-4b84-8776-c3854dc5fbe1", "value": "8204be1119875b1c8ec9b145d9fcbe0fe0c5439fbe8a0b5d061a367da37b67d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f308f74d-eac9-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767681353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681353, "uuid": "ad46f447-df00-47b4-871c-084ceb70a1c2", "comment": "Malware payload (CoinMiner)", "value": "32c12e31f96dd5399afececf02adf5c0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681353, "uuid": "4ad8e4a5-b3b3-4bbd-a6c5-8246de86adcd", "comment": "Malware payload (CoinMiner)", "value": "83331aee3703d73f8b6218b0537a3d95012c70bfaa2747bf8fdd1798500df41f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681353, "uuid": "baa53e22-86c8-4ab1-a9aa-f228af3c2be5", "comment": "Malware payload (CoinMiner)", "value": "b9d8318e3d9e53ab66d745157eefe53a92e405ad", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681353, "uuid": "cea0d5b2-eacd-4b54-98e2-4a50b8aedfae", "comment": "Malware payload (CoinMiner)", "value": "890ff6c332a42514d44dc104c542a25ecf848e762b9aa00d605be86c8ae11882dcb199c0fc072e0d53995c9bc8de6fd8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681353, "uuid": "816c05a4-3a71-4392-9351-87924127f581", "value": "T188565B73909514D4D2AED974C6156213BEE4388B673863CBBBC076F11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681353, "uuid": "c96a854c-fc9a-436d-be7d-c9cc0f3e2b1b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQt:cqYUQuVDt0TZEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681353, "uuid": "05c6aaad-63fc-40db-9771-48c9f53aefaa", "value": 6324224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681353, "uuid": "fd7be3df-836f-4f43-950e-3abbd826c088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681353, "uuid": "bb93e12c-ac20-41dc-bfa2-1346d6fa6d76", "value": "83331aee3703d73f8b6218b0537a3d95012c70bfaa2747bf8fdd1798500df41f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e5b40d-eb2f-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767725078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767725078, "uuid": "b3492f5a-b3d6-4601-8020-ef67cc00c98c", "comment": "Malware payload (AsyncRAT)", "value": "bba1a19f6d2c846b3d09505e5d9838be", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767725078, "uuid": "7bc8bc00-0e19-418a-b59f-481e6a243a94", "comment": "Malware payload (AsyncRAT)", "value": "851afa6f3343202f7cf017e1b4e7ada2063132ad3e726c26fc33e1d657e24586", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767725078, "uuid": "4f9b8209-5328-44d2-a3dd-b87527072226", "comment": "Malware payload (AsyncRAT)", "value": "27d76724dbb48bf181ee956d130ecdaa144ee33c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767725078, "uuid": "03fc9395-c83f-4b25-ac8f-8a3e08545bfa", "comment": "Malware payload (AsyncRAT)", "value": "29bc804b9298ccc855c0e5f3ae83559df16c1929164fe7d24879ebefb8ba9cfcfe2d52c89c648fbfe07ffbcd73c4cde2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767725078, "uuid": "2da4013a-9876-4488-a3b4-c91c5890ad9f", "value": "T194D3C0052B48C8A1E2AD4AB8DDF2564046B5CDB32501DA0E7CC425CF67AEFC95A077FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767725078, "uuid": "795bfd83-c20d-470c-90ba-afa5c3e82680", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767725078, "uuid": "653fb509-d2a2-4817-973c-4a1ff42d7de9", "value": "3072:gQQxBU4Uxv1AVEeGbb//1U9BeF+YzB1hXeiYY0I26QqxqY:gOzwkb3wBeYA/mIBpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767725078, "uuid": "55548219-5d2d-495a-ab51-b2003afd8e4a", "value": 140288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767725078, "uuid": "484feb52-fa65-4d0f-bb4e-a243b4430eea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767725078, "uuid": "6fc8bafd-f5c0-4483-988f-83534b4fb18a", "value": "winrar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617273a0-eb3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767730501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767730501, "uuid": "a8f9b38f-fb57-4950-8a41-b6393262c02d", "comment": "Malware payload (Mirai)", "value": "49c938d6f8a9ea39721b6e50eafeb56e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767730501, "uuid": "00d2521c-4479-4ea2-888c-bcb69c45df7e", "comment": "Malware payload (Mirai)", "value": "853d9da156284b4095bfb8791567ba93739eb70cabfae3b9d40927ae9bc897f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767730501, "uuid": "e34e1787-d17a-407b-99f0-6a519701c646", "comment": "Malware payload (Mirai)", "value": "cc0e5cff88e1fd9886166570cd2190eb5ceaccb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767730501, "uuid": "3a8e1133-3708-4a7c-be50-5b7228e0a62e", "comment": "Malware payload (Mirai)", "value": "6e1d7aa7709ab59799732123a1901822dd170eceeb705d6042946451f43f8aafaaa786425ce444c60fa31bbbe7c0a8b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767730501, "uuid": "e4fc9ace-3501-45ae-bce9-f89f6590c4f6", "value": "T189056C1BB2E3B4BCD157D43043ABDA63A935B43502226E7B65C8D6303E1BE701B1DB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767730501, "uuid": "c7b36f18-8242-4649-97fc-1d2970a68709", "value": "12288:dGbd0uNLRRIH4s0KD/ikDlxF1YrvNKvuyYsWbogOtLhNtKQSFdzuFUBSJywabqZ5:gZ0ofE4s0kDlT2FKGy20zLbtapbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767730501, "uuid": "b95a96b9-08b3-4861-9d39-4d9ea1baeaae", "value": 837040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767730501, "uuid": "52e8ef0b-e805-40e0-966a-c72589c36569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767730501, "uuid": "12f45c7a-0d36-4cc9-b06c-07fb84423c39", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02b8e37-eb2c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767723788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767723788, "uuid": "ef16ddcb-59aa-4a80-8fd6-2bfa4d36a5b6", "comment": "Malware payload", "value": "e1a631cbcd5228f88c611538b6c21981", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767723788, "uuid": "7b236e6d-a5f0-4962-aa57-0bc1f037d0f4", "comment": "Malware payload", "value": "8582aa091dedf4aa726841057bd27b81093cb780cd19a1aa6c3141bb10024df1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767723788, "uuid": "725b2cc8-aa3e-4ba2-9d8c-1815e461bbe5", "comment": "Malware payload", "value": "ad85b3558d5895eeaac50a934249b6f4efa95f32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767723788, "uuid": "bcda5f0e-7e32-41e5-8b0f-f5d41b522f0f", "comment": "Malware payload", "value": "4cbf74e12c8a3be03341463e7645563c7453174081fb52e6466ebe568b37b54b2fbce83df92aaa3754864988b605bc88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767723788, "uuid": "4befa541-2a37-4db7-a6eb-9b4526da8b3f", "value": "T12D087C4262EB04C4F9F7DA759AE66617C673BC122F3095CF221C17291F336E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767723788, "uuid": "f03037e4-362c-44db-8a9b-6159c034f2d7", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767723788, "uuid": "3691b67e-9321-4e13-88d6-30252ff8c948", "value": "393216:Vy84WHCQTas4MEMMurULlv9iaVZhLqJvHoNYusIyNOnS0B4AycWMCY+m3TIuMHPd:VUcTyuSsJYqlA4oe5rs3wb31CK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767723788, "uuid": "4083ab2d-6299-452e-aac7-3961c057cb6f", "value": 83148853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767723788, "uuid": "c817fe89-efbf-4df8-9e23-f89bd108916c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767723788, "uuid": "601b3223-4b3a-4d05-b00d-e23a132cab30", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7c0609-ead2-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767685233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685233, "uuid": "f7272905-46c0-4648-90f7-57fb1701f113", "comment": "Malware payload (AsyncRAT)", "value": "53de2d985225a8c6076873d1ba4d42a8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685233, "uuid": "fed461f4-3cfb-4abb-a28a-1fc87210e0fe", "comment": "Malware payload (AsyncRAT)", "value": "8707e35868f140fdcfb5f87599a22197260c154e45b26282c66af38df465ef1a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685233, "uuid": "772d150a-8c50-45df-8d1a-c89a4c2e92ff", "comment": "Malware payload (AsyncRAT)", "value": "92388c7f78359ec3c2150f441b167ed469c754ff", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685233, "uuid": "161f5458-4ebb-4a18-96c0-a7d155044010", "comment": "Malware payload (AsyncRAT)", "value": "65e877da9c0194e29c477e9af746afdf0e8ead2374e0534f0912a2648f44713559cde4b0321db7613b134063b826caf9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685233, "uuid": "ee8c5af9-bf4a-4dad-bbb4-13d4c99a975e", "value": "T1EB2612B0053A820221798931FDD50E687484075F5A43DD7FBB5A0AF947B5FBA327EAB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685233, "uuid": "51721dee-f1d3-457b-9362-d588a6c213c1", "value": "384:UXWnPXF/k+iXCpPLaT/3aW/7e6Yo6ZgxuiMC1BKjbNJqb3qQhfX8ZSrSFlgY:d/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767685233, "uuid": "6001bdb0-9fdc-4238-9c07-7e4ccde27c44", "value": 4468925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767685233, "uuid": "f5c549d0-d1b7-44a7-96b4-8c83894cd45b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685233, "uuid": "314f4d19-3943-4c61-90e3-d39e4c6c5437", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a6f137-eb3a-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767729839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767729839, "uuid": "6782d2aa-fd04-426e-a708-b04c888b7a2b", "comment": "Malware payload (AsyncRAT)", "value": "e2dfdc61e2bc542a7b04d16c540b58c8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Net", "colour": "#889405", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access-trojan", "colour": "#13F17F", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767729839, "uuid": "74a2227e-f67f-4a3b-9620-aae7c91e5e6c", "comment": "Malware payload (AsyncRAT)", "value": "8994c8fd4c22d82bcc82fd7cfc226b443970511966ea488fcb5823bcc63ed697", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Net", "colour": "#889405", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access-trojan", "colour": "#13F17F", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767729839, "uuid": "0c7f6612-b092-468f-a42b-812ec05d7379", "comment": "Malware payload (AsyncRAT)", "value": "461906f99ab8649133489dc0c71f96f325634c64", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Net", "colour": "#889405", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access-trojan", "colour": "#13F17F", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767729839, "uuid": "34a158bb-b334-40e1-a023-c1a8f963f075", "comment": "Malware payload (AsyncRAT)", "value": "16bdc3e24a33a8d93e8c85774d691c1441268e09d518b44b19d36b07ba8e979e9e1175bc3147be7e5d78411f57d26b0b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Net", "colour": "#889405", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access-trojan", "colour": "#13F17F", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767729839, "uuid": "d29c120a-6b2d-4c16-aafc-9a09ade64e60", "value": "T157535B0027D8C925E2AD5AF4BDF285004AB5D9772102DA5E7CC414DB6BAEFCA49123FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767729839, "uuid": "72f43a41-b575-43cb-81c6-9e570fa49657", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767729839, "uuid": "a114d4c6-3908-4203-9d60-5fb26cf261f5", "value": "768:gHwgOIXkkiPQ7FiA9Jkbpt9OZnsrP9hkN1+MSCv7mqb2nHpwz1oNcRZ8Gopt9VcD:wnkXKe9sn7NmGbb8wWFGi9VclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767729839, "uuid": "ba4db9f0-74c6-48c2-8bee-8fee0587cfb4", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767729839, "uuid": "db46ce8b-50c1-4a7f-8b05-ce18320fd480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767729839, "uuid": "d0deaa95-49f9-4575-a585-2c18e56081f2", "value": "EclipseEndpointSovereign.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d0fe69-eaa7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767666347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666347, "uuid": "b6b03e59-e6e8-4b65-9402-bcd07f8b1549", "comment": "Malware payload (Mirai)", "value": "a0988e2b16dc3a50f70594e3e5146e4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666347, "uuid": "14394664-52ea-4276-ae28-66010c81c979", "comment": "Malware payload (Mirai)", "value": "89f717c2818bc5e67cecb3f192138acffb6ccc3c8d9c578f2a0d15dff1643c1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666347, "uuid": "9fee31fe-2576-4359-acc1-d438086b6da4", "comment": "Malware payload (Mirai)", "value": "458ec34996b7bc9418beccd5ad7b8aa3f482dea5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666347, "uuid": "18dd4fb9-905c-4d97-9bea-a8b701224449", "comment": "Malware payload (Mirai)", "value": "9ff32b5c91f993e29d5b048345e1bce92b13e1d7da5604b3bb843fa9dda43c2cf76be5b8a240953df099c9e8911aa655", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666347, "uuid": "715d0e32-25d5-4b3d-94e8-b120aa02e095", "value": "T1DDB31992B8D19A13C6D423BBFA6E018C332613A8D2DE3217DD256F1477C691F0EB7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666347, "uuid": "1869bac4-b5cc-491d-925f-eb8fdd203bfe", "value": "1536:oh+wN4323mQcrXhrTi5kPSFGm8tJ+8rrjoTE3N5V72xhiB0XEtY509wZ35ZH9Rsg:oh+wN4G3+GKHoQd51ihSnYl3nHwHmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767666347, "uuid": "ca62e661-379d-43cd-b085-367dadf68be4", "value": 108216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767666347, "uuid": "63ba0a05-7f85-4c3f-96cb-a6945f09afa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666347, "uuid": "e823dd3a-b5fa-47ca-aadf-08ece745475d", "value": "UnHAnaAW.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2965eacf-ea9c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767661687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767661687, "uuid": "a2f14290-a7cd-425d-9497-0456b8194ab5", "comment": "Malware payload (Mirai)", "value": "ba0ec1815a9ab01f37d74bd96176c15a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767661687, "uuid": "8bb280c0-dffa-4eca-b752-0d57baecc819", "comment": "Malware payload (Mirai)", "value": "8a5c7212f989321383ecca141af7005ce989202cfc83e33c9e26462a55527847", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767661687, "uuid": "7fa1b43f-dffb-405a-89e6-d8918a62cf59", "comment": "Malware payload (Mirai)", "value": "5dcf334df8bc7456a6cab455b45e4dca4006cb2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767661687, "uuid": "529cd795-4b42-4af1-8e21-d960c8436ac0", "comment": "Malware payload (Mirai)", "value": "826860250adf26612c986d86c9a94d4eeebcb1a70a80019bf5d18b7cf6e3990dbece46e02004236a6790b257a3f310c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767661687, "uuid": "74261030-2001-48de-8fc4-8889bd57a966", "value": "T127137C76C02E6DD8D58856B8E4708E789F53F500C2632EBB8A8989758043BBCF51D7F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767661687, "uuid": "08e65fec-2582-47d3-8330-8889371329ad", "value": "768:La0wtrXvCRbgefUE8c5pUOP5xgprdnUEjUGCho1zVDC4Uu:La0wtrx+t8fOYFdU0UGV/DC4Uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767661687, "uuid": "7a677a24-9c24-4d8e-a473-cf8ff9b8b452", "value": 44088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767661687, "uuid": "0706beb7-561a-4c49-bbf6-f5d528b7bc1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767661687, "uuid": "1f8865cc-4167-4fe8-954d-11229855ab7b", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fe0823-eaa1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767663834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663834, "uuid": "6b49abd3-5a9a-4d5f-a6b0-9951ffdc67b8", "comment": "Malware payload (Mirai)", "value": "40dca802523c3bd6028893d3ecc2b349", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663834, "uuid": "537fc826-b11a-4953-8df5-e08ac40bc16c", "comment": "Malware payload (Mirai)", "value": "8c816e4927fcb56d770f5c01d940ff3afaa101b8de1176d5be65887341d29f65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663834, "uuid": "1de34c0e-0b5e-4061-a163-9870f212171e", "comment": "Malware payload (Mirai)", "value": "416f35811d5b034d9d231a5f127b24f188a16c2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663834, "uuid": "9d43c838-f77f-42cc-a4c4-bd484a965345", "comment": "Malware payload (Mirai)", "value": "26ffbd69f700174e5ffde1a0ac25ffb87716b3e8f6e80492c71f6de82e7bdc9561d67c54f1f86641b842335aaca80c9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663834, "uuid": "178b171f-ea65-461e-ae40-0db8c8546ba8", "value": "T193334A21793A2E1BC4D5B87E21F74734B6E6170E36E8C61A7D720E4EFF10A9421136B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663834, "uuid": "b3cbac2c-1a95-4554-9be1-8c9f3ebee04c", "value": "768:gYoInq90F4AmNNHP7xHfzqIDdRHuvhzPO+9jPkebC:gYbS0qAmNNHP7xHfzHhuvhzVkeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767663834, "uuid": "c01d45ba-2ad5-472d-b07c-1e8b3fcd6d3f", "value": 51464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767663834, "uuid": "5f46335b-79fc-43ee-b9e6-101d923f65fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663834, "uuid": "6341018b-c9bc-4c22-b7ba-40b0d10e34c6", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8239b2-ead2-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767685156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685156, "uuid": "f0624084-7ec8-46ee-b955-573b10a08a73", "comment": "Malware payload (Formbook)", "value": "15c2c919bec9504b34ec408462085db9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685156, "uuid": "ad50ea8d-912c-4a4e-8efa-64b30ff61ce5", "comment": "Malware payload (Formbook)", "value": "8f458ea339d79921e9e46311ec077fba71534ebe2092bc14a3ac574f284c82a0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685156, "uuid": "64427b9a-29c4-41ed-a3a1-c5373c44183f", "comment": "Malware payload (Formbook)", "value": "b32a2e81838ebd0d0f8cb3b027427c7779342451", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685156, "uuid": "8be8ab32-a148-4f40-ac79-b082b322e070", "comment": "Malware payload (Formbook)", "value": "54fd9f840705ff9e4fbce55a140f570b1a9db5ef426194604a0c439f2124b099bf33b1cc18ba1d01dfc76f3d08ea2ee4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685156, "uuid": "e55a85e5-766a-46f1-b4b4-09b874429b19", "value": "T1C426FDA6E274648DC02385C68BF6D004923BF8AF810F8D7FB7121E7D5796FB8159AE11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685156, "uuid": "de5c03e9-727b-463c-9aaa-d99ebcaed118", "value": "192:fsl1jfTxEdVg6k4444444444444444444444444444444444444444444444444n:f6uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767685156, "uuid": "36e6ec4e-1705-4bc7-973f-5efba95a5544", "value": 4615309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767685156, "uuid": "924ef07a-0b37-45dc-8af3-ad10b77f28e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685156, "uuid": "dd9a00a6-b0c7-4406-9087-1460d952860a", "value": "narud\u017eba56645.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f730ba52-ead1-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767684796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684796, "uuid": "3bf71a9a-d02e-4b24-bbc6-e9b4f42db403", "comment": "Malware payload (Vidar)", "value": "a22f876f4f5e654000aee78de1cfd23f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684796, "uuid": "85153759-5a06-4b95-b771-1a9917f51459", "comment": "Malware payload (Vidar)", "value": "8fd1a9111659c8bd79550744804e2887f4059ebe093365f1d8ca8d5a852069be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684796, "uuid": "6779e504-9f6e-4caa-9c03-b35f46705562", "comment": "Malware payload (Vidar)", "value": "38570dc67eedf0a10c35188b35233d2e8e69e263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684796, "uuid": "2a947ebe-fa37-4ef5-b608-c21c5c8e570f", "comment": "Malware payload (Vidar)", "value": "6b6584f6b4f88692f68d5523f1954177adb9e0e570af03e0a14ea02ca8658d5c93e9faad5872fb3795284881c48d11cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684796, "uuid": "296e8919-88c0-489e-9ad8-64cac0b4bdce", "value": "T13515120736B774FBD2A24274C6550146EB75B8B643A19BEB0398022D8F231E06D7FFA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684796, "uuid": "44f0599d-bf70-467c-9b1a-8797260e75bf", "value": "36bf284c586ac6c4422c3d2f53295557", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684796, "uuid": "6400680f-f16d-4420-92b9-14ee065e2c39", "value": "24576:Z2uRURShr3QMZb/trykQdk2+B1/uThOUCQM:UuRVZbtrykQERp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767684796, "uuid": "d35c86b3-2775-4f1f-8769-703505d0be7c", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767684796, "uuid": "e5aefd77-4db3-42af-8095-1c71054eb095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684796, "uuid": "c70e0faf-b327-4617-91e7-14d103680a7b", "value": "a22f876f4f5e654000aee78de1cfd23f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8658df98-eb2f-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767724979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767724979, "uuid": "ac429332-b59a-4e68-998f-fad1c45494ab", "comment": "Malware payload (QuasarRAT)", "value": "55d1a583dc65d76808a507c14cf16d72", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767724979, "uuid": "1d6e12b8-b49f-452a-887c-87e66163b0c4", "comment": "Malware payload (QuasarRAT)", "value": "8ff0f5aeb9ba1015ef62d07387311d770be1bb52c8d0f89f0d816ca9afe44b8c", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767724979, "uuid": "c3f802a9-32cc-4750-a6d6-f78635d72145", "comment": "Malware payload (QuasarRAT)", "value": "71e7cad4a1dff1712876c9272389d4e8919159f4", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767724979, "uuid": "9725e7b5-dfc8-4523-86be-2f943470facd", "comment": "Malware payload (QuasarRAT)", "value": "328187488d04c29ec4338cba58c1547559e87aeb388ff373f53592a752e14acce569ace9f33d0c56f36c029305f219ca", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767724979, "uuid": "070d2e88-2be3-4d3a-b9fa-6a21fd25c954", "value": "T185F55B1437F85E23E1BBE273D5B0041267F1EC2AB3A3FB5B6181677A1C53B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767724979, "uuid": "dbcae1b2-f73c-40e6-8226-cdaac7aaa7b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767724979, "uuid": "2ba6d631-3653-4c76-9a0f-9d9b6746f45f", "value": "49152:BvDUz2lBaA+FCPnl6cXaKYHEkhZC01JnFoGdsTHHB72eh2NTy:Bvoz2lBaA+FCPnl6cXjYHEkhZC6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767724979, "uuid": "c8892280-9336-41e2-9446-7daa1b4506e3", "value": 3335680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767724979, "uuid": "7ec19977-364f-4912-a429-ca09083dd44e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767724979, "uuid": "44eb188d-921d-428b-8787-9bec6317efc1", "value": "7zip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab3740d-ea98-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767660321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660321, "uuid": "6b640f2a-8d8f-4803-9b8c-ab7f35399afa", "comment": "Malware payload (Mirai)", "value": "695745f96696eb7e1ad3063f162ee3ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660321, "uuid": "300622d0-05ed-4f2b-bc19-2407118c692f", "comment": "Malware payload (Mirai)", "value": "90259f443b965276f304f1b28d98243c33ea5b5d0d73b9d1901ee625a05ddeb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660321, "uuid": "81a08e47-2e09-4b68-a79a-994727ee8ef2", "comment": "Malware payload (Mirai)", "value": "77551f66fd3220a0741b3c6054784f71d4d74aba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660321, "uuid": "3b2c1993-12cd-45bd-9c13-fac2ecd42d9d", "comment": "Malware payload (Mirai)", "value": "853700a6cf261e4b2359afdfba31c7eb8b62daaf43ffbc956d398b306eac0467a3113d3fc74c0056bb424042e657d82e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660321, "uuid": "e29b50ae-c61f-4973-84cb-aa0d88a81a7f", "value": "T15F436E4372180E57C5E60670253F1BE093FBA66020E4B3C5655FEB6A8676E37208AFDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660321, "uuid": "ea472fee-7408-4bfd-871b-a4e86dba5d90", "value": "1536:w56Te0anWWrLu3Lah9QYbmdS6Sn3+Hcup7Rp:lfAcLaXbmTSn3+8upv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767660321, "uuid": "39c2e5a2-f02f-4f09-94c2-c694a61d1e4e", "value": 58336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767660321, "uuid": "66ae2487-08f4-46fc-99cb-e454d67e323e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660321, "uuid": "fd280684-241e-4cc7-b3d0-a604cef642a1", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14127e96-eb09-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1767708467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767708467, "uuid": "d9e57230-a677-46e1-a6c3-89db8a8a0d1d", "comment": "Malware payload (GLOBAL)", "value": "8c37e4751c67440f5ea8931c3d8e1e62", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767708467, "uuid": "96935271-a59d-48f9-987a-433bdb82de1c", "comment": "Malware payload (GLOBAL)", "value": "90e6104462a969029a7c5b023ce811ef0c3ff93eb6bc72b0a0bf9e1baa722795", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767708467, "uuid": "60765b34-83c7-4ed0-910c-5733436bfe06", "comment": "Malware payload (GLOBAL)", "value": "65dc4d546231cbbcf575e58b98f8cea44f8cadbe", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767708467, "uuid": "96b8e45a-10c2-4367-b296-146ae34d0b15", "comment": "Malware payload (GLOBAL)", "value": "7995f3e67dfac64362239295e1e996680b34a5fddb90a74896974c6229a4466ea08197f929ea11f549b264dced12f0d9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767708467, "uuid": "ceab2bd8-ad26-4c55-96c0-24becfa56b41", "value": "T195347C30BBD28431F5B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767708467, "uuid": "54b484f6-b3df-47f4-aa07-dff5fcdb6b5a", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767708467, "uuid": "bf23ddef-3357-414d-8d99-a88bc33d1507", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767708467, "uuid": "adbc6d7e-d69c-4a9d-b378-f65ef7fbd59e", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767708467, "uuid": "b4b092b1-fa75-4cb6-8ffa-a05b08aecd60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767708467, "uuid": "1375cf4f-6996-43ef-86b7-29e0035ecae6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612d39be-ead5-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1767686262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686262, "uuid": "55d9a093-e0a5-490c-899f-9bf75d1b4843", "comment": "Malware payload (RemcosRAT)", "value": "9e2ef7279a09021e81c36236e4ed6ac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686262, "uuid": "3377e0a0-5514-4210-a8d0-d8368fdf680c", "comment": "Malware payload (RemcosRAT)", "value": "9250a3b078fb8a5aad785ac00fbe9bb617d82a843a517185e41233b772b9f387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686262, "uuid": "a87555f3-352e-424c-b69e-c1085f70118e", "comment": "Malware payload (RemcosRAT)", "value": "ea58adce4a22f8da0b1efafbbce0b50a4c1a709b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686262, "uuid": "5c35b911-11f9-403a-ad1a-3cefc7c82d58", "comment": "Malware payload (RemcosRAT)", "value": "6644ca7874eb816cf383ba3e74542161c7cfd3a07ad307ead6886f1e2215b87dac5591b8ffc3dfe7b861023ce00e2629", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686262, "uuid": "b902f2f1-03b8-4259-a747-bc09e006e862", "value": "T1D595D122E3904433E4722A385C2BA775442E7E101E1BA58AFEED9D4C8F776817DE5393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686262, "uuid": "7f2abb25-ac92-41ab-a61b-50b469e69508", "value": "f8bf7b54f582b47a2308f7e0b43974d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686262, "uuid": "5e53712c-9ffe-4b90-b86f-8a875af03c3d", "value": "24576:1DUyD7vMf1/iw0/GUh4OnZAE4kXVsvTYxnrw0KKEBKv6BXSvtA+2u1THo:1tTDh4Onh4klw8xrfKJBjSl9THo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767686262, "uuid": "06fa2993-32b7-4075-8bc9-85d34ae988d1", "value": 1894912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767686262, "uuid": "3d3c411c-b114-4536-bc89-34e9d0abafec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686262, "uuid": "235aeb10-f09c-43e1-9569-d5499122049f", "value": "PO siparis _6669_Kaliteli Yedek Parcalar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d0ecdb-eafd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767703500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703500, "uuid": "c542f177-4a7b-4978-bb45-1a141e1285d2", "comment": "Malware payload (Mirai)", "value": "859d38df71a0093948be5f3ec2cd373e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703500, "uuid": "87af7f12-c068-468d-b9cb-9edf03fd5423", "comment": "Malware payload (Mirai)", "value": "92e12de4431cdc0ee9398118f9b7d9e21202f1c34756900e39411094facb3c44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703500, "uuid": "e7494ea6-f3c9-4bf3-8700-f78a81cc0f81", "comment": "Malware payload (Mirai)", "value": "bcd39a0a5299f7ad13aed0126df3f571807a7d99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703500, "uuid": "aa46c759-effa-4e0b-b321-f91b2a03d1d3", "comment": "Malware payload (Mirai)", "value": "20d94f14e7ae4bf430fd283e5f050fc3028f7d688353dad2fd970c7071a43f7b019b7c83ad977a11a339d6940d20e246", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703500, "uuid": "19182fb6-366d-448d-b482-0b704795f6d8", "value": "T1A6433BC8E8C3B9F6FC00157C307A9B729977E63F6179DE97D7E895239902202A50135D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703500, "uuid": "6653f9f5-cfae-4d3b-9f95-baa6e1a36ae5", "value": "1536:gSW9y+LfCrlADLYuHwPdP+arvnoCF/iy9ns:gFyQfCrlAnbHK+CoS6Gns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767703500, "uuid": "a96b570c-f37a-47ba-9c13-1165f8a706eb", "value": 58160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767703500, "uuid": "e66bd5b7-a97d-45c7-af4d-3c642ae0dae5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703500, "uuid": "5a23a29f-7756-4577-bf12-696e6785b9ba", "value": "Fantazy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36bdf65-ead1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767684736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684736, "uuid": "beb5badd-3042-41b4-94e5-2dc554744192", "comment": "Malware payload", "value": "4543da4cd28611d29836ce0b99145e58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684736, "uuid": "b5b412e6-3fe8-479b-9f9c-c0d86f68e658", "comment": "Malware payload", "value": "95116f138582eef8a962fb96612c1d9c55b3815ddd32eb3b838cc8fe2ec1e838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684736, "uuid": "5c685dcf-ab0e-4a5d-87da-b5612712480f", "comment": "Malware payload", "value": "d51df7d8732d6c46ec8110c7343770a6017e6bda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684736, "uuid": "bb7f2a89-1932-46d2-b55a-fadd7fa28959", "comment": "Malware payload", "value": "98a455837bee7e5d93de56d9663c8cf3eefec46c66e084cbba19407617400359bcd2db820fc515f17bd8050d806d58ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684736, "uuid": "ce1992ce-ad48-4481-a2a7-5a090177e9ae", "value": "T1D4348E21B992C432C66709B39879DF69893DFC514B7169C7A3C40EBECD206C1AF35A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684736, "uuid": "a255742c-790d-41c0-926d-6e3aa48782ab", "value": "00e004ff0649be67e6fbb756d37edeca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684736, "uuid": "0c6ee220-df15-4144-9709-1adbd6da1ef9", "value": "6144:ZdWB5yRPCOvNcSVe3r6r7DmTKfjz4oH9nnkBQXW:nOyRPCOvNcSVe3r4fHRxnbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767684736, "uuid": "d0b2de52-ad15-4c9f-a482-8374d4d81304", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767684736, "uuid": "7a4ac9c9-84e5-4f2d-adfd-5455fa213d1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684736, "uuid": "98baa1fa-de4c-4fbc-b83d-6a0dfb83c140", "value": "4543da4cd28611d29836ce0b99145e58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed56714-eaca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767681453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681453, "uuid": "42c57d06-c3da-4a9b-8949-d72d07cae1d8", "comment": "Malware payload (Mirai)", "value": "672d31e21fdaa88d83301b9bb276c97b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681453, "uuid": "b26738bb-11ab-4f4f-b35f-bf014d7afba6", "comment": "Malware payload (Mirai)", "value": "964ef0ad6668128132f44c224d0927b657912ffd6ec2d161277fea581bfd2478", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681453, "uuid": "49cf24d2-9224-4bfd-a5bf-367483faf8b6", "comment": "Malware payload (Mirai)", "value": "1b1363da8312c6a70a496a749f21339704d76ca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681453, "uuid": "aaa8eb04-961b-44cd-992c-7551b0e43948", "comment": "Malware payload (Mirai)", "value": "6f4e9c4f7c2f7369e01161c25348330415e4e4dc83106a1f1b24046e7d59d226a4938b86a06a572e86600c79df8c0114", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681453, "uuid": "214dc4a5-a34b-4c92-9fce-95e7febf1eb8", "value": "T1C12309C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681453, "uuid": "197f468e-53ab-41fe-a5db-53b5776eb250", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGAZq/4Qw7bn2i1e:Gv4QPfZfW5XTOeoEz0qAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681453, "uuid": "43b007ca-596e-49e5-bd2b-c894e74db420", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681453, "uuid": "4ec4c099-4614-4c3c-b41d-23bc6b919ec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681453, "uuid": "d9bee52d-3450-431c-9003-3d20015ab361", "value": "bbd43861fc8cf38d1df5e7f8946d7d6088b8c6d2dacfba5bb395bc74a8e4dacd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f72a85d-eb3b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767730068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767730068, "uuid": "ccdbe27d-8e64-42e7-8da9-955c473d71fc", "comment": "Malware payload", "value": "4266276520bfd11303a27389db39a21d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767730068, "uuid": "cafd84aa-55b4-4d5a-b65c-4e145dd107e0", "comment": "Malware payload", "value": "9659695456f64b73d0ed7696cd4a73807ee4ce2c0fa6e350be759d324fc00a7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767730068, "uuid": "f4fd29ba-d166-40b8-9bd5-565973d096aa", "comment": "Malware payload", "value": "d85318dc532e90f677daa92ce012e3a18387817a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767730068, "uuid": "b7bbad9f-fb0c-4613-bb42-daea1a10c2d3", "comment": "Malware payload", "value": "8e4ed288026aa36a6ed77a8ea58caf9a13321adf40eb43d02e213a4ef09e1987c8ee70808360b5b80dd0e43dff6beff5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767730068, "uuid": "8055dc20-024b-4663-852a-a80d126f5270", "value": "T10B742388E6DB7FE5EBC5F4F27F16D37921269B030141D02A0777091B9BE6ED618213A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767730068, "uuid": "73fcc4a2-43b4-41d1-871b-15c189dd2c34", "value": "6144:l22X/dwTld/zOngtoFZg2Nkw2f1KU8ePSb0z/fPfonczLTlQnprlsNTnzZ0H8:l2ld7OnOoFleweKUZabU/HOcrl4JIto8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767730068, "uuid": "58713cd8-4f06-4e84-92b4-9087649bc952", "value": 339451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767730068, "uuid": "936623a1-b4ef-4c1e-814e-02780f62423d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767730068, "uuid": "a61cf5d5-2482-4e50-825b-010069169af5", "value": "bizy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751bfcd4-eb05-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767706912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706912, "uuid": "72eb110c-0048-4593-8bb6-a993b4d63a8b", "comment": "Malware payload", "value": "392e3061da57f1b7d77cbaa90946a686", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706912, "uuid": "87028197-8ec8-4b60-9dde-1709c0d813da", "comment": "Malware payload", "value": "972c4473c6575de7fa1add05221b128502e28a0a9f80cf822fe68d1ee6c18332", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706912, "uuid": "425afa47-7c41-4f2e-b3d3-a7624c36380b", "comment": "Malware payload", "value": "806f11ce667c73267ab7379a5ed6d52d50ff740a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706912, "uuid": "249e638d-4460-46a5-b137-46492b58a020", "comment": "Malware payload", "value": "47ce3cd00a4c0d80fffe712da52ed4004d6f17d389c76b6a51922c66a87e710a378acd79a44e0755c3ef3f890fd46038", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706912, "uuid": "2df32ac5-172b-477c-9ed1-21e2e1e5ff20", "value": "T10BC4F751BD7EB553E9CDF6357731A2D9302F7284D4E1A036DEA1CA9846F4BA88E13032", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706912, "uuid": "d3f7aa4c-3937-4914-914a-2e3ed6e90fb9", "value": "12288:Sld0eWZ3vWpZPXBQSHka4yegeNMok2/saPS/9HIBirkh7pNCDhGtrGGNy8uCg9UL:Sld0B3vWrPXBQSH14vgeNMok2/saPS/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767706912, "uuid": "c379d1e2-f7e4-495d-a424-24f430c6c9c9", "value": 554324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767706912, "uuid": "12fc9400-a062-45ee-acd3-0b9849548f4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706912, "uuid": "0eecc877-e66c-49e9-b2e4-113ad238df15", "value": "kinsing_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33cbe8e-eb07-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767707982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767707982, "uuid": "5979a518-8c5a-4f70-ba09-e5a51c2e244d", "comment": "Malware payload (Mirai)", "value": "3841d9e1b1311b83c9ffe038387f8668", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767707982, "uuid": "cfe44ae3-331f-4055-9f62-52b22b83acc3", "comment": "Malware payload (Mirai)", "value": "981f9cd6a20d4bca838e92d4b7e28ac0a4e9cd325663f291493966d77020d8a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767707982, "uuid": "eaee5ffd-3221-4343-a8a9-b9c2ee109ffb", "comment": "Malware payload (Mirai)", "value": "0b602660b405c4b423f841c45be52add31a8256a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767707982, "uuid": "c54607d4-e15c-4202-b7d9-6beaed5a9426", "comment": "Malware payload (Mirai)", "value": "7afa20f1d0a9601d622345078d50529fe972f9a0219ed6c550ebac35654917831401e76151effdede8bde73de82e8eec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767707982, "uuid": "6684d411-07f4-41d3-abf7-350ec76d215e", "value": "T1B1C45C59F8409FA1CAD529B6F65D929C33070B79C3EA720799245B343BC78AB0F3E641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767707982, "uuid": "1b47f817-5444-4316-ad84-894dcf73e283", "value": "6144:wUXT47Q1fjVyVyQ1GB92FoXCeK1dDQp0vK6yjoUmmGXJVJ8nhTVnGglgpZ6mvAfF:wUDamjVsunEREm98nhxTgpZ6mvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767707982, "uuid": "ee9fcb4d-c647-4696-a8d5-3fbee3e732df", "value": 554260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767707982, "uuid": "606a9ad6-48b2-4620-97b5-17f5960516f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767707982, "uuid": "10525572-4797-48e5-87a9-2c4df8f94a0b", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1f0963-ead4-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1767686009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686009, "uuid": "f02909fa-91af-4b5d-a523-3ff146d0f486", "comment": "Malware payload (RemcosRAT)", "value": "bf92dcd5dec3fd550c36b9e94b8e614f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686009, "uuid": "6a0d0c89-71c2-43e2-ab56-5f4809a41a0c", "comment": "Malware payload (RemcosRAT)", "value": "9842f7e9567bb2af79bbebb8832012df472fa2b8ed8d840f95985809f2bcaa9d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686009, "uuid": "c4851e76-6c32-4658-8ede-aca62ec02014", "comment": "Malware payload (RemcosRAT)", "value": "3faf0a408c600cfd282b5c1819d0e3a07032430b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686009, "uuid": "295f3271-9630-4850-be74-7f19a2a49f1c", "comment": "Malware payload (RemcosRAT)", "value": "9e5772814726b0f2a402882c307e9860404dbc3e793b9490d4559f7ebb5941b2d0f1c8cf50c6cb382acec3a6e5151f33", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686009, "uuid": "7aa830d4-a0bc-473b-92ae-30ed2ed5e6da", "value": "T17262123BD55CEFF00B3E21F001877D0520A5932AA9368D6D98D6C195BF2AB524F678EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686009, "uuid": "0ad63980-4f00-4a91-8c80-29d84b0b58c0", "value": "384:YAPlyhHckL17KBE1smsBBR9XZ77cBPgDORhViiJf:Y8lI8Q1059J77chh8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767686009, "uuid": "959c14bb-2aa3-454b-8f06-2c53a67cf95b", "value": 15626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767686009, "uuid": "19763460-d2c9-4ba7-81db-30c9f96fc158", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686009, "uuid": "57c8ad5c-82d7-4d16-97e8-ee3038e57772", "value": "PO_30089_200Units_2026-01-05.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f8b11f-ea98-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767660319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660319, "uuid": "ad6488ae-e241-4088-ab30-eaa55573d140", "comment": "Malware payload (Mirai)", "value": "da558524db1220e5e2296f6a3f8d6500", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660319, "uuid": "03906862-0eee-4e37-b33c-6699d9d4b1df", "comment": "Malware payload (Mirai)", "value": "9875984914a8adbe23f752b88c17a42d4837300bf5a018c967b916dbab9a788f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660319, "uuid": "33654db4-d3e2-4650-8aef-ba2369b78fd8", "comment": "Malware payload (Mirai)", "value": "5dcc6b493f1714853cabf04d61781e1534094d65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660319, "uuid": "d0a9d39d-f11f-4d9a-bb8e-6f906a77aad7", "comment": "Malware payload (Mirai)", "value": "71c3c81998a4459a98976ae8ff2d0468182fcf2f895158573df4a7dea2988d3b195f2119903b0a3a13282be4984cc791", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660319, "uuid": "03a79964-2d5e-4627-bfd3-48512156d09f", "value": "T126536E4232184A53D1E60AB02D3F1BF193FB99A021F4B7C9654FAB598276E331486FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660319, "uuid": "c73208c5-3e10-4216-838d-fb08969fba0d", "value": "1536:bPkQGUS+cxUfe/7sB5YmYyoBD0Bz+oeF/vur7R6:EfIBmSoFoeFHuro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767660319, "uuid": "d2fc73ad-728f-4c09-8396-5f29c36063ff", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767660319, "uuid": "b0e2b909-aaa7-4592-94d6-328cceca1627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660319, "uuid": "854626a4-0ecc-462f-9da0-af6f56aa94dc", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94449240-eac1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767677758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677758, "uuid": "59f5c07d-0e9c-4bc5-b99d-c49437f875ac", "comment": "Malware payload (Mirai)", "value": "c8a0ca906eace18c6368bb44fd48841f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677758, "uuid": "79207702-9fe3-48f3-bf50-ef383dd54adb", "comment": "Malware payload (Mirai)", "value": "999aa4e2c9ad2f3eeba4bd959dd124170d8ee18118e4dbcf1f7decd563c123f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677758, "uuid": "92a1926c-3a8f-48c2-a2d5-180c24f1006f", "comment": "Malware payload (Mirai)", "value": "ff86874a959a717bae1b80303f51d2d03728b705", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677758, "uuid": "43f84c23-e36a-498a-b7b1-aff7fe97abad", "comment": "Malware payload (Mirai)", "value": "e01bd28ac87ae9442c47e3d50e103256bebb40c92782f948a0a08622a84bc936d2a5ae7448c24f13bf31ac21163cfd92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677758, "uuid": "932aa691-099c-44dc-b4a7-3c45a1f3305d", "value": "T19FD32A06730C0A47D2632EB03A3F67E193AF9AC121E4F640355FAB8A95B1E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677758, "uuid": "3e59f3d0-0728-4739-8544-92d3f12fa957", "value": "1536:troGHNTUZN95IBUiCxfytKteQQvhDajwso7lbEJvAhh3rp+JuQfqAE87ynJ:3mkUiCxRteKwF7lLhrMmnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767677758, "uuid": "2a08552a-fd33-491f-bb94-3412c8019ec3", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767677758, "uuid": "732b0453-f352-47a9-b153-804c7622708f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677758, "uuid": "e1782687-d5f4-4cf7-9d9b-21ddd296aff5", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2a38aa-eade-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1767690010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767690010, "uuid": "d085d3cd-343f-4ede-9265-d6876f21301b", "comment": "Malware payload (GLOBAL)", "value": "324f0a679e2dd7d4174fc77e882336bf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767690010, "uuid": "bdd4b7ce-c033-4d0e-b8ae-cbb67ddb120f", "comment": "Malware payload (GLOBAL)", "value": "99ed96d48e99828077d807f342cf13244af232c190088f12f548199a8ece8d97", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767690010, "uuid": "ec9c7155-24e5-45de-b5c0-765a19864713", "comment": "Malware payload (GLOBAL)", "value": "c44ee6b8000e886a197ce4737724dcfc1c03cdb4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767690010, "uuid": "04298e2e-2760-4d05-94c9-e8e813fe41b6", "comment": "Malware payload (GLOBAL)", "value": "adfc17068b9dfa6f13ff679d81d1a57054380d9c1fd5290c83761c75506d5033f697d53cdfb5f325e4f718b6b13ec1a4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767690010, "uuid": "6ef4911c-c746-48d2-9f13-c0f117066301", "value": "T101347C30BBD28431F5B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767690010, "uuid": "0f9a985c-147f-4df6-abb4-cdd2ef7c7e99", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767690010, "uuid": "bab41987-d28e-4d1b-85ba-1921c65f72b8", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767690010, "uuid": "796bab5f-434b-4885-8fb7-89875f5d2ea9", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767690010, "uuid": "09d52aa9-574e-4981-bc56-a9d89aeb4a66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767690010, "uuid": "a6286f55-2d9f-44fb-80ed-f5d914ab14a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e4e8c8-ead5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767686210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686210, "uuid": "ca577756-00d6-4d98-8574-2e8867643272", "comment": "Malware payload", "value": "f16b349ba8589a3c69fd9a433b3315aa", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686210, "uuid": "6bc3f421-37a0-4bbf-b6d2-3b18b22a5a47", "comment": "Malware payload", "value": "9b67df7eba0b4a21bc1da09f487f92468a28660f5042319cbf0eaa2cb8127922", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686210, "uuid": "06edcffe-61f9-4caa-b7a5-6e41a49edaaa", "comment": "Malware payload", "value": "1036c38c7e59b582f3cd56a81e5bfb6f62f72cd8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686210, "uuid": "f4ff2aea-9e39-4154-a478-e3d913ad6281", "comment": "Malware payload", "value": "fb40efec99d826090942d90897e4c06ecd4bb7dacab8ceb1b445583425d24ed3d7c953d39c1759b6d9d3600c8324e09c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686210, "uuid": "0215442e-ebcf-4e06-a1ab-54e16b047aad", "value": "T105141FDBA9DA23D90CE5DD84431A36EDFA112D6B92181CF6D2172EE6D3850C050EFCE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686210, "uuid": "5780d9ee-a1da-4192-b02a-5f0a8e238e44", "value": "96:eRbLsRKObLVv6vKWrVFrnbViNaPtTCXEJcQ42:uPmPVSvjlbhPFCXEJcT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767686210, "uuid": "bb653d6b-4aae-4665-8c98-769fbb1a9774", "value": 203838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767686210, "uuid": "d5b7ef55-f8fe-4f52-80f2-5e3623d84ebb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686210, "uuid": "fc21252f-7128-45d7-b7e0-b348483e5abc", "value": "win32.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35cb1168-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767720979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720979, "uuid": "c32be553-cfec-4d12-a39e-eb2f1342c7df", "comment": "Malware payload (Mirai)", "value": "3fbf1d3e9e5dfb523044d88bba9326a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720979, "uuid": "2181c706-4b15-4faf-b74c-04535e7b0be9", "comment": "Malware payload (Mirai)", "value": "9b85124e476048b3120a3cccb781a6bb1b7b340c0ebccc7ac5b87ea2ddaf2c0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720979, "uuid": "db37d0ed-fb22-4d09-9bd7-419983098409", "comment": "Malware payload (Mirai)", "value": "ada14599bca85a021e2738e016931195af945707", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720979, "uuid": "2feba886-1611-4df3-8656-c9fe988896a0", "comment": "Malware payload (Mirai)", "value": "10940d790121fdc79ee839ae8cbaa308c2bb4283ab411bf5dcef5708455623d4a91f14ff1efcd4a88946c8ec9f23b4e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720979, "uuid": "d7c96f0a-3ae0-4862-8477-2b287374a236", "value": "T1C5C3E1E4F9136882D1A302FD98C156C287906DB6CF52464912ACF6B83D3D9FA0F58EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720979, "uuid": "3a5697f9-c958-4534-8d81-fd95c5169333", "value": "3072:Q5j5meenOrm89N18youfSXdWx+8wQB60qiMMTnw:+WO59aufGdWV6ixTnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767720979, "uuid": "31176bc1-adcb-42b0-bb42-3a59927bf96f", "value": 123736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767720979, "uuid": "de747829-4f3a-4cc5-9003-10312422d3a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720979, "uuid": "fa95c1bb-f8ef-4f11-8382-a9bfefaebb40", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867b665c-eb41-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1767732711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732711, "uuid": "41e3d894-5aaa-4c39-abab-e0c1336956a4", "comment": "Malware payload (ConnectWise)", "value": "3578c266017b8b15ec92a8da5b9873e6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732711, "uuid": "737eb233-29ac-48b0-912e-7a863f6e094d", "comment": "Malware payload (ConnectWise)", "value": "9bb9ef18e16e9acc2dba17079c348349f68ff5552cb835dfc52909a7f0b34115", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732711, "uuid": "6511b732-0729-4327-bfb3-7ef74b7c4047", "comment": "Malware payload (ConnectWise)", "value": "7377808b6dab758664394497557bd6a251bacc93", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732711, "uuid": "a8e5bcce-6416-4ebd-9a61-c036e2e577f5", "comment": "Malware payload (ConnectWise)", "value": "a1ff0a211f0f2e96eb6ec781fc15935fac4df9c33b1667a59b92507a0805fca17aa4f82c3c7f51c9fa2654a0842a8695", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732711, "uuid": "798195a6-1230-4e8c-b7c7-703af37e1130", "value": "T1D3A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732711, "uuid": "137b2e22-c3d9-4fa9-bd75-22cd89724539", "value": "196608:ZKaLNkbgHi4QWKaLNkbgRKaLNkbgjKaLNkbg:9WgHiH4Wg1Wg7Wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767732711, "uuid": "5dec387b-fdcd-4a55-a54e-a6056e43a743", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767732711, "uuid": "dbe017d4-3926-4beb-a7ae-9cd064984968", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732711, "uuid": "de6c5ab9-0cb7-4e0d-b769-2a41ffa006d4", "value": "loolpalwill.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529884e4-eae1-11f0-a129-42010a9c0007", "comment": "Malware payload (RONINGLOADER)", "timestamp": 1767691392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691392, "uuid": "9ebdbdbe-8146-48d7-9299-ae146becd795", "comment": "Malware payload (RONINGLOADER)", "value": "b2aa96c55da7f7497a10e5bdc0387f58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RONINGLOADER", "colour": "#DA46D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691392, "uuid": "da8ba4cc-2cad-42f8-805c-b532970d3a21", "comment": "Malware payload (RONINGLOADER)", "value": "9c3a440c5b4dd36f5ac69f1a5d1b122dd7423aac36af6e01fa4e202532361d9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RONINGLOADER", "colour": "#DA46D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691392, "uuid": "bafc7a61-c8e7-4aa2-aa1c-c53f6a5d5375", "comment": "Malware payload (RONINGLOADER)", "value": "0c28bf65b377564b33a3e0e33118b7392872bc74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RONINGLOADER", "colour": "#DA46D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691392, "uuid": "e541d1d4-545e-4d9a-8aff-c06bdd15f250", "comment": "Malware payload (RONINGLOADER)", "value": "dd2363a04e78b8d03bbe17b718c7d343e7144211e1b60e60bb2535e276d6bbdb37e964ec6cd0c407e07ab0174d2975f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RONINGLOADER", "colour": "#DA46D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691392, "uuid": "b0c95098-307e-47e1-a332-b21b502bce39", "value": "T1FFD733914920D86BD8579FFCD5F149DCD0FB8BFDF8A6CE51AF0870112809A938176BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691392, "uuid": "a5058ad2-cbaf-40bb-9e1e-640ad88b3fe2", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691392, "uuid": "60d75875-9849-4f67-8cbb-8bcbbbd07b4f", "value": "1572864:PWnGQRS64Lprv6eIGA9hL7sC7rNNpcvyxKOKohY0fM+P9lnzl:Pmfp49pP+L7ZXrpUyxaou5el5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767691392, "uuid": "c7342340-b167-47a0-8da6-d2787f9eaae3", "value": 62908376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767691392, "uuid": "f981d79b-583e-4659-a1da-bc58ec78ad15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691392, "uuid": "ed2ba6c8-7e57-4ea1-b14d-54a4076dda3a", "value": "tsetup-x64.6.1.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70259c21-eaee-11f0-a129-42010a9c0007", "comment": "Malware payload (Heodo)", "timestamp": 1767697025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767697025, "uuid": "474783ea-469a-4bb3-b626-43776be5fb51", "comment": "Malware payload (Heodo)", "value": "cbf9cd24fe9c97b47fb3f2b6dc12f29c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767697025, "uuid": "53411068-9d1c-45ae-bb33-ca12b47d5391", "comment": "Malware payload (Heodo)", "value": "9cb74811ef737d14f351ac8476e8b9a736dca3834b1bd6104264b9ee48c9b576", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767697025, "uuid": "6221dd76-5e40-41c1-954f-55f9182aa620", "comment": "Malware payload (Heodo)", "value": "c3ccbfb3079fd24d37e44addb447a0f108b9f138", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767697025, "uuid": "e0e601f0-9854-4d86-8a8e-9cbe516a04a5", "comment": "Malware payload (Heodo)", "value": "35c526b199d71132d7721ba986b411ed93d156913122ae512b91d08308925377846c3003383e22bfb3be72e42ba8d8a7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767697025, "uuid": "1b76cbf8-f5e7-4166-a624-154345358351", "value": "T17A4633D16B90CD7CE8E747BD88039416C6B67C1A8790C6DB17A4631A3F6338198BFB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767697025, "uuid": "f91f5cb3-1e7e-4ee1-a011-bb5b6038b838", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767697025, "uuid": "29ce1fa0-7bec-4459-9692-5ad195fccde6", "value": "98304:Kjz0dNrfwYoLFnXfZLmNPje/jEOMhhb6gT05Mh15jQ0XKyGJm6q/740t3:SzGNTwhLFnvZLAbUEOA9655Sk0ax8j4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767697025, "uuid": "aafcd15d-ccd8-4062-83f8-d08bb9bf0772", "value": 5646736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767697025, "uuid": "db72864e-5184-48d0-a2cf-6209e9f6aaf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767697025, "uuid": "272e3582-6fb2-4761-9a10-99d63f42db06", "value": "clientv2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc45bfac-eae1-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1767691676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691676, "uuid": "29b68e96-27bb-4fe8-a81b-263aef91a16a", "comment": "Malware payload (Joker)", "value": "a33cdcbab5c216932bd0bbc5d01610de", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691676, "uuid": "88fbb34a-7f2a-47f1-a81c-52f03d9c6861", "comment": "Malware payload (Joker)", "value": "9d13ee6b298942940100fae19ccdf2f13c8ad9e174bd860debdd41f5a0a9eb08", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691676, "uuid": "6b174006-0723-4cd8-99ad-da90f41600f0", "comment": "Malware payload (Joker)", "value": "cb28a90fecc1ad874297ac1a186f1f21a9a2cc89", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691676, "uuid": "f449b31e-a0a9-4556-a55c-01fd375d9401", "comment": "Malware payload (Joker)", "value": "f8a16ed3137758535559f4c1c4963a046356dd035601e4266938d38ecf79aa1e97f779c56fd860647bb7c93077a62ac3", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691676, "uuid": "793bdfb0-d7e1-4530-ad23-fad980b657ad", "value": "T10CF027390AAD8C6BD114A3F402210509CB79898654D02ACAAE8EFF410AA6B68580243D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691676, "uuid": "0085cf78-1556-48ba-94e4-523b91954fff", "value": "12:5jmoO3SXBiflECf9AH1X8DWGUfgukVICNCJAHSPavt:9w3SXBifeCfA5+WGUfgj8eSst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767691676, "uuid": "7df54f4b-bc8e-4134-aa5e-083e99762c65", "value": 470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767691676, "uuid": "2510e0f4-e617-4107-9458-346a7c51c770", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691676, "uuid": "36df2b6a-2975-4d4f-add0-4ce9cb684eb4", "value": "Blood+Pressure+Monitor_1.1.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ba9076-eb3b-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767729971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767729971, "uuid": "e376794d-e395-4965-b4c1-fd8168ec39cc", "comment": "Malware payload (AsyncRAT)", "value": "d063a719b444ac9ad9ede125d1cce1e3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Net", "colour": "#889405", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access-trojan", "colour": "#13F17F", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767729971, "uuid": "b1f75059-2600-4560-8da9-e5000f839507", "comment": "Malware payload (AsyncRAT)", "value": "9d620e2a5b4a61ec9d8705516e36c9d5dcff7a4c8d441afeeec86ca9a6d27fe4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Net", "colour": "#889405", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access-trojan", "colour": "#13F17F", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767729971, "uuid": "9405d0a0-47e9-437e-a103-4b6ccf2b78d6", "comment": "Malware payload (AsyncRAT)", "value": "0210606540f3427e1119b68101357bce4673e428", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Net", "colour": "#889405", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access-trojan", "colour": "#13F17F", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767729971, "uuid": "0b5c86e0-dea6-4046-ab75-0865b71cd519", "comment": "Malware payload (AsyncRAT)", "value": "b43f05d7fd5c133a069e11b98bb4d29fb3ad8673854ab562d52f980caf4dacd31bc02b98b0e351e3b0a37d3555701846", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Net", "colour": "#889405", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access-trojan", "colour": "#13F17F", "exportable": true, "hide_tag": false }, { "name": "scheduled-task", "colour": "#0B0AA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767729971, "uuid": "939f8b00-d3d4-4b4c-b912-a5f739c621c9", "value": "T184534A0027C8C966E1AD4AF8ACF2854006B5D5732102DA5E7CC814DF5B9EFC64A527FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767729971, "uuid": "7cc1a522-ebb1-4f46-907c-34de6eb2c645", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767729971, "uuid": "090364cd-0ddc-4c0b-a2b8-9b3545888351", "value": "768:klKqYdqrXiP398iX9JaecXveeObMbNCl1+6SCv7mqb2nIpwH1otj8IVjh8GFjPcI:klrQNPeeiMl8GbbXwlIt+GFrcVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767729971, "uuid": "6f9cc0a8-c1a5-40e0-88df-05630371f4d1", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767729971, "uuid": "84f2cece-3f4d-43c0-b0dc-ed573524878e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767729971, "uuid": "8d7f9ce0-8ba9-43c2-aba9-fbdb73f18b6b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d713bf-eb1c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767716929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767716929, "uuid": "4c2564a7-6083-4c34-adf4-047c51226227", "comment": "Malware payload (Mirai)", "value": "6c0d34765e9d81a8b1d75fbe92fd642a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767716929, "uuid": "f981ee92-e6f0-43ad-ac8c-0e38d8628a96", "comment": "Malware payload (Mirai)", "value": "9d6aafc9c277bb26880933b244a646c444b4e855fb5a4e65217f08078f56a039", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767716929, "uuid": "4ba293ac-268d-4992-abab-475ac8d59217", "comment": "Malware payload (Mirai)", "value": "06ac71d444b945c05eda74a5ec2069c7ac444ccc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767716929, "uuid": "b2d7f4d8-ffab-430e-b122-094e001073a2", "comment": "Malware payload (Mirai)", "value": "eda0db070b301f561caca81a0b7b522c99a7c8e160e39ee878b5f22f97a9e4c021f04de6b77e70d48852ae85cf175c4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767716929, "uuid": "e3de9278-d599-40db-9ec0-a8082a16f654", "value": "T149C44B55F8809F62CAC52976F69D829C73134B79C3EB72069D144B383BDB86B0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767716929, "uuid": "f2cccea7-b2d3-41fc-aa89-d05a59aa4d18", "value": "12288:irgkFZLqS0X5QV1rYWA2wMIjDOCwhcgpZ6mKCI4V:TqLwQNwPUAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767716929, "uuid": "e3b22182-c545-4200-8eb7-a66483d3a68f", "value": 566440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767716929, "uuid": "98796faf-9ed2-4bdb-a81c-9c3211191562", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767716929, "uuid": "dfe0bf78-2655-43df-bcd8-cf28f0f00c04", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f80af5b-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767721129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721129, "uuid": "860e7f30-0afc-4df6-bfd9-329b4b443f12", "comment": "Malware payload (Mirai)", "value": "7b0122b5809aad1d3174a49a1c4473ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721129, "uuid": "8807e1a6-d070-46e4-b59e-6e77e3c4a716", "comment": "Malware payload (Mirai)", "value": "9d82f8e5e8b69994dc0144c208478805fbce879582feb50dbec5a404fb4a97ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721129, "uuid": "b115cb44-4ab0-4c92-a267-d1a787fe76de", "comment": "Malware payload (Mirai)", "value": "4072961270560b28c8f06efee8a3539cb1a90906", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721129, "uuid": "aba8b11a-4c79-4bb3-a6a1-9c4b51430d42", "comment": "Malware payload (Mirai)", "value": "98469c7f2bdc2adee743a0e2e1903a5d64f66916cd597fd70b064fda6489806bd4506b3b4f3e2dd8679193ccade1c98d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721129, "uuid": "9770562b-e24a-4658-91b4-70f43cddcfc5", "value": "T10E6312E829B259F7DA58877447B6BBF1FEED7130D5A5F1ACF87C90428E3A44812004E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721129, "uuid": "cb0e0c5a-3c60-4b23-832e-e17174e67083", "value": "1536:hlC3Gfiadk3jwC4BfVy0NMSodcgQXC9xOf1VGGv/ixMF/oru+:zfiaYf4BNUSNCDmnGgua/S5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767721129, "uuid": "9ec9f7bf-4be4-4391-9a93-410762284a67", "value": 71956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767721129, "uuid": "2539a5d8-9f89-4f3b-8afe-a4d3de87acc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721129, "uuid": "e425f476-5ffa-4159-bc29-c368f1c41928", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91da0610-eb40-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767732300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732300, "uuid": "94e9c821-fd70-430d-a1a2-0e1baf99b60f", "comment": "Malware payload", "value": "953e293143e02848f4696a04275ea996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732300, "uuid": "dc6c6cb4-5038-4040-953f-da65f19eea79", "comment": "Malware payload", "value": "9f0dee619a75f144e77177679279b88daaa6c374bcfc7308b522dc43edc314ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732300, "uuid": "93d21382-df84-41ae-bd6b-c3a8c35087bf", "comment": "Malware payload", "value": "8c0c9ff12c1f27d543da45e806a03e635854818a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732300, "uuid": "55de05b4-3ac9-454f-bc1b-b39352ae2286", "comment": "Malware payload", "value": "c0d6e3a7bf67b0bb2f38abe132a20d7eeadfde64451d52889a8f944a33e8ba0804533d3d5ba5f3099219c36f9871215d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732300, "uuid": "4f595e2c-42e3-429a-83fe-9a7156feec64", "value": "T13DE36B17B29500BBD0768139C8A31A06E771BC250761BF9F47A4277A2F337E59D3AB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732300, "uuid": "ebf2cb1b-4ecf-497a-a7a8-17a29fe5c060", "value": "4444e26a3946da401a0a2c3e1b1ddd6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732300, "uuid": "300625df-f206-48a4-8f1b-c009e4bd2847", "value": "3072:WUxPGRcPjlDt/E+lAspdXUC3fQkD+jLEu/jJUfk7268AWrg:WAPGRcPjlDtM+6KFU0fCHEBmWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767732300, "uuid": "2dd9fa63-4a0a-4337-b95a-4e5fa5b732ab", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767732300, "uuid": "939b7998-4c50-434e-95c0-516b7e9e4c3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732300, "uuid": "43c3601e-c32e-4232-9da6-732bfbc42600", "value": "RadioLib.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6f4691-eaca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767681451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681451, "uuid": "c16b45f2-8ea2-40de-bc97-e785704e0e02", "comment": "Malware payload (Mirai)", "value": "bcb5e2819864ba4c74a03dcebe4e8ce1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681451, "uuid": "1901f8ca-801e-4ca7-ad4f-f037785692c2", "comment": "Malware payload (Mirai)", "value": "9fc26f23fbc19eb52c6e833b7e0293ad3f54c1ae685e49d70b03ba8969ddfd88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681451, "uuid": "007db323-83bd-41f3-890b-eb1734db5f55", "comment": "Malware payload (Mirai)", "value": "e19aa582cb9aa549350af08d3a428d2ee831dff1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681451, "uuid": "fbe41b81-6adb-4f2f-aeb2-da7131e5dc7a", "comment": "Malware payload (Mirai)", "value": "e1a62413130b9db7007ef47acea9f9e2304d9a4c2554fd1c96b2d64ac48e5f22cf432377b4776a92c3934881c29d3f57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681451, "uuid": "4bf65e37-c34d-490f-92f7-82a67d48136f", "value": "T17B63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681451, "uuid": "c2d6546b-21d4-4f0d-a7c9-090e34003b61", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAH:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzcL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681451, "uuid": "60edf0ee-9e70-41f7-9941-a7570d35d28b", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681451, "uuid": "41b3d2d4-a318-4171-bcf8-c8a2c869b8de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681451, "uuid": "f4224e36-a2d6-4c32-90c4-d72e522f228e", "value": "bf58bd0b459c515deb90524ec4cd3f9f2ee3e664d89962840f7a02cb8ad831ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee08feb-eacf-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1767683708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767683708, "uuid": "2cc4d355-96d5-44b3-9141-4a4a6139efe8", "comment": "Malware payload (ValleyRAT)", "value": "8cb2393ce8207493aa2de29510652e09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767683708, "uuid": "e1676b7d-f40f-4f33-b89e-e5ef063a185d", "comment": "Malware payload (ValleyRAT)", "value": "9fe5a6bcc4c0aa78ba696cfae414d60b9a022384f2cd663978276ef8763cae90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767683708, "uuid": "92e20701-b1e9-4f64-adbd-cbbf06daf16c", "comment": "Malware payload (ValleyRAT)", "value": "9069c4f2327e48a24cb04af50ed88bc496c8332c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767683708, "uuid": "5e487168-c732-4f3b-ae1c-eee4cd7517a0", "comment": "Malware payload (ValleyRAT)", "value": "95caebb39e1cc94528f119e5630158a9443bc7673221956d3c581cd54b2686c03cfd211483e28b83af6c63fdb32e8f6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767683708, "uuid": "dd2cd644-bf4c-4184-a6a7-ea3feaa6369d", "value": "T100473394FBC5C064EC59F6B1093674FC31793CFD0AA88E3966827CD9E9772A4633250A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767683708, "uuid": "76da43b0-f249-480a-9422-7305e00a59c7", "value": "c220098faa84d4d9bcb744d4c28ee792", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767683708, "uuid": "2f56a0f6-d8c5-4630-9ae4-f876ed599dff", "value": "786432:JejHQSRFhuwwXYsFC0pPPn8dIL0qd8XmXvn:8P3OXYsFCQH8dXg8Xyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767683708, "uuid": "d7adeece-2855-4592-b410-05deabbc3762", "value": 26394112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767683708, "uuid": "0f0c0912-179b-47c4-be51-09f8e0264f26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767683708, "uuid": "6e946604-9eca-40aa-bb9e-7c91da654be2", "value": "8CB2393CE8207493AA2DE29510652E09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11739439-eb0d-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1767710180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710180, "uuid": "9ee91298-6e81-4840-9e05-c84828ab6870", "comment": "Malware payload (Phorpiex)", "value": "5f18dede706ccc017a7dde3bf10777d5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710180, "uuid": "42ee09c2-4399-4619-b630-98c84477ee0e", "comment": "Malware payload (Phorpiex)", "value": "a030ac4b770f87ded6b1c7c051171f02708c2d63680a9ee01afab2f2fa8c2b3e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710180, "uuid": "2e54eb8e-e499-48c7-b17d-862bfaa5ee4a", "comment": "Malware payload (Phorpiex)", "value": "bbd86c69c0d8f0fd4d57906659f223ea2a33f0fd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710180, "uuid": "f1c25712-42cb-4cb8-9a59-c1fca2c903d0", "comment": "Malware payload (Phorpiex)", "value": "575fdff79a97d592ff7880409131d30be02d90c300c91a64c7dd5c62611dbf42462bc43893baaa0f41fe847d3370d109", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710180, "uuid": "53385129-1132-4eb0-931c-de6947ec9ea7", "value": "T142921A1EE602D133D0A081B09163DB2F497E5772334634DBDBE06A5A69362E16D33F9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710180, "uuid": "9cc7fe8a-8273-470c-b08c-942710b06e5b", "value": "ab715c6137c66e37d651b98bf65b445f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710180, "uuid": "8401df1c-b7ad-4dd2-86a3-bb2bc59b20f5", "value": "384:e/Hh/MndbI2h5EEFSsbB5xFwAzhehw9fLUOQPcfD:E2nfFSsdFwohehQfLUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767710180, "uuid": "cb0427f6-22f6-411a-b36d-0e0c6d6300ff", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767710180, "uuid": "9b845fee-556e-4d49-86ab-e3fad8f7ed0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710180, "uuid": "ad5d38d9-413f-464b-9788-b818ed9f1d2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb8bac5-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767720967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720967, "uuid": "6126bc91-3b4e-485c-8381-9ab103762e0b", "comment": "Malware payload (Mirai)", "value": "420f1bd0d5cc9f93f802ff3f59dd0467", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720967, "uuid": "03bf0f05-9fe5-4420-a4b0-e916804de89f", "comment": "Malware payload (Mirai)", "value": "a09253fbdb351678310d4d3697d10cf88971e742c5dcf13b634ccd247a9157d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720967, "uuid": "1901bfef-9cc2-4064-adf6-fc20c3493fe2", "comment": "Malware payload (Mirai)", "value": "f1420deda0903d5c0cab1b57e15bdf976b92c710", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720967, "uuid": "4a5c7c05-e92b-4406-a15e-d2b0da7f8661", "comment": "Malware payload (Mirai)", "value": "e9ac38f41151d35c16b6adef92845b97ed705f18ca71e67ef2ea48b2528d5206297fd8434be04bc6853f8865461c0a40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720967, "uuid": "0a0a79fa-3607-4c44-aa89-19756d532ccf", "value": "T14953F1DA70F45913D5AB8978C3B876D7F67CB2BE2994E46210D4785C86B31083EE8C86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720967, "uuid": "4af36292-2f8c-409a-b0a4-a06d99d001ce", "value": "1536:2HQepzw03lEHJeTLzUTQtYXANH2YRCReV8yJARLqMsSr:klc0upefzYXwHNR38yiRLhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767720967, "uuid": "6617efed-023b-4686-a928-b92851bd766f", "value": 60756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767720967, "uuid": "1f6cadbf-39d2-42ad-b23c-61926fc070f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720967, "uuid": "fa6271c3-f9b2-48af-8c31-11198067efcc", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08fa0223-ead0-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767683967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767683967, "uuid": "65515930-9651-4661-9d00-3291cdeb19b6", "comment": "Malware payload (Vidar)", "value": "d1b976e6f7d07c2f3f4e9bd0d52e73c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767683967, "uuid": "aa60647e-c51e-4731-af7d-f60707a96e34", "comment": "Malware payload (Vidar)", "value": "a0d4e99d0549a70f1b5e385bbc3226c0faa4cacf82808c69ec5f65f862c7064e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767683967, "uuid": "5fdab5e9-157a-4baa-a856-9e61cdf79172", "comment": "Malware payload (Vidar)", "value": "5bfe805a92e9c193b6aafc77fb03c61822431313", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767683967, "uuid": "6650c4d6-6c58-4d8b-8e57-56dd5b08abb3", "comment": "Malware payload (Vidar)", "value": "de18039786356a55960dfd4d774f08e3861d167df92035996c80bc70b2e67a1dff5a7ea88be7b89d4f05097569051f20", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767683967, "uuid": "84311969-527e-4526-835c-8a1e9f3631ba", "value": "T15B764983AE409225C59BE17AEEB561697230B084073113D3BF771BB58DD6BC8173B72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767683967, "uuid": "645ac08a-f9de-4309-8587-b6bc77ff9b48", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767683967, "uuid": "f61ea393-98d7-4da0-9640-3638513ffa86", "value": "49152:a4XmDrb/TWvO90dL3BmAFd4A64nsfJFN1OS37OfiVfdyun0kd/NJG+CgdFc0K1Qk:a4grzpTICQek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767683967, "uuid": "f1e8b45d-ce3f-4915-b966-0ca02d93d8c1", "value": 7501952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767683967, "uuid": "2c4059e7-6ef4-4d15-85ba-94966737f126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767683967, "uuid": "c5872da3-0031-4e61-84f4-2f267f9cdc75", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a88f1d-ead6-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767686691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686691, "uuid": "86e5aa36-1a97-4ca1-86f3-0a7e307ee738", "comment": "Malware payload (AsyncRAT)", "value": "05b6f7b5ffae4b2dc8ad2248f6a30f24", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686691, "uuid": "8ea48a01-5079-45d0-afcf-6da1824bb761", "comment": "Malware payload (AsyncRAT)", "value": "a0e8440b32b727eea98fb4937acc077191ff046dba07d24883c0b1a0847eb3c8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686691, "uuid": "2d688a16-133b-4e7d-93da-03ae16dbd0d5", "comment": "Malware payload (AsyncRAT)", "value": "7425cf0e09ab9cdf022311d8ec6b847e86efc451", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686691, "uuid": "704ba8ce-b88d-4464-b628-1993cc471442", "comment": "Malware payload (AsyncRAT)", "value": "90521bb7369ae8d81232362f2aca82a193fddaa9aba040003630c659f1762085aae769376995d888fd72b005cfc0a9f4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686691, "uuid": "c24c67f9-6f55-4209-ba70-2c62225b7208", "value": "T134C21B0473F48262D1ED4BBE48339600D375E58B5D13DB9F2EC494AD2A23BCD8A25BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686691, "uuid": "cb317b70-b433-4527-8c58-e1b22f52c3e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686691, "uuid": "39f0a592-cb34-4e4a-aaa1-c069a7cb5ad0", "value": "384:oQaA9XyfjjzgeRSQkeKwMymrJhxYHqqbuUsJQxnCJf+BWfXWs/Iu+:oQzMjjE9Qke3MyCJhx+FbHBFBvu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767686691, "uuid": "6b5831c3-8dda-41bc-9b8b-6d95bf2d7429", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767686691, "uuid": "855def86-0087-422b-9da5-a4285d7b8101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686691, "uuid": "92506f3b-578c-48b4-8514-e10cecf5ca87", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1633a01f-eaca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767681412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681412, "uuid": "4becb8f9-a9c1-4d4a-8bfe-3f9ef7ec4c0b", "comment": "Malware payload (Mirai)", "value": "d8b4095f8ba6303c0b91634913983939", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681412, "uuid": "ec312736-2769-4782-b0ee-7619541dab49", "comment": "Malware payload (Mirai)", "value": "a1c0ddb250d0736b740304169b9376832f1caf201ef5cb2f319b952933dab839", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681412, "uuid": "36007e97-c894-4520-8e52-6e6e7b1e4e58", "comment": "Malware payload (Mirai)", "value": "7e9cd76f392d5bd4a2959566aa147b218166eedb", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681412, "uuid": "e6cff3da-d605-42ea-b6b9-1ce4a8181378", "comment": "Malware payload (Mirai)", "value": "682abb3d12f96932ce3e49c8a4cd267a7b782556d0c7b8b056c1daeaf1d6d4d2b01cdff3cffa940d055910913c34ec23", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681412, "uuid": "f975d42f-0fc0-495c-a178-6e06535ef416", "value": "T180B2D0CD61943084CA8D7C7C1B8D4A664FACA1D0BAEDCB16E354CDD8B3BAA4B345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681412, "uuid": "cbbaf87a-f032-472d-a592-6fe5f5ca21f9", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpklZqSWvq:4QlS07FUXqIYSXQKqukbqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681412, "uuid": "7982ecda-5f3c-4205-a7eb-abd199e36099", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681412, "uuid": "b8426fd4-426b-4dd8-8c35-8081d5a62fbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681412, "uuid": "11164f0c-a082-4b56-bbe0-0aa8ed53bf84", "value": "a1c0ddb250d0736b740304169b9376832f1caf201ef5cb2f319b952933dab839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c6ab6d-eaa6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767666223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666223, "uuid": "8c3fb8f7-198b-42f1-8cbb-63446fecd622", "comment": "Malware payload (Mirai)", "value": "42c0f228a05974e728c4d6fb032e0624", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666223, "uuid": "96c395af-a978-4430-a3ae-69446d93a231", "comment": "Malware payload (Mirai)", "value": "a26056ca3842489d4e4037dbd08c7dcc2005c19b082d113c73a5694967e84d09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666223, "uuid": "93e13073-3d23-4476-928a-19cebe292290", "comment": "Malware payload (Mirai)", "value": "08fa35596af68775264758f66b65f68e96dbc8b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666223, "uuid": "d02e5d6a-ad5e-47bb-8ad9-a2eb3054f52e", "comment": "Malware payload (Mirai)", "value": "a6fa38990246cf4dd06991e8e66483079f53650f30c30a8437148d6a4406881b82d9000ccc43761fdfa18edb4f4f5b79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666223, "uuid": "cb0c177f-3460-41e0-abb7-5b1e9559d890", "value": "T1DAC45C59F8409F91CAD529BAF65D929C33030B79C3EA720799245B343BD78AB0F3E641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666223, "uuid": "1bf861d9-5b52-4d30-bf4e-cf48aa98dfac", "value": "6144:s27NpG5VLS3Xv8SLFH2XK89pXVBOugqgvG8zmo/MIAfO9JIweb3ckg3gpZ6miVL:s2wVLSEkGKtbNMiIweTqgpZ6miVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767666223, "uuid": "5805ccb7-31d2-448b-bdd2-e1e0a5c98fd9", "value": 553924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767666223, "uuid": "a5d11a71-93e8-48f7-913e-818c107deccd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666223, "uuid": "7e195032-64d3-4622-9e80-f4f41c7395b5", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e08feb2-eacd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767682714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682714, "uuid": "1d33a659-ef6d-4dfa-ab43-774c45e3af0a", "comment": "Malware payload", "value": "798cf871d6b5b30e9e22db80fdc90b98", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "Libya", "colour": "#251A80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682714, "uuid": "0b0d8a6c-adff-4257-b7b4-016066491ff5", "comment": "Malware payload", "value": "a2b0e6aa79caf6180cf51d93e20b75026bb5ca3c4682cb80f321f338cb4ab147", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "Libya", "colour": "#251A80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682714, "uuid": "15674f84-d5cf-4ac5-9586-c389d7b08be0", "comment": "Malware payload", "value": "55f3a28953eeb30ebb2d4a1a49bb16d57ebec3cd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "Libya", "colour": "#251A80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682714, "uuid": "69f531af-5649-49a8-8bef-ca161e582c32", "comment": "Malware payload", "value": "0bb0efbcfc0faea5f33fc9472318d1ac96157e596c9050b89af2c1a43f636a26a726d015d59b9ffb031992badae84623", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "Libya", "colour": "#251A80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767682714, "uuid": "0354424f-323f-42a0-b03b-a76f42341904", "value": "T14DE61227F7496E6FD8F7A334693B13A654196C258F03E18B7828B33D29B34C59A5B1C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767682714, "uuid": "f363b5f9-815a-4fdc-91db-7a730f69aac1", "value": "393216:cG4QCOX3/UXQyC91TjDm97ZQ0OBh4WtxdA+IN:chgMIbDrDh4udSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767682714, "uuid": "6c34227f-cdcd-4e20-853f-e8c746440749", "value": 15246947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767682714, "uuid": "a0193944-20bf-420f-b180-eb1d4e3d8ed4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767682714, "uuid": "18d250f3-76ff-47aa-bf72-69fb2d86bedc", "value": "masrifi-plus_Malware.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7147df-ead4-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1767685875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685875, "uuid": "b0f05b07-ec18-4e15-a404-31e30d69d214", "comment": "Malware payload (ConnectWise)", "value": "57bf43a3ede5191333449fb491547944", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685875, "uuid": "67d35f2c-8da0-4444-98b3-87bcee86964d", "comment": "Malware payload (ConnectWise)", "value": "a4c10608db883e2691dd4d2b600e94a6db7f3ebfae2fbc55bb0a5a43febae61b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685875, "uuid": "ae38c203-e812-4b60-8aee-9f32dbff0f60", "comment": "Malware payload (ConnectWise)", "value": "550486e90482cd3fa37c156b99674dd93c100709", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685875, "uuid": "5f176ecb-f4ad-422c-a3a5-45951ac68b4b", "comment": "Malware payload (ConnectWise)", "value": "bb3d09aef6bc7fe9b1458a9c681abda48806a6adfe438a2b9213e07c0f8baa01b8960c4e7bd433e13e9dc4b647ada352", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685875, "uuid": "2014e603-d942-4826-b592-14ddad068757", "value": "T18F2123061C0D964C74721397009F8988D5ECC685CD5848E77A9BCCBF54066FC86BC1CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685875, "uuid": "4b14735c-66a3-477f-9f23-aad5110fb60c", "value": "24:Z79KSoja/RTE1uivQBp3IPJoZ5/vNL3v6oz5DWOJbp7es:nGja/O4iWpYRoZRxBvRhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767685875, "uuid": "f0a6433d-4531-4db2-9fa7-90962de5de37", "value": 1309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767685875, "uuid": "410e5c25-7817-447b-b11b-aad598bcc229", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685875, "uuid": "22457a39-4289-4c3a-9509-5b4c1ae7f089", "value": "SSADocument-Claims.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ed54c5-eab1-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767670938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767670938, "uuid": "4b04893c-e5a4-4d53-948d-6c6bb8513d4f", "comment": "Malware payload (Vidar)", "value": "ff32331e1483c36171e5bd0f607a5e63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767670938, "uuid": "0a488e36-5096-4082-bded-5e3513cb33d8", "comment": "Malware payload (Vidar)", "value": "a5733c1eda2aee6798095b113e5b01686113d7e692c1c0c2a911ca22f15b5719", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767670938, "uuid": "a1214fa6-2803-4e4f-942e-8351fb19d427", "comment": "Malware payload (Vidar)", "value": "e2f97cfd3ba99d817108273c64cde5102d0b6828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767670938, "uuid": "97b294d6-ec0a-4563-973a-f9685515670c", "comment": "Malware payload (Vidar)", "value": "9b74a40f7a5fb4226a02aa06fcaa91654f48cd43aeb2ac4286a8ba8b037cf6e083276f864c7f66fb900dfd90afc8e9ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767670938, "uuid": "a61edb78-6325-4876-8a49-4f4e9af47366", "value": "T187C4086EAC60E362F60C90BEE285D3534E1578510636AAE319BDD32412498B3CF577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767670938, "uuid": "041e12f1-8519-4a41-86ad-d3c35868ad8b", "value": "01a26b45683b1e37ac006ab3f19e7aa5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767670938, "uuid": "eac28427-dc79-4d91-9ce3-4699f8b0e172", "value": "6144:N4xEdGse9NMXPk5Ay/v6VNF5oJiq1IrSFzbsX1pKEWWcNim2SQNtBXC0bSePY5+/:69n1IrB1pKEUCA5BiivCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767670938, "uuid": "54763a01-cbbc-4fd4-a6e2-1ea245e4b54e", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767670938, "uuid": "42aa01d4-3fd5-4562-a0d0-c48fd0ff69ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767670938, "uuid": "62adb5d4-7996-4579-8103-8fff2ec8ea46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7e9c46-eb0c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767709934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709934, "uuid": "0bd9799a-8abf-4f5c-98cb-9d57d9e78dfb", "comment": "Malware payload", "value": "049de082e7cb313bfe8631e5d03d70fb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709934, "uuid": "8b04579b-d821-407a-832c-7b43ff7b8193", "comment": "Malware payload", "value": "a5d512a60a8f143de06511f726cb40d40f8966dfcb19a3b9ee85486c2326e192", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709934, "uuid": "dee157d6-e565-4ffa-92d0-cf31f4d0aaff", "comment": "Malware payload", "value": "4c52ded3f8b99e613b287935825701ce9b9990e6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709934, "uuid": "6c67f943-7e2b-4c68-b116-385f0669b23b", "comment": "Malware payload", "value": "2bb26e5ef8c3e9c1b5d1ab5ac69af5af7ffc0f48b31cf82ead5184f402df3e78a28ac0bb6c68a795f18e5207e4f8a1d6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709934, "uuid": "f62d3eb4-9fde-496a-adb6-a542934b9d34", "value": "T1676402331ED7469DEC643FB85B93CE080396DA9E4212E5D4E590229AF27CF260C784ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709934, "uuid": "a04f873c-b9b6-41bf-9ff5-999ffbf785ff", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709934, "uuid": "24baf7a1-f993-4a78-9346-ea6c1fbb0ae8", "value": "6144:H0mlk5ClDW6tAop/ih1WdvFNMim2JK42gw/6eUrXHasrtlNkeyf2JU:lq5mDWk/iDWd0im342XyedsrtEeyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767709934, "uuid": "07bc623d-5bba-4452-8b87-86d161c68586", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767709934, "uuid": "d0078ec1-f350-4f75-8588-bdda45a69bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709934, "uuid": "3b5351c4-23e3-41f5-be1f-b9288ebc01e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc29c3e-ea96-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1767659061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659061, "uuid": "5d69dec5-a137-4ebc-a469-5f4ba52d39da", "comment": "Malware payload (Gafgyt)", "value": "2ad24dde37606ce27ea5d5eec2636c95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659061, "uuid": "b5d81679-04bd-4fd5-859c-2e1beb886cea", "comment": "Malware payload (Gafgyt)", "value": "a5f035343b91205375751e0fb4d828aef261532508ef80129ffe7a9ba8a30ed0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659061, "uuid": "05141d61-1009-4f5c-9ae4-c6335dd03b0b", "comment": "Malware payload (Gafgyt)", "value": "a33d740f2023cdaf966326e13ea714f6dd3b031b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659061, "uuid": "2531890d-ef6c-48bd-9568-75db8f0b0125", "comment": "Malware payload (Gafgyt)", "value": "bdc8c20906f95e2fd09f9b60a14ef2a0ec13bb0bddbfb8c9087930747f94051bba4db14d1385e53077a2855b7f43b7a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659061, "uuid": "f4870703-11ca-4284-a6f1-6256878f75bc", "value": "T1DCC3390AB5D1D9FCD868D2B42B9F6126D430F168113035AE3788AF1A3D9C9293F6BDD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659061, "uuid": "2b54c09b-ee27-4120-b076-74d65a3548da", "value": "3072:8ejl229mViR8izu7NVpgu3cd1G1kC+CaiF76I7e6GL:8uE2A0kP3EYztpcDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767659061, "uuid": "bcfeacb4-a3bf-406d-ad73-b80e8e473cf4", "value": 119416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767659061, "uuid": "5af67287-8964-4c2a-9d44-60ce65c34541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659061, "uuid": "b8f96243-daa4-4bda-8e4d-1c91e18ce0d6", "value": "rondo.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4be3ccf-eadf-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1767690671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767690671, "uuid": "9437ef5f-38ca-43c1-9e4d-ed5651cb0931", "comment": "Malware payload (Gh0stRAT)", "value": "3eb026862a5187cbedd3c49ff40b5820", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767690671, "uuid": "8746e569-467c-4809-b721-29e580cde6f6", "comment": "Malware payload (Gh0stRAT)", "value": "a826133b16e78530d1b391fe51c4097e135e83838e6b39a58e1eabb98e883e65", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767690671, "uuid": "ebcb8148-7b5a-48ea-8cdd-47b8fba0b087", "comment": "Malware payload (Gh0stRAT)", "value": "b48409915a900c9aef0c89d71a2c9481cc2730dd", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767690671, "uuid": "07b7a5ec-399c-4c83-b60d-a7a10e23033d", "comment": "Malware payload (Gh0stRAT)", "value": "ecfa35770774bcf706011a9a78902f6798309e9b042ad9b5ea5404ad0f539d576a452cd17a6c59a72007d9d680fb3979", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767690671, "uuid": "4db3d5fb-d35e-43c7-89e5-14a94dd4b9dd", "value": "T1A6573316769BC932E65D117AE869FF1E0878BEB3073021D7B3F9796E84B08C153B4642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767690671, "uuid": "6633f861-9807-4c70-bcce-0fd052bd8488", "value": "786432:QigJFf+IrYZ/iIT1ciiH52jxf0I39HeZI:QnJF2Ik/7Tw2jZ06dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767690671, "uuid": "d2ebee4a-459c-4bff-9ab6-e33dd46ba26c", "value": 28437504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767690671, "uuid": "328a8cbe-e6c3-47d9-b721-d3e4138cdb29", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767690671, "uuid": "8c41683e-a55d-44d6-bc8d-fae6be35c0fe", "value": "ChromeSetupx64A-9497.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2c88a5-eb01-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767705231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705231, "uuid": "8ddc50d6-3cc7-4a05-8d40-e9dab248e5d4", "comment": "Malware payload (Mirai)", "value": "d500bb88e94c7adf7915338958d07621", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705231, "uuid": "3782dd87-0821-4a2b-ac0c-6344942cb526", "comment": "Malware payload (Mirai)", "value": "a93d680be343103edd02547e64ecb255a9bdaf532056ea59eef656e161ea2f27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705231, "uuid": "e28a2571-ed75-487f-b8f6-fcdc59efde93", "comment": "Malware payload (Mirai)", "value": "9421cbc4de8fb70611e3cc3cfbdb64f099b821a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705231, "uuid": "aae54f2d-8b9b-4983-ae6d-a27811725360", "comment": "Malware payload (Mirai)", "value": "49ab2f8acc54f5f484841fad53c9c3401b89c89c37d432bff9aa7fcb6a9be78096149841183a49693a53788c6c5a2f71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705231, "uuid": "11876a15-3bce-4854-a547-0e99ec2017a0", "value": "T179432A95B801EFBDF84ED6F582160A0DF831626154530F23B767FE932D710E2E92AD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705231, "uuid": "1ef6a6d8-0946-4519-b4b4-299bf5397320", "value": "1536:uh0WUw7nsZ/K2YwtfM/3qXQJreBeXyy8rvq:uDUviXWM/agmeCfvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767705231, "uuid": "d5ac925f-a9ac-45f3-985c-6b310cb9f29f", "value": 60120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767705231, "uuid": "6865d5d3-484c-4002-a802-44866fb154e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705231, "uuid": "566018f1-4a01-41d0-8c51-46aa6e7323a3", "value": "Fantazy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43488632-eaef-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767697379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767697379, "uuid": "cba811b2-fb72-4f33-9d1c-e90c84cad521", "comment": "Malware payload", "value": "75df136107d22ff513d6b0d50484eaee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767697379, "uuid": "ba1630bb-be35-4e09-839a-c9b0fc4c4049", "comment": "Malware payload", "value": "ace2a44b81a78f4c2a71d7e26583a0824db60b14733ab23b6da6dd652e51b753", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767697379, "uuid": "efa22ffd-a7b4-4bfb-a7c9-1685d9ec55eb", "comment": "Malware payload", "value": "784906a72daaf3e15137a3134225fb307a64faac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767697379, "uuid": "2b4cd39c-2863-43ef-9f41-81636cfe0a0e", "comment": "Malware payload", "value": "f3ca03a92a3281b2c58a5b90693308abc6d0343922e28898413e88aaa565a25f63a66287bab3cd968ef7673b004fe3c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767697379, "uuid": "d2603a03-306d-46ef-8eb3-e9ea82986b28", "value": "T1DCD633C4B3950AF0F8EBD3BDA4C1A85663A2F4714B6486970BBA5DA10CB32D5FE34750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767697379, "uuid": "0b829066-58a8-474d-a27b-b883cc17303c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767697379, "uuid": "5129c192-b2b6-481a-8ca2-d707dd08faf8", "value": "393216:sPoEUAdW8p5W+tHjd+pqizZ4/JLwqvy9bmim6XR:kUAdW8p5W+NjyVVutVvydXm6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767697379, "uuid": "97f65377-2c92-4bba-ac01-ff7ebe65649d", "value": 12827680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767697379, "uuid": "34a92963-d159-4592-9fdc-e37fb56d2ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767697379, "uuid": "f46502c8-7eb9-44bf-846b-201d7a5316ff", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7bbff3-eb01-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767705229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705229, "uuid": "91f0a0b6-5ba2-4262-8b4e-814f37c60dfe", "comment": "Malware payload (Mirai)", "value": "5315247f6f4a58a20def98bd228b480f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705229, "uuid": "e3de767b-b546-439f-acb7-918608a56b03", "comment": "Malware payload (Mirai)", "value": "ad24186a6e0d6f2a7be977e27f35ddbdf32cfa847bb2bf1a1244f16b61382bea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705229, "uuid": "3ea0c5bf-227c-4372-b2e8-aea8c5062c64", "comment": "Malware payload (Mirai)", "value": "1d521b726613abb43581cb211f306b32bc85a455", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705229, "uuid": "4e107b28-60cd-4fcf-8644-0bf4b3892e89", "comment": "Malware payload (Mirai)", "value": "15f6d3ee3bedfd9f1502e7a06043a2db8c4533a40f80149465f4f35d09459d5a4a7e627805339107e87b0dbded1d36ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705229, "uuid": "f8f5f4d8-1a35-452a-ad5a-c7d92094d8b6", "value": "T16B534C85F5C385F6C81B4838A0DBB37FC631D9A94071599EEF8BAE36D63BA41011239D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705229, "uuid": "a981a465-4166-44e9-bdb4-dd5602caef4c", "value": "1536:W8tlDaAbLfE/YQNlvFU32cafxh3zAh22Cs:W8tleH/Yj32cafP3zAhfCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767705229, "uuid": "07d1ccf5-e8e4-4f66-93a5-d1c776a9756f", "value": 62256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767705229, "uuid": "1d452a80-76ac-4725-ab30-09658ad351ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705229, "uuid": "3dc91780-c553-4273-b39e-2bfb604e7199", "value": "Fantazy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5315e22-eb32-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767726427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767726427, "uuid": "8d1616f6-679c-4d5f-98dc-3fe10f20e86a", "comment": "Malware payload (Mirai)", "value": "e790e0acb21806550363b9e80722107e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767726427, "uuid": "524c8cc3-b478-4ac9-9c7f-4ee5ab5e2934", "comment": "Malware payload (Mirai)", "value": "ae7d48dbb204e660cece284d025b70b50effaf3d57f261d2807fc046f12a4b94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767726427, "uuid": "4225dbec-4805-4c2e-8ccb-ab83fa0411c0", "comment": "Malware payload (Mirai)", "value": "3dfff804b691c5c77f55a35c2d8a3d882cf7338a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767726427, "uuid": "97a117e3-a826-437e-a145-634c6ef538d1", "comment": "Malware payload (Mirai)", "value": "91b4814ae2b51976a09f6908ca247dad01bae794140261addaee22803483f699c144e3e8cce795c0e54e28e3eba3ec3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767726427, "uuid": "0a45c124-8550-4a08-a09b-acd852451bb1", "value": "T1A4F47D63BB218FA4E325D27005F38B256A9412A20AF785C5937DC6107B50B6E2C5FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767726427, "uuid": "0184db5f-8767-4e29-89e6-556fa556e4b5", "value": "6144:V49DyTEoEn1XKXiE8hDdRGTpZo0CPeLomlT+At8HKqlfUq0cDv2kSugApTQ7sTTM:K9OOzWPH+28JlHdnS1+TTG6gpZlZJsCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767726427, "uuid": "ab4e0964-b03f-4d4c-9f3f-6bdbeb1ca1b8", "value": 730456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767726427, "uuid": "978aeb9f-56aa-4e25-abe7-3d2b71f71d0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767726427, "uuid": "c8be6cf4-721e-46cc-8c94-577d184c5904", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721fa63d-eb0b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767709484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709484, "uuid": "dbc80ba7-4106-4579-b126-5cda224434e8", "comment": "Malware payload", "value": "2b948b20315f5ab79a116883f94a5285", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709484, "uuid": "50859c18-3d22-4cfb-b0e2-391ab7f778d0", "comment": "Malware payload", "value": "ae8a62a4533461369eff0b51828dbb86b7f52255de9a9244bb5d4e5677365f52", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709484, "uuid": "21e01482-9a63-4017-ae71-17b02ec861d3", "comment": "Malware payload", "value": "b0cc2ab9ee9f94f2ea0985a1e43208b978fc672e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709484, "uuid": "157a4451-21e8-4ddf-bcfd-ded4548cd3d7", "comment": "Malware payload", "value": "c97d9c0865a5cbd4c7774e1e7192a3b87e357e6010a7658e1f805866a059b55665c028c12ee316892fa351b5b6f69930", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709484, "uuid": "7ed2312b-4ae6-40fd-99aa-214659df8c33", "value": "T175D1AFDFB379D20DFA3B283DC8812626FD28D595E7A873806A2C95C2B1161CC7178078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709484, "uuid": "9239a870-1dc8-4cfa-88a3-c7317546c2a7", "value": "96:ZSztUVgEakHn9NZ/r7ZEQXbh6jexTaYdW1jebJDW54Adpao6c/ZVckay4C1mEv+3:CEx9j/rV59Now8ebECg6c/ZVcwhEw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767709484, "uuid": "813c163d-a4e8-431a-809c-53d068ec07aa", "value": 6528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767709484, "uuid": "24c2cab1-b733-48a8-bf8d-0ad42d044257", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709484, "uuid": "dfdc53bc-a7be-427e-b1e7-1e5ac0c58d98", "value": "salary_statistics.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f5aab0-eb1e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767717598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717598, "uuid": "f871009c-0909-4409-a8a3-fe999553df11", "comment": "Malware payload", "value": "f6befdb49fbce2f777bce4a0ef6e9408", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717598, "uuid": "fd98460d-5521-4be6-ad1b-f422de92da5a", "comment": "Malware payload", "value": "af9b09fbf857b4dc0b90e65aa3df173f00ff52e0e6207f6b31c35c901a576f9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717598, "uuid": "8c7eed0f-7b9f-4336-afbe-e42d1bd9fb9a", "comment": "Malware payload", "value": "5ba990bf8e1313d7efb232075a369b4ac9cba946", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767717598, "uuid": "2ef86ece-b45f-4047-a3ad-cd93afe53461", "comment": "Malware payload", "value": "b112fcd1f50611dfc00a20c9eefb98e52de0807bdaee2e5c62ff3f758db8d81098806929710672d33dd29900b8a9aa1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717598, "uuid": "3656072d-1ad2-411a-b20c-3c3975588b52", "value": "T15C56331279E0C57BE1E22731DB154BB087EBF6350E25103737CC294A6F7A28EA549B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717598, "uuid": "1b4c796f-6fbd-4bfa-bf82-9b254393b932", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717598, "uuid": "7b4d081a-5631-4e0e-9ccf-ba8db22dcb18", "value": "98304:xLAIIgCgxelIbGOwSVow3/wtaZjf+n4dW2vbLkCmBUrgFtMxMPo3LaXWwSNfcuF+:RrZKAoO/OiT84d1vvkNVHiMPo7sucB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767717598, "uuid": "ac5302a8-4f45-41f8-91af-3ff48fb6032b", "value": 6291456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767717598, "uuid": "ed7b620c-f49c-495e-b956-8c86511d991a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767717598, "uuid": "64e9a4cc-2125-41be-bde6-def9d39bd3c5", "value": "exodus2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a35458-eb1c-11f0-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1767716925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767716925, "uuid": "025bf3cb-eafd-44ba-94e9-192ac169be62", "comment": "Malware payload (GoProxy)", "value": "9ba61fb2a982729d7492e0dd9b1d4ffb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767716925, "uuid": "59ccba7d-522a-4e93-8b30-50cbf0b640f0", "comment": "Malware payload (GoProxy)", "value": "b3c7a1b37fc4d3df3f7e4aa2d827eb8604888f0440f5c5f4b6b75fb46edfe52b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767716925, "uuid": "40c77b47-8fb1-4fb4-a9da-9515607c89d8", "comment": "Malware payload (GoProxy)", "value": "532cf0f7fb2046fb6955b11fdb731a991a575912", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767716925, "uuid": "ab838e56-b6d1-4805-bd8a-6a058263fc4c", "comment": "Malware payload (GoProxy)", "value": "aa8a8296ea6d70980e826cb522a26f9c89075642bdc471e266b9565e97be8d9d70e5f2c4f95853b908e76de46eb5ed8c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767716925, "uuid": "b252b73c-2aeb-46d5-bfaa-194cc2dc8371", "value": "T118665B43ECA555E9C0A9E23189A79212BB717C485F3123D72B90F7382F72BD0AEB5750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767716925, "uuid": "03c6ceb3-f575-4813-a61d-05f9b2785130", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767716925, "uuid": "02a2da6a-c46b-4c57-aaab-7a1344a2a6a7", "value": "49152:AT3gIOjhoecmD827Osn6BsDVy8zwOHvGALijeju+dLV0JbMIeZgjsz9dUk1fKiK+:AkBaMNXAvgvtijepRrbz3dbHEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767716925, "uuid": "f4d9769b-be3f-4026-8d70-0703deb20740", "value": 6574448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767716925, "uuid": "86b84842-20ef-4ad6-bdb4-e1342cf971f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767716925, "uuid": "0ab96ef7-d127-4fd1-b3a3-997479ea4ac9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccf6738-eb4a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767736479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767736479, "uuid": "a3c1606f-5a3a-427f-a6f5-7332aa63b722", "comment": "Malware payload", "value": "4979fcf8120f48e92e38b759dbad2dc3", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767736479, "uuid": "bf983abe-b6f7-4a68-b9b7-68c92580e817", "comment": "Malware payload", "value": "b43c7934c08e5609d55c54ce36e3227dc41ff7d9ff0dcbb5ee05448c45c6719f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767736479, "uuid": "44a47122-6f29-4a50-8617-fae78075628c", "comment": "Malware payload", "value": "5a67ddbc32637dba85d74e60f87708cb4f5b63da", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767736479, "uuid": "12765552-01f0-4a8a-8af8-cbfe348dd0cb", "comment": "Malware payload", "value": "20f12646e0f75d2809ad7bcbfa3a04a20d4c97e317ae789d42ca150e1a397b3a1198c66befe14286a9ca8608d04576c1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767736479, "uuid": "2a186874-82cd-4470-878c-8fced31c7737", "value": "T1D1D53363AE097E6B46BC523E909B890CEB710FD7400CA5D673E4F0CB4B2D91B9877469", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767736479, "uuid": "68c70ed0-9531-4909-baf5-b1023a21c4ea", "value": "49152:3kquX7WNAYqRy/kTEN7+YaO+zMjp+vLljvcnngf:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767736479, "uuid": "fb3aa4f2-f445-45d2-8f6a-9ab4a3fe430a", "value": 3010781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767736479, "uuid": "00e9235f-64d8-4540-bad2-98e6c9df6cf5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767736479, "uuid": "b714ec18-9bfd-43bf-b375-1cb49ad82b86", "value": "payload_1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc211d1-eb16-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1767714441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767714441, "uuid": "141ebe12-73b7-4887-85cc-880c55f2965a", "comment": "Malware payload (MaskGramStealer)", "value": "8a14511fc26b6eb98c190dac64d87edd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767714441, "uuid": "b4c37701-5ba3-46a3-95bd-3027d5d15833", "comment": "Malware payload (MaskGramStealer)", "value": "b5ccaa59ccb00639ce88665e2a3bd5025e284e106bef24fd7911f6e48661d1b3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767714441, "uuid": "3b50185b-959f-40a8-89cf-bdd5d9fba9a1", "comment": "Malware payload (MaskGramStealer)", "value": "dc41e0d4b7ec1eaa5fbf951b39438d59097259cb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767714441, "uuid": "bf676b01-a339-4c48-b266-26c5fc47170f", "comment": "Malware payload (MaskGramStealer)", "value": "3f6b71663044cb3a35ab707afc46e143588f32cec4325971e82c9ecb129a5ec7fd40742df879cbb27c2c6e8c52e7cd07", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767714441, "uuid": "91ef73ee-3484-45d0-a80d-725a283429f6", "value": "T1BD9533654E49E23EF46EA23F59EED0542587E39F2A1B4EAC4293404DD06FF48090FA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767714441, "uuid": "1733aa65-15d8-47dd-ab2f-6ad43e48ef8b", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767714441, "uuid": "cefff3c5-a68a-48a2-a039-7099123458bf", "value": "49152:vKo62V0vM03KSaoFJa7nPMd5p+6E/KxL/Zo:vG+0U03KpoFqE57llo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767714441, "uuid": "f0e9fdf9-a95e-4faf-a251-025a67b5e78f", "value": 1940480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767714441, "uuid": "8100e656-1d34-45a3-8968-9c9d7cfbcf08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767714441, "uuid": "a35485c5-c592-4ef8-b2e5-4acd128cf165", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e842c1f-ead0-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1767684110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684110, "uuid": "d3916891-310b-4aea-8f81-a3d23cadef9b", "comment": "Malware payload (PureLogsStealer)", "value": "55508d207e4fc0cd70ac16f11b267375", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684110, "uuid": "ebd6699f-5120-4f54-9adf-d2cf2c81d343", "comment": "Malware payload (PureLogsStealer)", "value": "b61f479b41cbe22f801be4689f1d00123208cf9f1b2e8afd50b7f784fdba6898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684110, "uuid": "441b3838-5c23-4f4f-8f57-c0413c939215", "comment": "Malware payload (PureLogsStealer)", "value": "02c395de6ee3f74635117235b1ce8ffa07e5ac7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684110, "uuid": "a2d529d7-4c42-4844-b999-e458cd7430c6", "comment": "Malware payload (PureLogsStealer)", "value": "a193d9c411441c0de48e1960f6c8467b64fb67b7285757571e36e02511ed96d74c14ff2f5aae0587119ea4327baa8f5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684110, "uuid": "56549281-9a69-4808-af18-f1f4396d113f", "value": "T1D4F4F15033A9DA02D4A29FF41571E37447BCAE9DA920D3478EE6ACEFB539B016C10793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684110, "uuid": "6d10b423-d3b8-4efb-9841-66e213e736c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684110, "uuid": "8f71e28a-f9ab-4205-af92-67971ad1b887", "value": "12288:MQOjWVC8M2Vh5UqUoryJ3MR/TaWzdgqP2aymmNVwUvCT3HuN2kx2:oWk87aqFyO1mWjgm2Pv+Xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767684110, "uuid": "9bca41d5-e57a-484f-affd-be1b72de4b79", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767684110, "uuid": "55dd271f-cfc3-4c8f-8428-eaa85b5a08c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684110, "uuid": "4552726c-01e3-4527-b123-e13c25cffa53", "value": "SecuriteInfo.com.Variant.Genie.8DN.1756.11734.32204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968e0648-eac1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767677762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677762, "uuid": "01a029ba-22c7-485e-90d6-373493b27312", "comment": "Malware payload (Mirai)", "value": "2184f59001b2f20afad2466e5982103a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677762, "uuid": "15d89746-3d8b-40b8-9c88-d7432d9a86a9", "comment": "Malware payload (Mirai)", "value": "b68fd0e15767f110f2f20c6226d97c33b4dac8327b63cb28a16ff90fff1c1986", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677762, "uuid": "cf489afb-06b7-441c-9a23-5ddf299c8da7", "comment": "Malware payload (Mirai)", "value": "92592b3d97eab5ce09a6692150474447a40d0dee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677762, "uuid": "ec6c4b10-c25b-4a93-9162-48ab5c594f15", "comment": "Malware payload (Mirai)", "value": "05db6e0dccde1d00737b9a941009b98ea2b32d90be03a73e62881d00b4da4740b9716789835ab41c9d94b085dc50b533", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677762, "uuid": "76eb49ec-9712-4fe1-a54f-57e64914afe6", "value": "T15FE329C7F800DEFAF80AE33748570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677762, "uuid": "a5499831-929e-4dcd-95dc-c039708ed7cb", "value": "3072:GmzTDH86JM781q5lZjApqGidS8w9aeVvjbieL/VCyIOH8Vn:G2TDH86JqPjApq3du9a4LcyIrVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767677762, "uuid": "e262cde8-4645-4c79-8e80-0a9a13f2dca5", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767677762, "uuid": "8d79be77-5524-42dc-8647-1d2962b3748a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677762, "uuid": "9f629218-55d3-45cf-8dc7-44ca12f12566", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330f4b79-eb45-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767734289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734289, "uuid": "492e6469-88eb-4b3a-866a-ce8f4b584287", "comment": "Malware payload", "value": "886e7458aae6fc02fc228702761725bc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734289, "uuid": "147f32e4-a969-43dc-8b46-81c857455482", "comment": "Malware payload", "value": "b71cf215c7fc346a51d1f0ff5c7163188c109c9b5f21bc05b8592117c61dfab0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734289, "uuid": "218932e5-38d8-408b-906a-3596b4050528", "comment": "Malware payload", "value": "65ba77fc92c4680c88ff8d7e458c4e5c4d333956", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734289, "uuid": "29237139-f98a-4772-8b76-cf4e9e99100f", "comment": "Malware payload", "value": "f30e284c89aef6cbd4283656cbfd334bbeb621ca0977dc45448c7efc077831ff005e1c817568d8049cb191247c07b1f2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767734289, "uuid": "8bc77a06-dc48-4c8e-9586-f6839e13d36e", "value": "T1A503E1194F74697DC7B3033212A5AD6C9510F3D87E12C29443EA0CF7F51798A59139BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767734289, "uuid": "b2650145-5119-4c1b-8a6a-2d4631f6397c", "value": "768:XK5Y4WI5P7DVX+4tC6P9l9BaEvEz+S+F39:XK5x5dCc0m7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767734289, "uuid": "b6593159-9adb-4f0c-a4e7-0646011cf6ce", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767734289, "uuid": "2941180e-7bfe-488f-8e24-528e421fd480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767734289, "uuid": "acb48457-925b-49ea-afac-d9292b9ba273", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add76378-ea98-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767660192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660192, "uuid": "62d29663-f598-46ae-9555-79c7786c47dd", "comment": "Malware payload (Mirai)", "value": "5bd1928fd97a89c258b79c89b5886850", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660192, "uuid": "b479d2e2-3499-4381-9588-cb1180043aad", "comment": "Malware payload (Mirai)", "value": "b873558bf89dfc0a83a87b252a5c2cef23f3fef21ccf21dcfb7b3dfdbd3803a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660192, "uuid": "e6fe789a-1f14-45e3-b3f9-215443c04681", "comment": "Malware payload (Mirai)", "value": "9fc7c38a28915002c85835699c187bb7db9df974", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660192, "uuid": "943e3fe4-c247-4557-be82-9b1704ae56bc", "comment": "Malware payload (Mirai)", "value": "61b9d5546a9fb0c6deea6ddf3c6134655586e6bc0d2e8e2688ac8c9131c0f0ba04d9abadc893591884277f85b7c5e8c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660192, "uuid": "7c499df5-e282-4d39-8d38-7579375ef356", "value": "T11973D8166E26CF6DF76C873647778E219788339227E0D642E16CED009E6034E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660192, "uuid": "58a292e2-af5f-434a-9adc-da567ff5b15d", "value": "1536:+94Xn4aNHqaVKLnqxvwT6a/Iv/+9v//RD3LnFDIXup7RxG:W44AHqaVFFu3LnFkXup6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767660192, "uuid": "9d4f8263-4bfb-4f0e-ac6a-00e8073ed950", "value": 76228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767660192, "uuid": "eeae75b3-18ca-420f-ae27-4f3cefeaba3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660192, "uuid": "e7d82d6d-c967-4010-8969-98d70eae1cb1", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c2ac1c-eaca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767681443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681443, "uuid": "cfbab1c2-1fe3-45e3-9f1b-334ec5414a71", "comment": "Malware payload (Mirai)", "value": "b02cf3a0ea2f0b85cad01f1fd7b27511", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681443, "uuid": "a8b18cdb-2491-4eeb-8174-49df6842380a", "comment": "Malware payload (Mirai)", "value": "b8d2b8fb79e79497518bb66690cc7fe49ebad1aa91609d6bbd8f48abc15d3edf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681443, "uuid": "fb8646b2-0ffd-4c67-af0b-483439ae82c1", "comment": "Malware payload (Mirai)", "value": "496231b81359bf23152b2331481f67d47db26479", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681443, "uuid": "1dd73572-7c3e-44dd-9093-a484347338e6", "comment": "Malware payload (Mirai)", "value": "65c503aa8641d1039794d971154badf100d42c7968d919107f72cd95d6b5b7046b512bce122da5aaa2910c1cd2e95051", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681443, "uuid": "e4b04224-09a9-4f00-80db-0a382d9b04f8", "value": "T1ACC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681443, "uuid": "de381468-2a75-4802-bcc9-e721e21ac108", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHo9rScVM/9OAvjik:cowpuQyNSG24a1styKdlTuI9rSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681443, "uuid": "bdf82061-73df-406c-821c-48ab4e548ff2", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681443, "uuid": "750b2dfa-43f0-4608-a03b-dc39a48a302a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681443, "uuid": "be7e7e8a-690f-494a-a0ed-a0e25d551426", "value": "b98e193b30abfb0e77c1221ec2b0d7f31905a5e0dde8c74bdd8397d700f18927", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563c4b86-ead5-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1767686244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686244, "uuid": "d47aae03-4373-4e02-8417-f3f386a99f57", "comment": "Malware payload (AgentTesla)", "value": "1c5b3e12956288361f375d11ec684fae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686244, "uuid": "bde29215-40d6-4241-b665-2205202d6954", "comment": "Malware payload (AgentTesla)", "value": "b9276f217842d170f4c9f4c82afcb837f4a819a6349831808ee08c1eb6c8afa9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686244, "uuid": "c8b30c45-87cc-46b9-9c33-55079f31bfa5", "comment": "Malware payload (AgentTesla)", "value": "5738745e15d1ae3902d1e4d50d2a88e00c2e027b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767686244, "uuid": "1c949b96-c831-4c92-b5b4-e527f8b5a5e2", "comment": "Malware payload (AgentTesla)", "value": "4b19d0f10144a44467295733fb041576cdb25ff6f80bf807780c3e0a120fd13ffe81f0d2678f40768e49561a96cb3f30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686244, "uuid": "2e4ab4ab-a73c-4766-bafe-93581e30785a", "value": "T1B7359CF037688A47C5A6D9F30623CAB04375EEC95602D2DADDE1FADF34B8B015A15227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686244, "uuid": "97c962d6-02ac-45fb-811c-0880df719e11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686244, "uuid": "ad600ea5-e64a-4d47-a7f0-86785e17fb07", "value": "12288:X2y9saRuN2kx0A5h3SHE9qgH2rKY3My7kBLZBwUVs4TMWmklOSck3wja5TpYk11+:GyeaRrFA/Sd+Yc++lnrTMbScAwmTpLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767686244, "uuid": "21139141-7597-4bde-bced-2da4669b1893", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767686244, "uuid": "1427f8e5-fe42-4cef-a9f4-2a39bf1e2339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767686244, "uuid": "a070fc15-0bac-484b-99b7-9b3cc4bf2330", "value": "Dekont-20260601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e67015-eaca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767681385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681385, "uuid": "7f7b1975-2665-4d90-b92e-d595d14f1071", "comment": "Malware payload (Mirai)", "value": "cecd1d57763572ec78905d2fadc5eafc", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681385, "uuid": "835b9fc6-d901-48f4-8d08-d193e74f6d7b", "comment": "Malware payload (Mirai)", "value": "b98e193b30abfb0e77c1221ec2b0d7f31905a5e0dde8c74bdd8397d700f18927", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681385, "uuid": "414391ef-b5be-438a-9851-26627d482e79", "comment": "Malware payload (Mirai)", "value": "bc968598eb9ef55edaa5d11997725e272af0a198", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681385, "uuid": "00225094-4972-400f-a5be-393d3032ba13", "comment": "Malware payload (Mirai)", "value": "ed9fee61477a3daf9ea3e01bd52416f5175fe3a5ae720174fb93d81e24eaba9fd2bccdfc4de50fe61341275e214e7223", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681385, "uuid": "1221abe9-6cec-4b22-9ff9-5cae2b943b3d", "value": "T19C230271890E9EB124303C72DF99D793B6F11AB2C6673023D6180A386F757131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681385, "uuid": "e97a78bd-f546-4386-a41c-82ba7d885f5d", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b339q3UELbUXfi6nVMQHI4vcGpvq:DECFd+A6YHAxGLRQZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681385, "uuid": "6fd1cc0c-3690-4c84-9ce4-48d35b11eb57", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681385, "uuid": "a7c8a764-9049-40b9-aacd-168cfb57a384", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681385, "uuid": "947d1a23-dd7a-4883-bae2-6060be8bbf2f", "value": "b98e193b30abfb0e77c1221ec2b0d7f31905a5e0dde8c74bdd8397d700f18927", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1779a5b2-eb0d-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1767710190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710190, "uuid": "539fb818-5042-413f-baef-a067982a46fa", "comment": "Malware payload (Phorpiex)", "value": "7b0fde40c81321e54fe06c25c1b80443", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710190, "uuid": "5d6836b9-a7ef-47d9-97de-a86c104e33fe", "comment": "Malware payload (Phorpiex)", "value": "b9b52cc15fa1c03663a49c10af56e8f7aaa786d7688a75176d6fbfb779e8faca", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710190, "uuid": "c12ada2e-9b36-43d1-9fd3-daff8775d88e", "comment": "Malware payload (Phorpiex)", "value": "5918aa7a343aeabf81df787fbe1c45986724a12b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710190, "uuid": "4dc422aa-297a-459b-b0bc-f31f934d6f43", "comment": "Malware payload (Phorpiex)", "value": "ec88f8bcb9f2c6ca9af1cf6d0d6bef82b7afd93325dd2aba71359f8de90d4aaf7ed8dc19159105bb38bc14a5e9279971", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710190, "uuid": "982e80db-8d46-424d-b236-b6d0e17587fd", "value": "T152823C0BBC51413DE4C144F85236AA7E8DB958BA378169EBF3C045CD89785D2F83A91F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710190, "uuid": "9095c67c-1e09-4d85-b398-36a82eb7b006", "value": "51c161c9913a4b650517329371c6046d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710190, "uuid": "3daa1b5c-7b09-4145-af79-1cb705d38a42", "value": "192:i7wioLPXbeng7GQxN/vy4zTP6DcVD5xYQEZeaymJr1KUSh+zwzwUSJxTopHB9ctS:B5X/NScT3D5xlE4ayou+slScpHB9c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767710190, "uuid": "5ac07854-fa0a-43f2-a5e4-c99ba9ea61f2", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767710190, "uuid": "339f1fbe-626c-4687-8b30-1a1090c8baaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710190, "uuid": "d3b9a5d6-6d8a-40e5-be55-99ab7e093af3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a36caea-eb16-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767714168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767714168, "uuid": "7e5afcb8-cbf0-44d9-b709-504f99a0d67c", "comment": "Malware payload", "value": "0ce760d53f9847094a869e569684b8f1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767714168, "uuid": "2b35b03b-302c-424f-9380-81ce9b1b2f61", "comment": "Malware payload", "value": "bb21b33ed8c55610a40454f754710260e88ba058a222cb02c39661007ba98680", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767714168, "uuid": "f2813791-b0dc-4786-83e4-a066b7c6fe16", "comment": "Malware payload", "value": "9ee124dd862d12723839f75b81c1cc95b47e59b1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767714168, "uuid": "fbb480db-a633-426a-88bf-1e188299fd15", "comment": "Malware payload", "value": "d86a3e7dc9e841a1aadb85e224d33d856280027234f80b09f83405eca5f8b4db5c39f0bdd1b59d9d061a8329bfd07312", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767714168, "uuid": "41ffb4d0-cbdd-4813-aeda-663c8678bde4", "value": "T11E61AAEBA2C247306DA95973A3ACD504BC89E1F379962E302DF924FEE44CE443344957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767714168, "uuid": "d441a240-72da-4428-9424-f28f1e3eeca8", "value": "96:ih04hzphaqh1zhprhOGhgMhZHLh8ghbZh3DhGw3hO2hD0:a0Azjai1dp1Oeg0Z18obz3NGwROuD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767714168, "uuid": "efaaefaa-6d0f-4c7e-818f-f55c4a9490d0", "value": 3197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767714168, "uuid": "3ff473c6-8471-45fb-817e-0f88abc74d7a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767714168, "uuid": "740ce051-538c-4c52-905b-0d01cb7bf28f", "value": "newreaxe.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97c6404-eadc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767689471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767689471, "uuid": "dc65ab27-d4dd-4e28-86a0-2ea53a415d9d", "comment": "Malware payload", "value": "06f3ea853442728f1753b1a0e49b825a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767689471, "uuid": "a5eeb429-4f40-4f4c-a354-ebc3752df029", "comment": "Malware payload", "value": "bba7457d311c19971a5cb3ff3047edbd4a325a1fa2017024ad5f229720851d83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767689471, "uuid": "39feb790-eb82-4895-b99e-d7b1effdb294", "comment": "Malware payload", "value": "a099c85ed731df387a7923903bb1e0a543b7859d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767689471, "uuid": "c51bee1a-2fda-42a8-a823-a71c90d5828b", "comment": "Malware payload", "value": "61287630f6e4284c78a208da77b44d8465be474ca0b6b6fc069f3f57cab8d2a12f4f78d945ace2f66f4ba1272907c3e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767689471, "uuid": "40384cc3-7c2d-4dcc-ab44-cf53f2da73e4", "value": "T117673367BD98755AF7F2B660990FF7BD7E70149711C1E403A0AFB28A80E3A1748C606C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767689471, "uuid": "e8a00d68-aa04-4071-938d-d5d739b26455", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767689471, "uuid": "ea0379a4-4108-4ab9-a1b6-798c56a92b22", "value": "786432:QeWBhvN9jPgzX8KXGxZZUcLza8Io98ZRTVGSb9c:L8790T8KWZecfv8xb9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767689471, "uuid": "cdfa91f0-5d92-47f1-9d61-48966c360e76", "value": 31946240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767689471, "uuid": "0255f5bc-b490-42a7-8cf5-8d8098ad947d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767689471, "uuid": "c0090caf-9ecc-4218-b73c-7c24270470f4", "value": "anonsnos_cracked_by_expecto_tools.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20be6812-eaca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767681430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681430, "uuid": "71064201-a8e6-4d78-9d6b-ec2c5f0d5820", "comment": "Malware payload (Mirai)", "value": "d45dc7509946a434c34e21754a23e9dc", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681430, "uuid": "7f321f42-8d2c-4849-add8-5c1e4dde0945", "comment": "Malware payload (Mirai)", "value": "bbd43861fc8cf38d1df5e7f8946d7d6088b8c6d2dacfba5bb395bc74a8e4dacd", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681430, "uuid": "74907665-3ccd-400f-ab87-c76827ed9022", "comment": "Malware payload (Mirai)", "value": "a1372da01c908319d058beab3c17cd6e1283cdf3", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681430, "uuid": "eee1ec64-0526-4725-8e8d-cbac94357566", "comment": "Malware payload (Mirai)", "value": "b8c8e891a9dd4cb26ea8efa8780b10aeb131fecab7290c2aa31a3943497fc4405851fc0a1fa83465d51dec1200fa6a70", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681430, "uuid": "e1b48d9e-ce42-4dcb-b3d8-636df9f9b055", "value": "T1C7A2E115BF18818BC832297551D9E9D21257FC71F2EDCC192A40C16FF1A33A96874F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681430, "uuid": "57b7c8f3-9ed7-4dd9-97ec-d0915d6c7afe", "value": "384:MsiLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKY:G98o08kxofBE+ZkXaqGbp2F2TWul0c5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681430, "uuid": "c2cc5349-70d8-4f40-835e-83fd46efecab", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681430, "uuid": "5c533fd7-f5ed-4400-a137-9d7bd78b2d1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681430, "uuid": "fe978543-afd6-4e6a-bc2b-fdf0e2d5704d", "value": "bbd43861fc8cf38d1df5e7f8946d7d6088b8c6d2dacfba5bb395bc74a8e4dacd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53be30ef-eb3e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767731337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767731337, "uuid": "33a13cc3-4971-49e6-8d6b-e91afa2f9002", "comment": "Malware payload", "value": "3922dffcb1a94dae996244fbc5b050ea", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767731337, "uuid": "b0c308dc-ec65-42d6-9c7a-c671b3e6dba3", "comment": "Malware payload", "value": "bcf13c1e79ebffba07dcc635c05a5d2f826fe75b4e69f7541b6ce6af4a5e31c0", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767731337, "uuid": "702d6bf5-0b18-4d69-8d27-60eebe00da23", "comment": "Malware payload", "value": "23bbbe871452e02d1ae05f57fec88f39e90c7e8f", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767731337, "uuid": "92e69f8f-5728-4597-be8f-3f0e90b4dda4", "comment": "Malware payload", "value": "03e5c0087b7f19dfd45a02215fe7b2ce8136c316b31fca7f642a762b5af197dddedbe8119099554f74f87f80119d9bf3", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767731337, "uuid": "036ba740-a9c7-4180-9edd-789e1dbe9e0c", "value": "T15B97334569112BD2FE36B630F7F2176453A0416586B2CEB7CE1C03D96E83FC5ABA442E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767731337, "uuid": "2ba05576-2631-4837-9352-a781916e08df", "value": "786432:bTWPxduZzPhutQX37iLluSuE1WtYWh7o/mbe3XVcdkrpgaFHNZly/9gPtBljOh:bYxduxP8tI378QhWWJougFcdktpNZA//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767731337, "uuid": "85972937-0ab1-4b4f-97eb-26fdee4ced2b", "value": 41523044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767731337, "uuid": "78999847-5fb0-4122-b85e-eb922260c4a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767731337, "uuid": "7a1bdb35-9f6c-4630-8a95-51b45d96bc59", "value": "byte", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc40d916-eb10-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767711863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711863, "uuid": "12f4dffd-b930-4f88-8fd1-08c0dda625b5", "comment": "Malware payload (SalatStealer)", "value": "8469ddefa50d753897370922e81105e1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711863, "uuid": "b3518ac6-33f2-43d6-ad00-a3cbddc37af9", "comment": "Malware payload (SalatStealer)", "value": "be3f92f8376e736404aaf25660dd273d640a21169f18eb7d212b1e8b980ec55d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711863, "uuid": "eb6cfc10-2898-4b08-810f-50361edb2e44", "comment": "Malware payload (SalatStealer)", "value": "be3cbbde6a14e603fad7e773bf0e7ad0b0a86048", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711863, "uuid": "2db0c8dd-184f-4377-b6ab-f2db0723ad0f", "comment": "Malware payload (SalatStealer)", "value": "afcc9c82ec806a714c61118c56598b3026b974e4c3b1d61af8189790d7556a62109de225a2cf889eae977c0932bdc591", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711863, "uuid": "08ac652a-7d65-4012-872d-2c143c556abe", "value": "T12AE533F0DD537E4CF75DB4B2B08898A73B5A59C78BE012877116DBEA0AAE21F74408D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711863, "uuid": "e1363cb4-c1f7-469c-8e7a-fcaf44732eb8", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711863, "uuid": "c35167ee-f0d2-491a-a500-ea9163978873", "value": "49152:Mc7MsYa6Uhnp0YqhjKqOmZXMt3+fnreJSFfadz5orVVkiXG3QWiarAihWYZKhXX1:7Y0LqdKqOmMcmz5277uPAihW2wXXZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767711863, "uuid": "27412877-8d8d-49d4-a5f6-5ca8e2969b3a", "value": 3291648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767711863, "uuid": "f9e003db-3069-4020-895f-6b3288077928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711863, "uuid": "44443fc0-a122-404d-af68-68ac624a7a50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44b093f-eae0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767691126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691126, "uuid": "58ff902f-6216-46ff-8a42-7bd2a8c0f4d6", "comment": "Malware payload", "value": "bc2c2170c893a0d80794380f3ef0666e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691126, "uuid": "e96ee8db-1a8e-4616-849f-1acc51a6caa9", "comment": "Malware payload", "value": "be5fa45db4f6eb3dabab120f880f21612fd0084bcdc53e90116dede1358b215f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691126, "uuid": "33e67443-4ff9-4d07-8914-a1d0f4469f84", "comment": "Malware payload", "value": "e7c68153b7dec17dd6c4c61a20fd5518ea6b0a4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691126, "uuid": "5da03da9-5de9-4169-8d56-acaa8909fcc6", "comment": "Malware payload", "value": "215dfd875d039662443c07823a460a74c717621d2969889524bdb9cb4fcd1c8f2125908e074b659068f0d4779c1a0f31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691126, "uuid": "9d59c2e4-33ff-48c7-9112-469e4626e8f7", "value": "T1A9768E03ED91499AC5AAA635C9A782927B707C486F3257D72B60F33C3F767D11AB9300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691126, "uuid": "d873563e-3ad6-460c-a0b1-50f934e625fb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691126, "uuid": "6fae5a9d-c957-432b-8679-67334e549746", "value": "98304:FL1FKhUHEQTrVttEVLzDNEynIQkWlJMgHQf/B54lR:FR0uHEQTrVt+VL2ynHlJMgw3IX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767691126, "uuid": "d74e08e9-68da-4c3f-b87f-ea6a7cc9c99f", "value": 7211256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767691126, "uuid": "02b3ffef-5bb5-4889-8f6e-e39ce40fe219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691126, "uuid": "7a3f032f-2fa2-453a-aabc-5d10f32216e4", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7c4ae5-eaca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767681421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681421, "uuid": "e556719e-888e-4919-851b-bcfb62369ab6", "comment": "Malware payload (Mirai)", "value": "eabd6db1db24a58fe287395c47dbc77b", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681421, "uuid": "d2e601ca-0fea-40f5-bfb7-796d3d7c0e54", "comment": "Malware payload (Mirai)", "value": "bf58bd0b459c515deb90524ec4cd3f9f2ee3e664d89962840f7a02cb8ad831ec", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681421, "uuid": "851d07fa-9f48-43af-b3a2-2a06ba8b3f5b", "comment": "Malware payload (Mirai)", "value": "d1bed79cfdba48d447d9964c97c83dbe2fed22ef", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681421, "uuid": "6d966c97-bacf-4863-ae20-6a166fa1ce39", "comment": "Malware payload (Mirai)", "value": "4bdfdea5e4cecd0515ebb1db0c6a60eaaf5ea997aee25a98e49592cbf4471a155874cd45f82b7f2d020c7fb63d429a8f", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681421, "uuid": "4cb6e1b2-604b-41a9-8916-19de20c9605f", "value": "T1E6B2DF3C1B111F99DE1EC1BD83AD0B603CB81B7591829D4B6207ED97AF964747413BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681421, "uuid": "969fa3f5-679f-4701-a860-676e3cc72e87", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiHymdtJgGlzDpH7uNj1JAA:YeD8ZSWvZHZbs1row697qohQvg9SitJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681421, "uuid": "2d7c6834-19ca-488b-8ca6-e98c14ca3358", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681421, "uuid": "9743b4a6-16cd-4655-9622-ab71642f96d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681421, "uuid": "8432d208-7518-411c-a65d-cafbee8ef7f2", "value": "bf58bd0b459c515deb90524ec4cd3f9f2ee3e664d89962840f7a02cb8ad831ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30467580-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767720969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720969, "uuid": "8f704bda-dec3-4c0b-91c0-a024b321a2e4", "comment": "Malware payload (Mirai)", "value": "f10dd5d061f49f5165f7eddd797089b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720969, "uuid": "cce73f64-2b64-4841-95eb-dd6cfc49ee8e", "comment": "Malware payload (Mirai)", "value": "bfb9992f05345fbe650a8151a8065a902c35d01e8c86862cfe218de7ae569ecf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720969, "uuid": "dc144123-a571-4a62-bc41-cbfe638521dc", "comment": "Malware payload (Mirai)", "value": "68539cfc9445c1de5141555db8b86617763b6125", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720969, "uuid": "2a42f999-7e11-40d7-9dbd-c264e7ae1f53", "comment": "Malware payload (Mirai)", "value": "e59a658148a385e0dc624b21775ea3d83a98df972565af5d9cd25c32b53dc80c76b3dcb48553abc2360f83555a1bdac3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720969, "uuid": "62bafd8d-e178-428a-bf04-cabd37d82d32", "value": "T1B5D3CF31F400ACC6DC210AB434BAA5B80B61AFB407D62582FFFEE95A9477D4439BD271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720969, "uuid": "d75cb556-ad45-4d3e-9ff3-ee5553eb54be", "value": "3072:+SaGSyl3UPm3+T1hC5x6ELmVkYC6szU1:+SnlkPm3SZJVkYCno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767720969, "uuid": "59902ca6-b2cc-4418-82a2-4aa040427fae", "value": 131676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767720969, "uuid": "58399457-2849-469f-80a4-b341e378076c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720969, "uuid": "3280acd7-a9f2-4e28-801b-25b9f828193a", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d59aa3-eae0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767691147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691147, "uuid": "130f7089-404e-4c89-b67c-a1276fc80942", "comment": "Malware payload (Mirai)", "value": "4e4e0b558a461e824f11d8ad032cb68d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691147, "uuid": "a08a5a9d-15a6-4ce1-a172-a9164e1a3811", "comment": "Malware payload (Mirai)", "value": "c1eb0d3ed2ddf5d918f2b9eeffe21a5c9fb25b0746899dc42ba1d16633b4b2ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691147, "uuid": "6dc8320d-d30e-400a-a1bf-ae3a4618f0ca", "comment": "Malware payload (Mirai)", "value": "a475254c7bff8b0cbaef271323591f66d9345058", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691147, "uuid": "8fec4a91-184a-458c-84e2-090b20b85cb5", "comment": "Malware payload (Mirai)", "value": "5688b18e6eb1fc80996b068c6c0c7d4bb579d9d01d3e6579787d37c5023fc150997be64c732bd14294f6510ef94b8bd3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691147, "uuid": "f36714c9-15e8-45cf-8441-ebc2e5582525", "value": "T1A101E1EF70105662169C8F5062B71004F945C8E5AAB12F399ED414F28FD67083B5CEB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691147, "uuid": "5a348d09-2070-4ba1-a57a-869fae274e51", "value": "12:mgyNgy3egyhNIlengyq0LKLgAOAgk2gWDj3gjfgWtZYgugMhgUuv:mRNR3eRhNIURxKLb5n2ZX3CfLtZYBlhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767691147, "uuid": "32aeed27-2c06-46da-a4f4-793519f7c8de", "value": 742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767691147, "uuid": "5a9207ee-816f-48e4-901f-4ef88b51e47e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691147, "uuid": "e3373939-1df9-4707-bf00-cef075d29475", "value": "c1eb0d3ed2ddf5d918f2b9eeffe21a5c9fb25b0746899dc42ba1d16633b4b2ee.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c9c8d1-ea97-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767659832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659832, "uuid": "abb67b80-1cda-4826-875e-02dcd8d322fe", "comment": "Malware payload (Mirai)", "value": "0b1ff640904a8280d9f06596a5307f75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659832, "uuid": "9a0cb717-196b-46fe-829d-2c0e3ac49901", "comment": "Malware payload (Mirai)", "value": "c2d5b7f36e74fc7dc72f6a73dd234caf49271be45d0806b22d1e23b2cf8967bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659832, "uuid": "8a88e5de-c29b-4dbe-8c6f-2ce25928cd72", "comment": "Malware payload (Mirai)", "value": "bf49574d3b4809044b13b975fe93bea25a088ba3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659832, "uuid": "3dc9c809-d41a-468c-af5f-ad80b1c48b16", "comment": "Malware payload (Mirai)", "value": "e493378dce0b983a1431777333a8f1783ad2dd69087b18ded1a977f5cdd204ee2f16983fc04dd65b0daa3121080816ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659832, "uuid": "0e43bc41-9ffa-4183-9b28-0d69347c09e9", "value": "T1E8530945BC81DA17C6D462BBFA1E41CC332553F8E1EE72079D116F257B8A82B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659832, "uuid": "f68c7734-9e48-4987-b991-89543efd3ce5", "value": "1536:TXVld8hgFPGgmaM23AKxnn6lZ/D3rFur7R:TXVldp3Vnn6lhD7Fur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767659832, "uuid": "a99e14ba-eade-490b-8d7d-c5f65b4507b5", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767659832, "uuid": "fa7ea5be-c2d0-4766-814c-3f71b728a8c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659832, "uuid": "0f192b6c-4787-40a5-9469-802a96c805fa", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5469a00-eb05-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767707073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767707073, "uuid": "a9c2f47e-afb6-4f71-9369-6c23d670796c", "comment": "Malware payload", "value": "a06b4eec98b55fc148e80d7198cae7aa", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767707073, "uuid": "163b8290-83ab-4976-b660-70b43109780d", "comment": "Malware payload", "value": "c2e797ef17558bb54a7fca528b3312a5af68d8668a6e96b66fb4e11c6c013399", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767707073, "uuid": "6315b85b-8e6f-4bd2-bc07-91bed4aa33b9", "comment": "Malware payload", "value": "daa3789729a1e819dd5d5ee89b168c53fd6dfd2c", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767707073, "uuid": "4c5ad032-9ee9-478b-acc3-f1700916feb3", "comment": "Malware payload", "value": "7ae0eb84f6b44441512789e2ff95ffb842b713fc2c44d14348bf49b8cc6568ee5d7ded913176a566fa84031d88434330", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767707073, "uuid": "4f514abf-24cb-4dd6-99f1-6f7e8096644e", "value": "T1B052B4614C4B105396F2C19EBA5DD803EA23722316B2A053F5BC4364AFB2175DEAC57F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767707073, "uuid": "d08f6eec-5a41-4f07-9594-42f433a6b98e", "value": "192:/Vbac6rsmMVs0qfF605GfFlIiWt+vykaHXjrw+vKd24kEJ7oFHlEjGv8qeSglKRc:/Vers1WFcmGdlIiWeuT1K2eX9m1qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767707073, "uuid": "4d48f7df-7a73-4fa4-b538-e66cad0fc63a", "value": 13347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767707073, "uuid": "b6432136-ed0e-4fd8-9dd8-45f73212a868", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767707073, "uuid": "0663405d-0d7c-49ad-80be-095ce34c583c", "value": "spyder.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad31f41d-eb02-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767705717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705717, "uuid": "c4671c87-d345-4cc1-9363-23ccc54d856a", "comment": "Malware payload (Mirai)", "value": "cdd574f847108f4c93aeb00fddbeaeb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705717, "uuid": "8bddf3b5-8d37-46c9-9994-53ab2241e475", "comment": "Malware payload (Mirai)", "value": "c3508a0f82231e945c1e5fde31a84ecf32146e5387e21e36c7ad65ebe83707fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705717, "uuid": "02f6c7c2-8f34-481b-ada6-e7130b9c050b", "comment": "Malware payload (Mirai)", "value": "1d0e5ce16e455843145ea03e2bfeb1107b2e76b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705717, "uuid": "7215d5f1-43b0-41df-92ae-bcc0d925cd41", "comment": "Malware payload (Mirai)", "value": "09af1ec9de44ad18fc37d00e2c0b24eff989b2a52b6762bdc6aeb4ee48ad5662e204a48e91e7677368270b8c0ffe0623", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705717, "uuid": "8546f7ff-cc44-4ee9-bf06-1f63677a573d", "value": "T182968C03ECA555A9C1E9A2318A729252BB717C491B3123C33FA0F3386F73BD46A79754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705717, "uuid": "ce96802e-fdf1-4ab4-83ba-4e8c737f2fc8", "value": "196608:5uRrX4MGiVyKsGG66WPhLioCrh/BPm9Qo:5yrX4QV9lGyJOr15s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767705717, "uuid": "6df5ef1e-0139-490e-ab32-4ef832232d4d", "value": 9466975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767705717, "uuid": "6c1e244c-b9a7-4c56-9b5d-ed9eaeb587db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705717, "uuid": "45ae5d8c-ff59-4c05-96ce-2d6d835aea47", "value": "sysad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44618c7c-eaf3-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767699099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767699099, "uuid": "7b249196-3b85-42ae-9542-77f43832b8ec", "comment": "Malware payload (AsyncRAT)", "value": "b661de3ac8d53b2b99cd494e6dc263d3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767699099, "uuid": "ff809d78-3a47-4f35-af08-d650d3ca1102", "comment": "Malware payload (AsyncRAT)", "value": "c3d3bc3a7ae093e6d36f0a6606d4d87b0f9af085bd37cfc5408014b8bac98baf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767699099, "uuid": "d23ae6d0-c944-4f37-b737-21a5afd5d782", "comment": "Malware payload (AsyncRAT)", "value": "c97f9a16188099f2c1b26f9eb533a1b7bb586d2e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767699099, "uuid": "ca571f24-1f56-4222-a4d2-925cb73daa0d", "comment": "Malware payload (AsyncRAT)", "value": "da6a6838a53bcbe8b66a36932c6bd9cabeae3de6e8e9952708015b652615bc8d5386cb7891bab6284a4c85ce7d137bf2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767699099, "uuid": "409145f5-d9d1-49f9-bd3e-ea92ee0d727a", "value": "T1A4C21B0473F48265D1EC4BBE48339200D375E58B5D53DB9F6EC4A5AE2A237CD8A21BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767699099, "uuid": "17c676bd-d1e7-4fe7-9042-6a9b68d29e08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767699099, "uuid": "1a50350f-8d94-419b-a273-d145cd6bfe35", "value": "384:w42k+mc3PzgeVeQkzxWMymrJhxoHqqbuUsJQxnCJf+BWfXWv/Pu+:w4Cb3PEtQk1WMyCJhxOFbHBFBju+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767699099, "uuid": "fc75abe6-d023-4c10-8574-ff0b408a70d3", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767699099, "uuid": "750f32b3-a65d-42ce-82f4-a753ffbb3922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767699099, "uuid": "8c1c88c8-6807-4ba3-8d8e-f732c1c4305d", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50fb7c0-eabf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767677035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677035, "uuid": "2c851a51-1706-4d0b-98f4-dea6bbc532ee", "comment": "Malware payload (Mirai)", "value": "d45b6d2943886cd28815301320a4bc03", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677035, "uuid": "94607f55-59f3-4bf6-8ff1-cef83e470a49", "comment": "Malware payload (Mirai)", "value": "c4784ae0b9a3c53c3a743f743c413305549342a3cf9d3127bcdfd4a2ad177af3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677035, "uuid": "ee717325-d7a7-494c-8470-fbabd881d456", "comment": "Malware payload (Mirai)", "value": "8897637160d8e6cced1f52181ac92d6781e7bf71", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677035, "uuid": "5a8ed497-7582-4205-8afe-80aa8e45c2bc", "comment": "Malware payload (Mirai)", "value": "1c14469f943f415e209412a2491ee03cdc612e658b3749e9e1ca275eaaa54e6d87c2d4801aace78758f8efd9b81147f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677035, "uuid": "c53675df-1952-4553-abb4-03f92e052da2", "value": "T16431F7CF342C4A72378EDE87A3B1754D15928DE217A40DB49FD4486EC9E8E68B748E18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677035, "uuid": "8137ecff-660f-422b-b891-d397c9d69881", "value": "24:I9dT9TpJrdTJT/dTWTcrHdT/0T/I/KSdc3cTdgOMbf5dc0cISHdT3Ts+VgdT3TsC:S33trHFXtONttQW+CW+C+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767677035, "uuid": "ee286b95-f173-49f5-a370-78a0095cdf1c", "value": 1677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767677035, "uuid": "0546f91d-75ec-4f39-bc8f-21a7eb397c29", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677035, "uuid": "385f3209-70bb-4532-bb58-ca59b733cbd4", "value": "k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fb36bc-eac1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767677764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677764, "uuid": "76db84ad-149f-4924-b506-0d5e996a8347", "comment": "Malware payload (Mirai)", "value": "b948107d8ac24aae944112afb74a5f1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677764, "uuid": "c77d6917-d4f0-478d-bd98-148f1537a670", "comment": "Malware payload (Mirai)", "value": "c4e2097dcd74ffea3b1e0626d2255efc9d617cb02a074ce84ea482febb1541bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677764, "uuid": "64394691-0d55-4359-92fa-f585b6c2944c", "comment": "Malware payload (Mirai)", "value": "3c2cb2023b9dd3c3f3e2dd67d0049e99728976cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677764, "uuid": "406f6c9f-fa69-4982-85c9-d4e07962eae1", "comment": "Malware payload (Mirai)", "value": "a8c63698ca5958618f7caee5f7c346492c2af012bd8967e1dafc6f26cf99ffa16fdde7789eb3b5e3fbfed700659f54da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677764, "uuid": "2a6382b0-a35d-47cc-83be-9da5d28c2847", "value": "T15FD30845F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378696B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677764, "uuid": "198b1b60-3ef5-466f-84e7-d05358c95b11", "value": "1536:QKdzElm18uZJNb4AXFa8eAZHk4VB7fzTTnf5mgYivCyeqZ/Z20lCmwyw6RNPUTuM:QKp50oU8e947L3f5mziPtRZ55ZKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767677764, "uuid": "59cd6644-6ce8-4f34-a8ca-4e9a8a95f8d9", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767677764, "uuid": "8369bbe6-64a3-44b4-a9d5-b5eeb072a58f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677764, "uuid": "d65c3172-2815-4260-bbc9-057401c51434", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98aa271f-eac1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767677765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677765, "uuid": "ad5077d9-ae00-4c95-8234-0d9dacd6ab84", "comment": "Malware payload (Mirai)", "value": "001200dbb807d73c21ce2d34cc2c92a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677765, "uuid": "6cf19698-75c7-49d2-8f66-6aa1fab380e9", "comment": "Malware payload (Mirai)", "value": "c51c526c1247a032e895692946c5ddea9c1eff44ecbcaa7a9eb06fd6002ac920", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677765, "uuid": "6b3dd5eb-b1c1-4deb-b325-34f9f7e3ea08", "comment": "Malware payload (Mirai)", "value": "a2c694ba838e54bb2c2330901862f56db69d3b88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767677765, "uuid": "4acc0ac6-972f-4254-8767-559b2296c2cc", "comment": "Malware payload (Mirai)", "value": "dc9e720cfe799d47acaad3e065d32ceba00fc403b2047c896469046d5a6cf4cdd3ca28e65f433786f7287e8b1f5e6f5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677765, "uuid": "c920d97f-0dd9-47a3-86aa-ad2a0c828b03", "value": "T1DAC31B45FC405B23C6C611BBFB5E428D3B2A17E9D3EE720399255F60378686B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677765, "uuid": "674e5f27-7abb-441d-8019-81f35931ac61", "value": "1536:pXKa0rG5yC/cMChygtwOBdWFAcJX4VlgXTA70FoDUGBr7k51WhPV1lHFwywEReQm:pKaprMh7eOXWFh4UX40FoDJBkvWR2SH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767677765, "uuid": "d0304d2e-0bcc-45bc-a33c-9fa865c949c4", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767677765, "uuid": "f2d13ba2-46ac-4531-9d11-adcf7e59bdac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767677765, "uuid": "775c5853-84d2-4c12-a7a7-8bcc943bd3b9", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e432b1b1-ead1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767684764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684764, "uuid": "919a69c8-0943-4844-a4a0-4b5e3dcb8a16", "comment": "Malware payload", "value": "e89b1df20dada3e4722d8b883aa96bb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684764, "uuid": "1735f460-b154-4718-bab3-420fd172cf72", "comment": "Malware payload", "value": "c5400d15c42827162def34c0479f67223c6bda5e5eaa3fcaa132719058f162a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684764, "uuid": "b0a4a7c8-9f71-4534-be18-32e12cc8e406", "comment": "Malware payload", "value": "c5272fef28e5350cda8554c83a49cfb809201e66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684764, "uuid": "db2a337c-fd5a-4579-9f34-fb0c2c51382d", "comment": "Malware payload", "value": "b3118a9a1bb82c8a0b02969517ca5e82f71deb8127b68140dee7fb792e859188bb7b89d20f83da8f751993f1b703a86a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684764, "uuid": "ae80d8c4-338c-42c2-a9e2-1f59430c7df3", "value": "T178520922F6C2C6B4E84614FA6D1B5BB67C7D642F43D050C3AFF41D2ABB225F50A39684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684764, "uuid": "9fda121d-4857-4a4c-95a7-d2545087f717", "value": "192:E1Xq+4LJX6IN7akHr239gjts9MW/rLQqFuM5Jsde5WY3/BntLD0tJdK8XATTFMw0:G4LEIAkHr23uEQWP5Jsde5WMDMZKtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767684764, "uuid": "d73da1ff-39fc-4400-892b-7aa07d6cfff3", "value": 13273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767684764, "uuid": "29cddd3d-5fb7-4f84-bf9b-983a26ced204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684764, "uuid": "e2927106-12d8-42bd-a0b3-8db3469f406a", "value": "e89b1df20dada3e4722d8b883aa96bb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bf0239-eb4e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767738323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767738323, "uuid": "eaad58fe-0c35-4f08-927b-9a8d4e81481b", "comment": "Malware payload (SalatStealer)", "value": "52ba88ec77a4740df699c10ca1248356", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767738323, "uuid": "c74e4477-e1df-48f6-91d5-ef2b4d855235", "comment": "Malware payload (SalatStealer)", "value": "c557ebe4615066c1019d0c8976e10c932a82813853a159587ae68a5a6eb0225c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767738323, "uuid": "7930a4ec-422d-43bc-ad4d-c2a8710807ca", "comment": "Malware payload (SalatStealer)", "value": "7115e3da53ff7fdbee1fb46dc8078c467e136394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767738323, "uuid": "e6b2507c-cd75-4698-a4ff-db1d2ca7ef1a", "comment": "Malware payload (SalatStealer)", "value": "fded61fe5ae0b298a553fcd596703d964ff7108448dbb60c0d0883124c7ae80a59f49fb690c80e0bfb01c3238adadba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767738323, "uuid": "effcf7ed-599d-4bf9-98b6-5500ec9a2ea0", "value": "T193C66B11FA8B54F5E903183580ABB23F67315E048B28DBDBFB543B6AFC776811967206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767738323, "uuid": "61d40dc0-1da4-4e0c-b77a-a5ffe871ff77", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767738323, "uuid": "68ebc73d-e224-4fab-9b2a-8ad98c1a965a", "value": "49152:cJpkDRKiMDJux731tz+okSKnXdqR3EMxWsr4YhSgfhMNSSGB6+wdHA8yJSzdjSuX:k6DRn77H7NhDOHLXdbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767738323, "uuid": "8d95b314-5fc5-491a-8cb1-01174ae56bf7", "value": 11657728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767738323, "uuid": "31aafcad-27f4-4b25-9279-e01835026984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767738323, "uuid": "c0d5bc25-11ad-468a-bfbd-ac081ef17dbf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8350f3-eac9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767680965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680965, "uuid": "4f0708fc-3b86-4c6e-afaf-3a9984796d17", "comment": "Malware payload (Mirai)", "value": "e904c54a253e3822f7becb91b5ea39c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680965, "uuid": "c8369dc9-3710-4d39-8fde-bcdb028931c0", "comment": "Malware payload (Mirai)", "value": "c65b158cfe0560f2c64eca0692d680003609a769e3d314f7d0e48de9234b5d2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680965, "uuid": "5e24134c-355f-48e4-a1bd-bc0cccd1f14a", "comment": "Malware payload (Mirai)", "value": "6bed125c004cf7d022acf3b32cde02e8c55dee56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680965, "uuid": "eaaeb792-8f91-4f83-80c1-efc7cfd30329", "comment": "Malware payload (Mirai)", "value": "8261a028f3d75719adfc650290ac6ceb97725cf324e72681357155b29f6dfb56776175953deb60787f1f38c527489be1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680965, "uuid": "43542364-acf2-4c15-becd-3b0350147b55", "value": "T1B004871D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680965, "uuid": "8fecf2c0-fae9-4199-9fdb-974722e0f992", "value": "3072:/A57BE2Ln5irHKx3+xS9JOPKaTCNRmF+XQSiN:/AlBE2Ln5iauxuuCKFMQSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767680965, "uuid": "7ec5d968-f309-478b-9e3c-86a6d33913c7", "value": 173856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767680965, "uuid": "b0894da1-9724-4d33-95ce-95b02fb2956c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680965, "uuid": "c7639e6d-e0ca-4f57-898d-fed29482fd73", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a12e2a-ea97-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1767659540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659540, "uuid": "92cd546f-ef17-45cf-9d16-ce1db4e0bca9", "comment": "Malware payload (Phorpiex)", "value": "85d2cb8c740065498f4b28be129d6dbb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659540, "uuid": "1706871b-0b98-4876-a72b-a6cdec53a95c", "comment": "Malware payload (Phorpiex)", "value": "c6def8e8fb6eaa582f7c5dc88a85723d4a868b04c4ea8f8584bb828417a4ab86", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659540, "uuid": "98b896b9-c439-4a8e-9a4b-c4ebf1b4e794", "comment": "Malware payload (Phorpiex)", "value": "46d039d94b5b26d4d30a4bc603fe75010d3f538c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659540, "uuid": "af19e587-638e-49b5-8fb7-2817e5573ba9", "comment": "Malware payload (Phorpiex)", "value": "a08a891ffeb1995fa4a021f5890dfd5ad87d8b3be7cd439ed785bf836a74f8d8fadc377d9198919c1d0d16ba89b7a6d4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659540, "uuid": "2fe7d6a6-2957-4f40-b974-85d22d066459", "value": "T116923A1BD603C222E0A041709163EB77997E5772334724EFEBE4499B2A3A1D16D33E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659540, "uuid": "5f58fc18-80a9-4241-b8a6-e8fca7fbaccb", "value": "ab715c6137c66e37d651b98bf65b445f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659540, "uuid": "4fa04a70-cc27-43fe-970b-018a0b35deea", "value": "384:EM/Jh/MnPbhs5EEFSHlTfJhuvDjVfLUOQPcjD:E6E6FSHtJhuvDxfLUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767659540, "uuid": "8269e0d3-809a-4f48-8968-7d4ebc702bf5", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767659540, "uuid": "bd280910-e39f-41c5-9559-26baa863ccf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659540, "uuid": "1e96071d-927d-4dc6-9cd0-d1cbc7026d97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d30b9dc-ea96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767659063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659063, "uuid": "315cac05-ba5a-456b-8736-1f51800a0b53", "comment": "Malware payload (Mirai)", "value": "e3dea3d34da37628ed5d874727668c52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659063, "uuid": "6ee4402b-4134-4246-8df3-dd931ecc6c05", "comment": "Malware payload (Mirai)", "value": "c753c26ad689567bf9275ff3c949e2a5a8c477f5e57d6ea11403bb06c9fe4376", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659063, "uuid": "af619d17-11bc-4eb7-8083-cf262065d77b", "comment": "Malware payload (Mirai)", "value": "daf764e22c1a22d1f200fc908229f0e7220612c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659063, "uuid": "a1c65d25-4c84-4e59-9698-eaf46fb66fcd", "comment": "Malware payload (Mirai)", "value": "070303300d70859577056b3417a2d7d85c0b0fcb296b1facb8599be87c43fea868191ca22380c6c8a31814c832d74544", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659063, "uuid": "2094d517-fa3f-40e1-b3d7-e9054c7ccc91", "value": "T1BD83D705BB254FB7DC5FCD374AB95B0429CC960A31A83B7A7930D818F25B24F59E3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659063, "uuid": "03f3e7e2-c6ab-48e6-931a-47151eef51d0", "value": "1536:ysDG+OPEBy1uY/O3jh0H5y9WyT3jVuO0FpoMOnbO5yMHeur7RR:ysq+Osy19/WhWy99tmPeurj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767659063, "uuid": "d2b5c67d-1275-4006-bded-caeb6e78b610", "value": 87020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767659063, "uuid": "82af51be-122d-40b0-83c1-f1fdee73710a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659063, "uuid": "6b626742-a861-45ec-955d-468ee9344a9d", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe008f6-ead4-11f0-a129-42010a9c0007", "comment": "Malware payload (Guildma)", "timestamp": 1767685911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685911, "uuid": "09267485-d335-45c4-9697-82a8ca530212", "comment": "Malware payload (Guildma)", "value": "b9cc76210a37e16f01b24a202ac53b61", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685911, "uuid": "f8dfa3ef-a5e3-44ad-adb1-4fc4226ef436", "comment": "Malware payload (Guildma)", "value": "c78ea254f8b069e2e77901645da2df969ac94208c19beb1d0b4c9e76d7a0a647", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685911, "uuid": "282b71e9-4a7b-4b4e-9338-6937a1ecfb08", "comment": "Malware payload (Guildma)", "value": "2aa301eed3d4148df55e32c9d639e0f918d49cc2", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685911, "uuid": "0721a661-7a61-4853-8c31-b940444f3e0b", "comment": "Malware payload (Guildma)", "value": "d54d9712e2071ad4250b2a6478346a33bb800b009310626f9a87b54f789f52f02ba7fbbe8ebbffec3bf3e6f162ec821f", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685911, "uuid": "e2e96cd6-63d3-497d-8727-77b4bc2f7fd7", "value": "T170F0E2280FB9D476C7AB0D0180FFFE892DC4A644111D33796C8FA80C6280E7A88B79F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685911, "uuid": "a18c538f-b422-4e53-a0c3-03813ce75be3", "value": "12:505M5w61664515Qtgpt1tgHCCcXS6Rt5mmtKc5rFIREBzSDFIUvflFVYTYlz7Aw:505M5w6Ab5159vC6zQHWBzyflFVYG7Aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767685911, "uuid": "e03141bd-8214-45b7-b94b-d47a92ca163e", "value": 653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767685911, "uuid": "b4db54ba-d479-4d79-8ddd-4db1d88ec99c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685911, "uuid": "e142ada4-2b4f-4155-ba86-b0c8402ed2cf", "value": "377602682146.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d20978-eb04-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767706430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706430, "uuid": "1503b61f-ad6e-4463-aea5-bdd478f543f7", "comment": "Malware payload (Mirai)", "value": "0c15ef647035e89f54d92c9403d65466", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706430, "uuid": "cdf86bdd-3796-4e95-a135-1aedc2a870d1", "comment": "Malware payload (Mirai)", "value": "c8bc60f2b1ebfae6c2055a21312357cecca4f70ae72d79943e22f86164dd6a1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706430, "uuid": "07719922-4f0a-4c97-8f33-0e8f85e2476f", "comment": "Malware payload (Mirai)", "value": "fc469ca5fbbbe7a3bb1687272da11fc197e1c1fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706430, "uuid": "26d10e1a-8591-4f08-a92c-3ffa816586f0", "comment": "Malware payload (Mirai)", "value": "6f002fa4838c59bba87b7e64301511760011f38d554236980791b6b8b4eb63f7c91669bb545c79ba5b8d95f218114246", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706430, "uuid": "808ac870-4d93-4ccd-8c7e-7ff9f301962a", "value": "T11373A40ABFA02EB3D8AFDC3349AA1B4625DD551720997B79BD30D818F60E64F15D38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706430, "uuid": "777389ed-f6e2-4519-8ad3-3388b7f1d4c3", "value": "768:9y29uZs5eGHOsR9lx8MEwzfHrj3/9VZxd+c9vufd5uxejlc8f/Wh7Tzrb2757meL:9y29WsUGlenf+x27MCEZajx38ZGyKZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767706430, "uuid": "945b50a6-3199-4a3a-b3fe-3dd7807d4843", "value": 80392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767706430, "uuid": "b200c03f-8c08-4cd0-a6e5-51578a6d0500", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706430, "uuid": "a49f1bb9-ffc3-410a-8f12-b1edd7deb877", "value": "Fantazy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a2b4a0-eb43-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1767733707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767733707, "uuid": "8d8ccdee-0616-4f23-b885-e8883ff835e7", "comment": "Malware payload (N-able)", "value": "cc4f2512d2f34a1d50c771869b88ab2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767733707, "uuid": "52631a16-043f-4f01-8d9b-e053711bc968", "comment": "Malware payload (N-able)", "value": "d0734e9101ff40347e6a78bec1650fc74240e8d4143d428a3b96157edd6283c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767733707, "uuid": "1ff943c3-f897-40c4-aade-b01ff759f7cd", "comment": "Malware payload (N-able)", "value": "4c004f638b66b5e9c1d72345cfa2635e9d330a51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767733707, "uuid": "debf1712-b187-4172-b500-f9871d678f9d", "comment": "Malware payload (N-able)", "value": "560f77c25e15836fd511810d4adb59d11f7d12546f365e6beb53c1dd790fbce8bde8781a9622c68378c86bb37ac712ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767733707, "uuid": "52587c35-12e6-4f24-b6a2-07d0de1c1302", "value": "T1D7E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767733707, "uuid": "c288d9d9-b541-456f-bf90-ebea23325f23", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767733707, "uuid": "6dd75fcd-7c43-4c1d-81e8-aeef020f434f", "value": "393216:I/F/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1c:KrRxvoC/7a0jUxX7h1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767733707, "uuid": "04039381-d574-4da7-9f88-3b596d84654f", "value": 14781984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767733707, "uuid": "3c5cab54-bd86-4e4a-adae-bb18aedbacd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767733707, "uuid": "ab60fcc0-8c5b-4f84-9be7-a9f3a5e02ac5", "value": "SSA_Annual_Review_2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20c8bab-ea99-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767660682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660682, "uuid": "a1c2c661-0a5b-4968-b845-fe5c918288f1", "comment": "Malware payload (Mirai)", "value": "e5e44d8f008a922aac4338e3a3435a49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660682, "uuid": "69748153-c234-4f58-9f6a-b53ac8875adc", "comment": "Malware payload (Mirai)", "value": "d14675730fdcd76877918cae824a4a3c145c72d93932a400bf22d514e3ebb48d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660682, "uuid": "4414909e-6181-413d-b76d-d70c6294d8a7", "comment": "Malware payload (Mirai)", "value": "6f5a6341cc0112666d818c2aa89988f491977a66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660682, "uuid": "1097c128-d8f4-48c1-8188-7ca8c7d5da23", "comment": "Malware payload (Mirai)", "value": "87a843df82e0185e7e4dab252b35eb8a1cc73e25415390ae715011a6e0b32c49b3279a0d007294ca64077d36cf11c13c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660682, "uuid": "ab4f3611-edef-4dbc-ab1d-ff7981984fa5", "value": "T14313E88ABC95CA56C6C55177BF0E42CC372603A8E1EE73439D18AF66765F82B0E3B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660682, "uuid": "c328794f-6d0d-49e8-89e3-bc2eca26022c", "value": "768:e5xHpBHnTqW2oFynNIEmNThd8BipeAJtxnvJur7R:SHXPFAuBh18Khur7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767660682, "uuid": "32089eb6-c8f0-4451-91ef-75de770a0cbc", "value": 42836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767660682, "uuid": "361fba09-611e-4f5b-a7a6-bfa574d54a27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660682, "uuid": "76289d47-f3df-4387-b160-88a8d46cd279", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98718f6c-eaa0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767663592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663592, "uuid": "a95861ac-80ec-43c7-9d7c-b9613f95d22d", "comment": "Malware payload (Mirai)", "value": "a8a9e549efaa6c99335727792077d77e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663592, "uuid": "dc311d5f-832e-4339-ba7a-2bf582040121", "comment": "Malware payload (Mirai)", "value": "d1a079761168680cdc2adf66e599f567290fb1fde9d0740ff6b8effaaca6623a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663592, "uuid": "28905e00-6656-4405-993f-7a8b0fb08e4f", "comment": "Malware payload (Mirai)", "value": "0e6759c935f833e69861148ca88467a729e55315", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663592, "uuid": "495d2d30-ac95-43a4-9124-28d946aaca6b", "comment": "Malware payload (Mirai)", "value": "74285772c493fb4682a19d78d3a896dea7d71a8290d88ca24e78bc248a1def9b0cf704ebcd35b1a1283385757aacc5e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663592, "uuid": "fec9c53f-05df-4871-9f36-33002048807e", "value": "T189C45B59F8809FA1C6C52576F75E829C33134B79C3EBB20699145B343B9B86B0F3E642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663592, "uuid": "a0e1bf57-6ce5-423e-b3f3-236be521dff9", "value": "12288:AzY7i3g0XOLcrXhSpnyWye7PohIPVgpZ6m7j4:J2K6hSnyWz7P+IPrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767663592, "uuid": "cc2ac9a9-7aa8-4394-b04a-2a4e1ff6b9be", "value": 549724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767663592, "uuid": "eda4d2e5-5edb-46a1-9c1c-718e16dadd24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663592, "uuid": "25ceae3e-4482-40b3-bc13-4fa88df13e19", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2742e33-eae0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767691150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691150, "uuid": "88af15fe-3079-4279-9548-ad9716ed91eb", "comment": "Malware payload (Mirai)", "value": "9644b112df1748e2c108da42659b8c74", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691150, "uuid": "754bc09d-c1d1-460d-9d5f-990db0e5438d", "comment": "Malware payload (Mirai)", "value": "d20a3c1dda54a03f1424b74344411d9afb8eba2b0d14547d1ac3bfc2a183226d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691150, "uuid": "edcb059b-f1bf-474d-93d9-cf2ccc55fa08", "comment": "Malware payload (Mirai)", "value": "c94273164e6b9c289f800eedebac6135df492f5f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767691150, "uuid": "c9f0115d-b9c8-4d42-8bf8-64a8c138b6fb", "comment": "Malware payload (Mirai)", "value": "90f2df3be8baff3f16181ce22c9568bdcf0c84234ce661e952cc52899d828191214f7ffe3c695e02915e9d843bff6a78", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691150, "uuid": "86ac752d-ae83-496b-bdc6-0f616182e213", "value": "T1A311D2ADB0215A63278D8F59F3B3124CF84185C591FA1F61AE9104BA8EDB70477D92B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691150, "uuid": "94f15fc1-b6d6-438b-9a71-c403c6b45728", "value": "24:mHRD7QXR3h+ODRhNIA2RxKmTxbbun+OdZ5CCDxeLtTVa7lsGcKA:0AB3hXKxV9v0A5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767691150, "uuid": "c30ebefe-0a54-4af7-8972-f4145f91baf2", "value": 997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767691150, "uuid": "304a3c5c-5067-454d-98cf-286f66551703", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767691150, "uuid": "23c73b1b-b405-47ef-8a7e-0afcdb3268ac", "value": "d20a3c1dda54a03f1424b74344411d9afb8eba2b0d14547d1ac3bfc2a183226d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14ceb34-eaa0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767663714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663714, "uuid": "a86284e2-42dc-47fc-b051-e224f221d014", "comment": "Malware payload (Mirai)", "value": "62d6b082368a65a40f98bb3f76eae309", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663714, "uuid": "7b279a61-6bf4-499a-b99d-a3649e37fc8a", "comment": "Malware payload (Mirai)", "value": "d29ec5996558c581e8f3ea3b561fcf9da15d8c0eb6f0e8dff2a55ec85d959abb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663714, "uuid": "87c19f85-c9df-4e78-9aae-b13e114598bf", "comment": "Malware payload (Mirai)", "value": "4d18deea4488041ead38c2b7dcd4c7f6d65665b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663714, "uuid": "8da50653-fe59-410e-845c-19f276df1aea", "comment": "Malware payload (Mirai)", "value": "df480d897de7f730fc524328471fc67bde36c23d3ec1fcc12cdf635ffd16e5db6fcc50dfb80d7fca8cc8e62e3ac12b81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663714, "uuid": "f62b6a86-3604-4b46-9f5b-10bb8c66a8f7", "value": "T16F138D27C9799E29F10D59B474308B794B1BE601A3872FFA621AE1658043F9CB64E3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663714, "uuid": "d92dfee6-be4d-4c6e-9b05-e2a8e3a85342", "value": "768:4a59CmJ1ard+UpvaBmdn2zlnx8jUJCh45DTcCowCDCvcur7R:4imdfYmQzfcUJj5DTcVDDCvcur7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767663714, "uuid": "9e97d59c-a9cc-43ba-8946-7beb2b1c86ca", "value": 41832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767663714, "uuid": "1becdcad-b824-4c9d-8743-ae08c0e01975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663714, "uuid": "58f61481-5930-4fd4-bee0-db89245a5bab", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bacd0a33-eacb-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767682118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682118, "uuid": "051947bb-a5a0-4b82-bbdf-8a4c4d4f88f4", "comment": "Malware payload (Formbook)", "value": "a45b36ebb3b2ecca41b3252a94f06c59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682118, "uuid": "0a94d9b4-ffc5-4708-91a1-d29461b0c56e", "comment": "Malware payload (Formbook)", "value": "d363f5cf402f0d93805a1ce7533ed38729fef31538b8a699a7dbe7ee39b58b43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682118, "uuid": "921a31d3-3cab-4346-a918-6d407b7ea30f", "comment": "Malware payload (Formbook)", "value": "5df727567c721433396c8fdd56cfd4d9388d30a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682118, "uuid": "7e67ab66-bd1e-4cdf-8f45-80ddea5cbf4a", "comment": "Malware payload (Formbook)", "value": "30fd244e9911e7af4cc161f542ea6e67b595be198443cf1ce5eabe0d3b95492697d88796bacc9d4aac5345bc6c2c2e75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767682118, "uuid": "6663cc81-3a62-4a74-bb14-e31b1cf2e039", "value": "T19FF4F14433A9DF02D0A29BF519B0D77457B86E99F820D3078EEAADEB7839B405D50393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767682118, "uuid": "11f27768-335e-4737-882f-3eeb10ade42a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767682118, "uuid": "e902ae38-2cec-49e5-ab99-98e851d65cea", "value": "12288:lQORovRUZ+WQt4wFfoqOKbtlO6GHZr62zuN2kxW:DoZUZpZwFfHOKbtla5rNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767682118, "uuid": "4a11d754-3142-40a9-ade2-644f50b4aa67", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767682118, "uuid": "aa713b53-1d72-4c60-92d1-f969891831fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767682118, "uuid": "d4210d54-9c6c-4e54-b07c-300be8de7b8f", "value": "PurchaseOder00019823333532.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f59776-eb04-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767706569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706569, "uuid": "0f2691ec-4558-485d-90b0-b98eb3e8de7b", "comment": "Malware payload (Mirai)", "value": "9ee9d01dd3fa82b4c9e5442b548d7025", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706569, "uuid": "0bd2539a-2645-44df-a55d-9cf88b890539", "comment": "Malware payload (Mirai)", "value": "d38c7c128ec65c2bb900ba770790a8b5702c1e3325da7773cf3ffd27bff2317f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706569, "uuid": "5d60ae37-0b75-4a46-8bc3-04cd75590144", "comment": "Malware payload (Mirai)", "value": "1f73297e2558ae8146c6870f5d4134df94b5e6d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706569, "uuid": "12925ff9-901f-4f50-a496-29ebd2e3b6bc", "comment": "Malware payload (Mirai)", "value": "03141549a9a58262fd08c209c3328ab96a33a523c400d9bcc04a87b5b697a6053516a177c4f5b29fe7c3bea3d4c42319", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706569, "uuid": "5721d81d-a3f2-4263-b595-8c29205c38d9", "value": "T1E4F45B06EF850FDBC47FCD70492E828716ED9AD706D0933551FC8988BACE66A4BE3458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706569, "uuid": "8bd2c377-9421-4623-a3ec-fff4d4f85580", "value": "12288:4hQkYBZqC1viI6OjhqzLzdzWzl1lgmzHbiIAWcK0GOq4hFxlSyIr9EdTR/Q+Ci9a:jdyskRs6wymeUYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767706569, "uuid": "583d76a2-b7ae-4e07-b779-fb2b7ee2c8cd", "value": 730456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767706569, "uuid": "45c8b9e3-3e2a-4bda-90bc-8b61a398b051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706569, "uuid": "cf3c5283-2666-4640-b907-e3a71aa12edd", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fd5a62-eb0a-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767709138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709138, "uuid": "c143442e-9573-467c-9a2b-9e01bb4d0a87", "comment": "Malware payload (SalatStealer)", "value": "1812ef5cad0ab63208760386472838cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709138, "uuid": "9fd04bfb-ca10-475d-b212-790933a14782", "comment": "Malware payload (SalatStealer)", "value": "d61d8fdf7806fbc3b096a415f277de09eaafc1c315da77fbb8f12e4669264fd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709138, "uuid": "0dc04442-263d-4599-9150-fe522a2dba24", "comment": "Malware payload (SalatStealer)", "value": "a2d123418c6465a5779050027ae578ce1f5f4f8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709138, "uuid": "26f5bcb2-5902-4e13-8074-6ccdaba310de", "comment": "Malware payload (SalatStealer)", "value": "9a0869f4e87c1e5c5e580e82b28e53f79c01458fbf37c18b285768355ae590e9f2bea77fdc43ae773d842ec5279ac78e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709138, "uuid": "fc34c692-0637-4f6e-a27a-652d97009842", "value": "T1CFE5337BEE0BC0FCD5689EB4B030CA44A7F214E3382546AF6775D04366B8316B27675A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709138, "uuid": "2068b3eb-5104-4d72-acd4-a8da7c8e7cec", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709138, "uuid": "a8b15956-1da2-4879-8bc4-aefba4702290", "value": "98304:XG2r711jtB5BCjfUwlJjlFiHHnd72dsZFxNJQh:Xv3ttC/jlknGsZtmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767709138, "uuid": "8b3f7c2b-77bb-4263-9a6e-c1b37b9d3b1c", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767709138, "uuid": "fe6e3f2e-65e2-4edc-8cb0-ce28421fe31a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709138, "uuid": "cca28841-053a-4918-81f2-351691d1d7cc", "value": "SecuriteInfo.com.Trojan.PWS.Salat.332.27008.14008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91630fd-eab1-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767670921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767670921, "uuid": "3e9a82dd-99c6-49fb-bc46-7c7cb0a88843", "comment": "Malware payload (Vidar)", "value": "9c1e0aad3e5f84784aecdd96f47c9630", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767670921, "uuid": "e91defde-5bd8-49df-a55c-6ca1754c74d6", "comment": "Malware payload (Vidar)", "value": "d62ef0a828a92ac117fe34edb2aacc21a4c5cf2cca0897d9e86d5898d4c485d1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767670921, "uuid": "5c82c882-4a8c-47dd-8847-a020ccfb0a29", "comment": "Malware payload (Vidar)", "value": "9a004814db05b314fac7b1862a0d8ac117e0464f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767670921, "uuid": "cae932bb-42fa-405f-9fb8-d34c30aa2d4f", "comment": "Malware payload (Vidar)", "value": "01a5d0d8a48acc5387811ef6e48a1d4f863da49b6112d7bd57a680407d2185bd72401adc9a0b3c03809d4bfc9c28b99b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767670921, "uuid": "5de831df-cb4f-46c8-a547-f467b358357a", "value": "T1C214136EA19E1010C12B93F46F1F40B48E1BBE9A254EC7EBF4E6E0EA49F10844D751E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767670921, "uuid": "fd92265f-251a-467a-8bb3-d9fefe1742d2", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767670921, "uuid": "274fa8d7-9382-4268-98a2-8dcfefa34702", "value": "6144:KFzhDNPB3hHuUWwfIKIS5Q9usw+jiBJp2Zd:6hn3hHuUtfIKISiuD+jifp2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767670921, "uuid": "4a10049b-9768-4ae3-a616-faae148c9593", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767670921, "uuid": "0351b10d-2468-4732-814f-9f5c255c5da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767670921, "uuid": "93414078-3d36-423f-93df-508d46fe9de5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e4877f-eaca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767681403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681403, "uuid": "f7c55e03-562f-4b04-b753-6a9582f34954", "comment": "Malware payload (Mirai)", "value": "ed4f687d4b5f8e71d3c3813bf6871e88", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681403, "uuid": "c4da486f-c714-4fae-861b-5f72a8069c3e", "comment": "Malware payload (Mirai)", "value": "d758ae90211a20ddbb11830dd76c46a6bb086354649e92b82e9a5d59a378fc49", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681403, "uuid": "0bd34020-8529-4652-b105-c979b8ffd3f5", "comment": "Malware payload (Mirai)", "value": "88be695b007859feb3e0da047f47d5c9a2d16b57", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681403, "uuid": "179973d0-cf56-411c-b5d8-0bf36c36949b", "comment": "Malware payload (Mirai)", "value": "422d3e44539ab73c2b6183d87913b6a500fb8dcb6f2a2fbc3bf41c71690ad2d5a57c421933546372a1418d8533469924", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681403, "uuid": "e48b9a63-5110-4645-98c2-954a8186ff94", "value": "T19582C03061AB75F9DBF10430FEAECEC6971A0BF8D1FC36921758AB78894540251F92DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681403, "uuid": "0419196f-10eb-4481-ad0d-58928cea3f4f", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMau0hymdGUop5h5l2:2dV0P6+kom0tVAoNvm+to1u0s3Uoznl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681403, "uuid": "e33ab483-8c5a-4978-b36b-3434e9963d56", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681403, "uuid": "736487d7-ac74-4208-b7ab-6a0d184b1597", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681403, "uuid": "98f45d09-8a7f-44af-84a1-5294f97fda66", "value": "d758ae90211a20ddbb11830dd76c46a6bb086354649e92b82e9a5d59a378fc49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c0bdcc-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767720972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720972, "uuid": "080dd5ee-c736-4066-85a7-740e350ad150", "comment": "Malware payload (Mirai)", "value": "2cf584550fcc39aa1a1abc36514e93fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720972, "uuid": "9fa38d1c-e6ae-46fb-8a44-ab12943f3dde", "comment": "Malware payload (Mirai)", "value": "da5b874d9a35a78fad4c4300a0173414627d30aafced868ac46dd105b57a2006", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720972, "uuid": "d8e577fc-bf62-4bad-bfff-b738aa211205", "comment": "Malware payload (Mirai)", "value": "ba3c4c01ea5900cf9ded8f91cbe55b3e9b26a2dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720972, "uuid": "904e507d-7ea4-4acd-9854-a8ebb04e2611", "comment": "Malware payload (Mirai)", "value": "4c388cbc1ba9b3957215a3c6ab0f72fecd5f196771e52054211de676a73cd6bb7a182638c2ad1fdc33ce292bcd3f541e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720972, "uuid": "cd557066-28f3-4ab0-92e3-0da4406f0af5", "value": "T19DD3AD32E426ACE5CD0106B438B7957807019EF006E61983EFBEE56E14B7E54F9ED7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720972, "uuid": "2d2eab02-2f46-4ad6-81f2-8a584315ada2", "value": "3072:c98ebN8u3wO4DHSVx7g6GNhJ8hhP9iZg:c9NbNh32bSVWLbShhVIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767720972, "uuid": "0ac1596b-f8be-4b7a-bcaf-59a5b873cac0", "value": 131668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767720972, "uuid": "679d09f4-27db-426d-b0d6-f73732277c87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720972, "uuid": "984cb786-b411-48d0-b535-70769655aae6", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e51854d-eac8-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767680755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680755, "uuid": "0b8619f7-5f2d-45e0-b622-c443ae5c3d00", "comment": "Malware payload (Formbook)", "value": "5033cdbae312f7c5cadbb94b68ae968e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680755, "uuid": "87ca9cbe-b2bc-49f9-a2a5-5eb1d5cc4495", "comment": "Malware payload (Formbook)", "value": "dac4a89041fb6ea5255f0ec86147c75faf2967ea2b45449e99737de5e41410f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680755, "uuid": "531a220a-b7b7-4c52-8398-d907f2e5a88e", "comment": "Malware payload (Formbook)", "value": "507ad9415f6d2bcaeca346ed501a4aae5be627da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680755, "uuid": "db6cae50-b09c-4402-9ed2-2919e3ba6960", "comment": "Malware payload (Formbook)", "value": "f532474c2d99ed8cdd573cc71254b702ccabba1181846d1b17eb928ba859a42eccd174677bcad3e8fc1fc9e4ea04d270", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680755, "uuid": "8d24f07e-81a0-4cdb-9d24-6ab28beccde2", "value": "T147F4F01433AADF06D0A28BF51A70E77457BD6E99E821D3078EE6BCEB7139B041914393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680755, "uuid": "ff76ec63-995f-43bc-9def-3aae28f8bafa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680755, "uuid": "8a2b90f2-84c5-4fb2-bc87-416c76dfb82d", "value": "12288:ZvHuN2kxEKXIMZqZQdl+WWtf9GrmLE1GP2D8JPD7zG19AVrZoNnLDru5vslF:Fr3KXIMZXdl+XtgrO4Gm817irAVrunLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767680755, "uuid": "79a6ce51-63ce-4f82-8d56-4f88475f8027", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767680755, "uuid": "2f11a639-aeb7-4c7e-ae62-0d8ce70913e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680755, "uuid": "6a9ac8ce-fb65-4157-9e0a-1f8237d67615", "value": "SOA OF DEC. 2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac2a490-eb46-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1767734865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734865, "uuid": "626cf8f9-4a16-4234-8151-bfa41f73c826", "comment": "Malware payload (MaskGramStealer)", "value": "8e3e0dc82b7cc955e79cd24c7270034e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734865, "uuid": "dd6360df-51b3-4ce5-a261-11a0e4c03c93", "comment": "Malware payload (MaskGramStealer)", "value": "db0d4585d8113482e8f8ceb4cf7a14c16ab6bd29c86faaca02bb06b56d5e0d0f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734865, "uuid": "80346726-c5b1-4701-8641-32eb86d74247", "comment": "Malware payload (MaskGramStealer)", "value": "fae68b05bc22e26610eb3368098184853bbfb303", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767734865, "uuid": "fb843325-bf90-4ffa-a7f9-f0ae505ad955", "comment": "Malware payload (MaskGramStealer)", "value": "d391eb53f01bdbc9a8895121211f23211ddd7065bf1bfcd883eebc0f6997837b1d0b4c545d68d609c6d10ed1a69e4663", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767734865, "uuid": "a28f8434-0370-4087-bd2b-78b2a4c65f68", "value": "T12BB5339041AD4A38C52B8E3210B3EB15F306EC76CC5F4F81A72A8ADDC5F5762B58692D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767734865, "uuid": "ee2886f4-1d49-4c97-ae2c-fba7ae523917", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767734865, "uuid": "a0f23e20-6ed0-460a-930f-31d3bb1d56bf", "value": "49152:bmAo8ruoSxImNAbCAgh+kFLEe38mE8eaIjuXRtNO0b:bbkImcCRsmPRtQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767734865, "uuid": "ea115a7a-4592-49a3-a6f2-003b9ea45b02", "value": 2305024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767734865, "uuid": "cc348e53-6b88-4af8-94ae-137832f071fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767734865, "uuid": "a1fef02c-dec9-4030-bc70-396356dd8e30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f849765-eb0e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767710660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710660, "uuid": "a0e48b64-4aaf-49be-b48a-dc79633bf55f", "comment": "Malware payload", "value": "d9add0408da485ff94bd5e33af6e772a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710660, "uuid": "2976d125-c68c-4076-a786-0b6fe4aa534e", "comment": "Malware payload", "value": "db1a29d891a285d8a80405e65422bfd2bcb84e5aed734fa96b6920444ba61eaa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710660, "uuid": "64558f42-ed3f-40ab-831d-05732fb24c30", "comment": "Malware payload", "value": "537593376b66a0d053d5aa915510674fc5626183", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767710660, "uuid": "cc82ce1d-9165-47d9-acc6-4e2e78476773", "comment": "Malware payload", "value": "3ccdb6d68c979a2a701b55ae8fee7d296e132e66532ff8aa056130adbea6aad11d00668808e1503ee00332e9b531458b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710660, "uuid": "c33561bb-5371-4314-a7fb-ba91378925bc", "value": "T1B8B21F0534E822B0ADFCCD33728FCEB45E61CB71985A6A85B5F1E85D6C262C1F72518A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710660, "uuid": "f36c01de-85c6-4682-859e-c902a5f0924f", "value": "768:qG+l4lqLLm31g12uVbBlydsc1QioVzYCWFLSx3VI4KKVxare:FcLdSscSr3WFSVI4Kgare", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767710660, "uuid": "ad1fa8d9-2df8-40ac-bf8a-488e5a1e293f", "value": 24829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767710660, "uuid": "c307a65c-4cd7-4e24-bcb4-da43311522c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767710660, "uuid": "d5089225-7639-4411-b91b-b4cf0e2a3e3a", "value": "qpwoe32.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4aa1b7-eabf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767676674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767676674, "uuid": "6e64b19c-7d63-4cf8-9414-4e58acb26186", "comment": "Malware payload (Mirai)", "value": "d0a2cc99207d468bee28aa5829824b5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767676674, "uuid": "a9b372d1-fde2-4306-aa68-91119e86a506", "comment": "Malware payload (Mirai)", "value": "db1db257053f32f916c1c4ef1c4f850b213caa8f3337e8caafe777a58fb1ea56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767676674, "uuid": "88aaedab-ed3d-474a-ac19-0c1f70a24c2e", "comment": "Malware payload (Mirai)", "value": "5855c03d5310b569891424a66f5f3f74913de11c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767676674, "uuid": "327187a5-ca46-401a-a4b9-78ef5eb60cff", "comment": "Malware payload (Mirai)", "value": "41d0d7bfcbf2b5d9bf553125d573ffbfa8264a28f360a0d5c3b71930cc210a3f2cf0619ef6e5549721b7ab0c83aa1576", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767676674, "uuid": "22a1766b-9a04-4c20-99b1-18cfe746eb59", "value": "T110C44B59F8809FA1C6D52576F74E829C33134B79C3EBB20699145B343B9B86B0F3E642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767676674, "uuid": "2ec95ee1-4669-4c1a-8123-abb2ef47fe43", "value": "12288:ZZfAg0Xpn7NGRNeWvKLSG+t2ItsgpZ6mdZ:ni8RoWvKuG+kIt+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767676674, "uuid": "6dfbf1b2-10c7-482c-8c47-6b931be1eca3", "value": 554156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767676674, "uuid": "1190fcf8-6f51-4297-aa33-e07449e20d21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767676674, "uuid": "93f84073-a0f1-4963-a93a-23fbdec4b1ae", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90770307-eb01-11f0-a129-42010a9c0007", "comment": "Malware payload (Guildma)", "timestamp": 1767705239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705239, "uuid": "33846a72-693e-4304-aa84-470cc748b8fc", "comment": "Malware payload (Guildma)", "value": "5765c3adad3bb5eb6f09c9259301df00", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705239, "uuid": "1525b9d9-82c6-4372-8172-e49dc7b09fdf", "comment": "Malware payload (Guildma)", "value": "dcc65e18a02dfb9a360694285c0b93faf4e6d8b14af5e4b1c69e261712dfca23", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705239, "uuid": "c7c6fecd-3f79-4f22-976c-743e914ea7fc", "comment": "Malware payload (Guildma)", "value": "aa8caa276faa93fd39ec21f229367d9d4a4a2079", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705239, "uuid": "922c28e1-82a9-4d42-ab2b-7b7f6e5cf41e", "comment": "Malware payload (Guildma)", "value": "b4bd5a099ba9a5b0b30ffed23102e1d4df8a69301cd4d00d4f4593e8e923d3dea97ca1271b66ad30f354e92ec3b46e4f", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705239, "uuid": "80b8c1a0-344f-4928-a7a8-105434966df2", "value": "T1C201C4140F78D4B9C39B4C0640BFBE857E81A658062D3375285F690C5284D3EC8778F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705239, "uuid": "5a6451e5-c9d3-4fbc-bb9f-15a79abf8b3a", "value": "12:4Y5NtgZp1GhbnmkU5Uotf515uOZCgAbciFaYg6YxXRg/QFVYTYlz7Aw:P5uObnmb5UM515D9AbclyVQFVYG7Aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767705239, "uuid": "d5d67453-db64-4cec-94b2-c709a88230c7", "value": 823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767705239, "uuid": "fcd18b25-6f3b-4b7b-a51b-b6797a1fb9f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705239, "uuid": "8ff45939-1686-43b2-a5c5-c5a31c4ed19e", "value": "4305548766440.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6747108-eae3-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767692418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767692418, "uuid": "7fceea41-d915-4d38-9d2a-2831fa2d2a22", "comment": "Malware payload (AsyncRAT)", "value": "75b8e7a6ab5e1dd8b78bd6d4d91ad3e9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767692418, "uuid": "ce92bfc5-eb55-4160-927e-adeb929af750", "comment": "Malware payload (AsyncRAT)", "value": "dd4a261e45a02d4a645ced0c80673a5eb91e08c5d345e248eb63d424528f494a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767692418, "uuid": "b3d687ab-f16a-4878-9908-61bbdee535e7", "comment": "Malware payload (AsyncRAT)", "value": "6578306e989b25b19985c347c25541e37e2a840a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767692418, "uuid": "bd664797-e735-4317-a821-37cc505b4204", "comment": "Malware payload (AsyncRAT)", "value": "e67afea90c700b230bd493e3a4a1c04fe9cfbba1766fd948b9717aa3835792de4a55cca6e89a39505f3bfee6d96a3d8a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767692418, "uuid": "e6de7edd-15aa-4476-9ef3-bc4beebf2006", "value": "T1A0535B003798C925E2AD4AB4BDF295010AB1D5772106DB5E7CC814DBABAFFC646133EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767692418, "uuid": "edd5df16-db63-41d1-a36a-b26eafdfaea1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767692418, "uuid": "81aaadab-0c0b-4dce-8b4b-4a27614acf89", "value": "768:YhXCOXmSiPvZUiz9J64n7MrWQ+YueXMQ1+XSCv7mqb2nGpwH1ov6ge0sJp8GPZVS:YbmpRdgrW4MQRGbbFwFGGPZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767692418, "uuid": "1391d54c-248b-4939-8229-d94ed59905c8", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767692418, "uuid": "967c4a51-29f5-4319-8fdd-496e53dfcdea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767692418, "uuid": "7a87690b-2423-437b-892b-d8b522ab1331", "value": "StratigonNetworkFortress.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8319dfff-eafd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767703499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703499, "uuid": "45b2659a-6ba3-4a36-b095-aa3496348be9", "comment": "Malware payload (Mirai)", "value": "7b22a43f35c6eb0e84f4f63d4e219ec8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703499, "uuid": "110ba48a-8817-4fef-a006-a54854190756", "comment": "Malware payload (Mirai)", "value": "de273633b8daf4b2a1d744be34b12a8405b588c167c161475d98a14d4f271eae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703499, "uuid": "6183a1b8-dc12-4f55-9b46-fc961962c876", "comment": "Malware payload (Mirai)", "value": "658fcf5352bcdbbcb4989a1472a257e5804cd248", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703499, "uuid": "c409509a-6fa3-42bd-99c5-6578c04b7103", "comment": "Malware payload (Mirai)", "value": "60658c2245a4f94e783d3f36185e3677b3fd8dcc68554d7df7fa3ab3d36ca68cb048e9f1875674570c4ff8f86468000e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703499, "uuid": "abae75f2-a0f1-4969-8454-07e5f289048f", "value": "T13373F9C6B840AE11C5C61677FE1F114E33075798E2EE73628E145BA0778FC6B0E6B61A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703499, "uuid": "261e45d6-4165-4821-be06-1a6350056eb2", "value": "1536:iFnc3TrBVJamy5NEld+U31MJz/qOEHe2m//6BNzdI8ibVDO1C/:jfBVJrIgd+21MJenejZVDO1C/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767703499, "uuid": "ccecd387-7d99-40bc-b1bb-5eec32e49693", "value": 75064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767703499, "uuid": "9592edd8-86a5-440e-861a-0df7ed408ecd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703499, "uuid": "c11a5f3c-8cbe-413c-ad54-7133f8ee6cba", "value": "Fantazy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd030a1-ea9f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767663121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663121, "uuid": "093a0863-5e65-4733-bc17-c6900eacfa3c", "comment": "Malware payload (Mirai)", "value": "ad8d2bdd8e53a1c23a28f6c3efa437aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663121, "uuid": "459356a9-e665-4a6f-92b6-2edbd856962a", "comment": "Malware payload (Mirai)", "value": "e0a56b0fce8db473777e0f734b65bdd0d186c14587ea2de9976b9ecb0c263c79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663121, "uuid": "d6f65dd6-901d-4679-9611-5d3b42dc6cad", "comment": "Malware payload (Mirai)", "value": "bc3b8c0cdef665d8684d3c50ca139c5e3eeacfd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767663121, "uuid": "e3bf02d1-d14f-41f0-b4c5-c3d1c1a58c8b", "comment": "Malware payload (Mirai)", "value": "f60ca7d0ef58b7811d0d03da28c517ff79fc96cc6b9548adb9af767561dacb41fe9c991ea9db1df9ba8c2837095a43b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663121, "uuid": "2700da12-97c5-45d4-8dcd-f3d482e2ec65", "value": "T1E1057CC9E786E4E1F23340F1025EDBF75538A22A5013F6F6EF452A6274327616F1A21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663121, "uuid": "8eb068fa-c232-4728-842a-5f5a95314c64", "value": "12288:kuhTTH5hAQhM8Axsf8L30Mgyvg44pNNh2qGfzlfvQU4GPyMDXYyPEq+Lu:kuhTlhAQhwskAMgB9LNh2qgnJTXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767663121, "uuid": "99c833bf-b654-4d71-b601-fbbb72b56583", "value": 861272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767663121, "uuid": "1ef515f8-6e73-4c5d-80c1-a89a4bf45f6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767663121, "uuid": "89774729-3664-4ba1-b757-6fbba4bc1bd6", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bb424c-eac9-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767681005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681005, "uuid": "3fbde8f2-8d93-4094-b56a-810e6649e927", "comment": "Malware payload (SalatStealer)", "value": "17d633efa44195ae0dcc71ee00b082d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681005, "uuid": "cfeb3eee-f8d7-4c2b-aa3d-cb6f8916ba63", "comment": "Malware payload (SalatStealer)", "value": "e3e5963c668bb692207ac73e72fa053cf7c9dc0b7e031bbfd1923d4f9ced5617", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681005, "uuid": "70bf834c-cb48-4c77-8923-40a1586de448", "comment": "Malware payload (SalatStealer)", "value": "8b6fac1b8e6c351d8045454a692765d17c7944c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681005, "uuid": "7e1cc6be-fa05-4bd7-94c9-820da2837af2", "comment": "Malware payload (SalatStealer)", "value": "b6707fbc2f2d7f28d9bbcc9912fab01257728fc535823f70b3fea75189bdde5e651be92e6c37601813c8b28fbdba73f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681005, "uuid": "70405e30-2745-4ea9-87b4-4a0a2c171094", "value": "T149B63314ABD406F9F967D23EDA19C871933279129751CB9B03D41E233E236D92C3BA72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681005, "uuid": "1f8da1ab-eb08-4a3f-8350-0c71eee08e81", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681005, "uuid": "31b4a303-e871-467a-894f-1907bf57c7c2", "value": "196608:kJv3RkgbvqcmrusDOH17YcurHeD9BKG+5fc2S/ErXKEtw+GoH8MsqfTmd:c2la5VVuyDvV+53SM8+HzD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681005, "uuid": "9c6c149b-0b66-47d5-8025-e66a73b65c2a", "value": 10576432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681005, "uuid": "ce5ec4b8-69dc-45a3-af0d-e74f32819180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681005, "uuid": "c738ed71-ca5e-4783-ba8b-5b5148fe2548", "value": "17d633efa44195ae0dcc71ee00b082d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89167f5b-eb0b-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767709522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709522, "uuid": "d979ff58-166f-419c-975c-236de0584615", "comment": "Malware payload (QuasarRAT)", "value": "36302f2f1d8af21110ba981cc5eddec7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709522, "uuid": "e7c5a4ab-e901-410e-8978-fa0cd740416d", "comment": "Malware payload (QuasarRAT)", "value": "e49c36c3b9de82ab0dfc8e3410d0389de54b21b535f972c81fe289998b52cde3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709522, "uuid": "e486a686-5662-4d90-8f5f-13f91c2f1746", "comment": "Malware payload (QuasarRAT)", "value": "541557a3be6adcfab743eeebafaf47f44ab84dd7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767709522, "uuid": "4aa95394-a57e-49e8-9fda-8988244fff6a", "comment": "Malware payload (QuasarRAT)", "value": "9dd06625de543590a77851dc5183bc747c7df77d334da39accfda5ade59b4119885f2abe06e21c8ba3a178b87dc02ffc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709522, "uuid": "165b8b46-1041-4c20-907c-f29b9776eb4f", "value": "T1EA76561A5DD280A4D4D98A34E7BC86F966F12B2F5510A3BB11412BFAEF1035FB5122F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709522, "uuid": "92f95f09-2401-43e9-8043-ae1fba983b89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709522, "uuid": "50468883-fdc9-4fcc-b40d-38c0a24e2891", "value": "98304:jKe3rhi3h8rL/VQoCvbLdtLdgQlvaYQbRO2wxC0D:jK4P/VQnLLdgQF0Yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767709522, "uuid": "526f1add-6e9e-4db4-9084-e296826b7e22", "value": 7252992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767709522, "uuid": "12d147fd-c90c-451b-8151-cbc6391fa7ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767709522, "uuid": "07c27786-dc0c-4fef-acae-dad686148308", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25c8e97-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767721161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721161, "uuid": "7c1d9557-bac5-43cf-951b-d8ba945c0d08", "comment": "Malware payload (Mirai)", "value": "441e0a4dfdde36ecba6e674578d2ecc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721161, "uuid": "c7d3dcb0-31ef-4d2a-80d7-f293169f6ef5", "comment": "Malware payload (Mirai)", "value": "e506d42d32bd80c54db72cbcbc0c2baba38ddf8b244b838b2b8e7b8a0bb23e37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721161, "uuid": "bb1927fa-09ca-43db-ae7f-f7d296578396", "comment": "Malware payload (Mirai)", "value": "79a8a648346d74809f13d81a3397e0ab6c2d0b10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767721161, "uuid": "2ed65187-d240-41b2-b245-0ea11f4a85d8", "comment": "Malware payload (Mirai)", "value": "8c1caf2bef03109814a9951108db4677d7b2e7f080764e24965456f63c2cbf6f7df5c0889045312906ac4d3f090fb5db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721161, "uuid": "5ce5fb5c-69ef-4b27-be37-23f307444afe", "value": "T1A3D38D69FE4FADC1C2C7E37DED4A0FA275177874D665C0B20A00929FD5EAED88890217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721161, "uuid": "1d0b8d01-52cb-4237-be53-edbb67f9df13", "value": "3072:X49YO6kdzt4UtavPBWjdAuF30qo5CAKLFKNezPxG:X4+iaBWjdAuFkSAKLbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767721161, "uuid": "823cf9a4-ef02-483b-961c-30971bfe6805", "value": 131984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767721161, "uuid": "ac29768e-96f4-40f2-a979-77431a5f024d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767721161, "uuid": "a84f0676-3abb-4d6c-9a52-0c59c74764b5", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6161a3f2-eb0f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767711173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711173, "uuid": "64be8569-b6f7-4303-9c3d-ad137aef41ac", "comment": "Malware payload (Mirai)", "value": "fff5089d170269f998a1156c437731eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711173, "uuid": "2e9bda81-1738-4aff-974f-1d95f6467b3e", "comment": "Malware payload (Mirai)", "value": "e579a5bad3e5df52d049382839b3ab438f3cc84cf74c68067a0aaef00ebd2ee9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711173, "uuid": "fca0c2f0-b94b-49ac-a4cb-fbf787931cfe", "comment": "Malware payload (Mirai)", "value": "450115b4fd6dade919a08e44546a6bda113911fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767711173, "uuid": "2cf7ab41-0370-44d9-8a3a-89a908ce15b5", "comment": "Malware payload (Mirai)", "value": "0db6046536a5a6946c00c46a7e2012e9cf73f86c35affcb5ae06728e8d048e0ac5648a1a570e757cf4ad0a01b0c57c15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711173, "uuid": "5524b0b3-ca64-4631-80f1-9fe840fadb15", "value": "T1DA057CC9E787E0E1F67300F1025ED7F64638A22A5013F6F6EF452A6274727616F1A21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711173, "uuid": "a0582693-5ad7-442d-abd0-38e6f9f7e9b7", "value": "12288:140ETHyhYQhEK8HMGxwwSCEAaFrVpkGqmjay4zCtBWPyMDvnEnyL0Lu:140KyhYQhUMiSCAhnkGqm0utEPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767711173, "uuid": "54d6ac1d-3167-4cc4-9e9e-59ad96b269e3", "value": 861656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767711173, "uuid": "7335e935-67ac-4607-b332-8aa091a136da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767711173, "uuid": "a4839dc4-f323-4252-8f22-4f567ec9edbc", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3493ed1-eb01-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767705352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705352, "uuid": "3a63b7dd-7df0-45a6-b087-cbe52081a738", "comment": "Malware payload (Mirai)", "value": "8da1a81d8a5330dfe0d62e748861f299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705352, "uuid": "8727375c-fb1b-4192-966d-032da7ba9c06", "comment": "Malware payload (Mirai)", "value": "e7766504710cdcb0e741ed0c4e1349ef8a968599470b9df52a9a22dc1e9fe140", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705352, "uuid": "4ca17f51-50cb-419d-ab27-07d95e949d2e", "comment": "Malware payload (Mirai)", "value": "df9080d325cd9f4ab4130c0ecba8542d80aec353", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767705352, "uuid": "170f926d-adf1-4c59-92b6-08422ad3aa86", "comment": "Malware payload (Mirai)", "value": "49baebf6ee073196956b2ec1583fd920558eabe10176d685bbcbbf6087c92be61ebc9687aeff0752278205a56be50ab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705352, "uuid": "40e1a238-7e98-4a25-8695-abd4c7dcee9d", "value": "T13E73724D7E325FBEFFAD813987B75B205245339213E1C184D1ACEE060E7428A742EB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705352, "uuid": "5fcabbff-6ee3-4e19-86be-b4ed420c59df", "value": "1536:w1ecqk6zoxEeWawB8avOXL4HkWeVE7nbo7Pj2NkavMU/lmSV2sskg:w1ecV6zGWas8amLzFC7nbo7PQ70CJskg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767705352, "uuid": "298eb721-079f-46df-b421-a02f8c606040", "value": 79992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767705352, "uuid": "0939a883-e750-4392-848d-f6b9966ffeaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767705352, "uuid": "f5035f1a-4bd2-4a7f-aed0-02faf231f107", "value": "Fantazy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2060aa8-eb34-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767727227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767727227, "uuid": "987f944e-1530-41ab-8abb-a3dd5a2df250", "comment": "Malware payload", "value": "eb81d0a3565c48e3380bde508ee86a96", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767727227, "uuid": "54d8bd70-22be-445d-9bfe-118ad7fa984f", "comment": "Malware payload", "value": "e86a733ba25c26215e6c82a677525296347305e36e3caeeb3dfcfca6b709b40a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767727227, "uuid": "76acf75c-8b04-4919-8542-0c9b54eaa92f", "comment": "Malware payload", "value": "d1ae5eea0779891f1a2bd9073e8ea763c797c3bd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767727227, "uuid": "e8a37441-2c89-4f89-a13c-a513503d41cb", "comment": "Malware payload", "value": "064fb62193910f9380a628f8313ab6af425d86723775f133be3c5ed93920ad55e046c1d729183786a88d5b21730346e6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767727227, "uuid": "bc7afa8d-a14f-4b70-b30f-96171b8139a5", "value": "T171B64BD3BE1846A5DB9BE23ED461A2462230B086133112D7BF6517A55D0BBC8173FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767727227, "uuid": "3bd334cb-3ac9-41ec-94ce-0c48cb2165fc", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767727227, "uuid": "5b7369bd-da62-4bbf-9372-d7168b9d1da4", "value": "49152:BaZiGkrb/THvO90dL3BmAFd4A64nsfJFs9IAw4yFF0pQdgMv99cSQlF+PgaB+8/H:BaXRFPBjqzZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767727227, "uuid": "9f8a42f1-311b-4e40-8b9a-e2ecc0b92e5e", "value": 10555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767727227, "uuid": "1c426d52-a279-4ad5-8da5-0c78b55e2df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767727227, "uuid": "fcdac425-83c4-4d5d-86d8-a3d5855323c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d8c714-eb57-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1767742207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767742207, "uuid": "36c5a071-c681-4a89-a3bb-583e5d1c4739", "comment": "Malware payload (DCRat)", "value": "19ddc33cafe3f94e1a2d221010d86460", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767742207, "uuid": "dde3660a-795b-463c-a4d3-91365cf82ae9", "comment": "Malware payload (DCRat)", "value": "e91492e48f7a86783e88785156e3453daa85f5ce5b9fb4dcfe159996da72fd4a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767742207, "uuid": "d3ad09ce-e23d-4e2b-a769-c6a801c12b3a", "comment": "Malware payload (DCRat)", "value": "80be547cc6e440ec3f4cf148508ee4f9bc5d444a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767742207, "uuid": "135eacbc-9f5a-4a45-8da6-d3e8e59f1939", "comment": "Malware payload (DCRat)", "value": "bffcf24044cf26b4945168a009046455d269779d44ed5ea8d28401769afb733eb64762cdf8090843c28a06023ad5663c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767742207, "uuid": "335b957b-40d0-4a3a-91cc-082099ec483b", "value": "T105455B01BE04DE51F0891A33D3EF46484BB498516AA6E31B7DBA377E16123A73C1D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767742207, "uuid": "e01a13b3-ad40-4a6a-b7cc-0b5e223d8315", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767742207, "uuid": "1a50d785-668b-4b8f-8b1c-08c647505ca8", "value": "24576:Bc4MBRW8fO7eQSfNyxR794HjVWbpXXO/jX:BSfM4wuHj7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767742207, "uuid": "e68c0574-70ec-4c84-80d8-c9269f8df0b7", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767742207, "uuid": "e2f0ed86-f6ff-4bb4-a578-9cc534ea33a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767742207, "uuid": "44797a4a-72fc-4eb1-a501-f7ec9e16cbee", "value": "19ddc33cafe3f94e1a2d221010d86460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8872540-ea97-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767659834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659834, "uuid": "82bf8107-fc06-48a9-98fa-ec2af91f85ba", "comment": "Malware payload (Mirai)", "value": "1748b9d971b05e635499475ce55e57bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659834, "uuid": "1d2f2191-125a-449f-9d41-70407fa7b613", "comment": "Malware payload (Mirai)", "value": "eb2c42f197b29185e5839a28cc735d36b869571ebeeafd9ef13a1a23f9b57e65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659834, "uuid": "4a5dbe27-6fbd-4333-ba06-d83b03f191b6", "comment": "Malware payload (Mirai)", "value": "7ed80476e05154f90ae9428fd0f3dcffc024a365", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767659834, "uuid": "20b11bcd-e3d7-494c-ad30-9b215a3d634a", "comment": "Malware payload (Mirai)", "value": "526a14319fb46ff0bee92c756ac75a4da20ada28153cc8c915aab93cdff43e8d005b7d03be9cf9f1151205e49ad3a62a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659834, "uuid": "858ac7ce-f1dd-4125-a1f1-fd701e1c001c", "value": "T137F46B02EF890FDFC4AFCD30456E824B17ED89D706D4973451BC8D8CBA9E66A4AE3458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659834, "uuid": "212fc052-0057-4ce7-8cc8-066be5217208", "value": "12288:I/tfTsIQSjIMh6OwhVzQzyzhzb5lJYzrbI6TWLKjGjEwCgTh7xx4Unf0+1ZigKyI:1SenYNNdEc1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767659834, "uuid": "caae29c9-4137-4046-9e4b-5a6729ff20f7", "value": 730136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767659834, "uuid": "d10b4faa-8eb8-49f2-a4c0-b8970f4216c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767659834, "uuid": "984a5812-ce91-4f55-8b9d-50899d590f2d", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e40aa98-eac7-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767680164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680164, "uuid": "0f070696-38ae-495e-89e3-5bed210967d5", "comment": "Malware payload (Formbook)", "value": "da3b19649ee5d4572e5f19dbf4c9d4b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680164, "uuid": "1772ff42-dc8c-4548-b159-c7cd27275061", "comment": "Malware payload (Formbook)", "value": "eb6f7fd95744399028c5c7a546d78ef3fa1e8c0afa7005d88dbc619b4e1730bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680164, "uuid": "03d4fe3d-9db2-4c1d-9f88-69e128560d3a", "comment": "Malware payload (Formbook)", "value": "e4ac5a977c8bec09cd0e1aca5cbcb8ec12080575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680164, "uuid": "88ce8a6e-7e1c-41a7-8dc3-4d83db7acfd9", "comment": "Malware payload (Formbook)", "value": "752a20805ef38c8df553d088835207155d154236470a7d839527b4d77eb66a7b4ac43f0b80c2ed7013d5b677dc528969", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680164, "uuid": "19236820-0112-4add-88c6-f85dcd8467bb", "value": "T15BF4F15423A9DF06D0A69FF409B0D77007B92E99EA21D3079EEABDDF7439B006D50293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680164, "uuid": "ba40bd22-fe70-4b23-aaa7-fa6c9f114987", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680164, "uuid": "a3b7a4cb-6bc7-4cd9-b960-34090e7f955d", "value": "12288:auHG4y6lcKJ8CL/NiuIW4IbKSjDSG4n9MSau2CeZEWioFC5lKq9duN2kx:p8+d5KSj4+u2cWif5lK4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767680164, "uuid": "ee9baaf6-7d09-4c50-a88a-ae805eb39d57", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767680164, "uuid": "e331d580-b64b-482f-8e4a-3bb432f58e00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680164, "uuid": "1825e0ce-b084-483b-9e94-6cd65551081a", "value": "MV Nicos Tomasos VSL info.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712e7978-eb41-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1767732675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732675, "uuid": "8f71d69b-9ba4-4690-991d-4064d5287920", "comment": "Malware payload (ConnectWise)", "value": "9b0d5e21645264673a706dc9f52889b6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732675, "uuid": "b798fd57-5f96-448d-b5e4-ce678449e99e", "comment": "Malware payload (ConnectWise)", "value": "ec8644851c032955d29ef0c1c6d7565b4ab617b989930e550a21a888a0fbdbed", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732675, "uuid": "e5675f4f-c00f-4c3c-9e95-d3d32cda1777", "comment": "Malware payload (ConnectWise)", "value": "e03ddba2523c6a03573e78f6fc27339285f4b583", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732675, "uuid": "b16e6975-4641-470e-95f5-da9796668ced", "comment": "Malware payload (ConnectWise)", "value": "28f169fb27d62d26a027e1a3b2b1492ab80fde5923b346e65733d1b7dd2aae0beed662ed5b8bde2a41b31aee3a704d48", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732675, "uuid": "11e4a675-6bb9-4718-903e-a474a3f7064e", "value": "T1F3A6233662E4C026E2B71E39E9794AF25939BC468913C15F533C794E6871E81E9B3333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732675, "uuid": "41975b2b-7c18-4c2b-b4c0-0aa65c47522d", "value": "196608:z+kLGB1R+Z3/Q+kLGB13+kLGB1Y+kLGB1:CkqBzokqB4kqBTkqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767732675, "uuid": "aa8ecf00-4358-4e52-9002-5201e6198fd7", "value": 10063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767732675, "uuid": "98eb0367-8632-4403-9444-328bd8b20b6b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732675, "uuid": "206f2d08-1f6c-4545-a138-285cff842a72", "value": "dinnervipguestx_i1hqy.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df477da-eb4b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767736991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767736991, "uuid": "0a426551-b4cf-4482-ac17-38159684b246", "comment": "Malware payload", "value": "e9783ee67d04c624344225f55ecb8012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767736991, "uuid": "785fe6bf-9f9a-4e2f-b314-b4e87cf7cb24", "comment": "Malware payload", "value": "ed868c0bbf654880d014f954e935039c5d3a4ad7d615912277c4502bf67964cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767736991, "uuid": "72eed6aa-929d-4c15-b34b-b747fe6a5964", "comment": "Malware payload", "value": "b39232213ea396ff93a6488c4f5a1df0f3146725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767736991, "uuid": "dce3d1e1-7489-4732-9725-43713b57c115", "comment": "Malware payload", "value": "af20c0329cd556c32daea1d79fa85b1b2cd5bb4c4c81349ea40bd863aae9ba9f3f169b90764c78a4a85bc73d0659f3a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767736991, "uuid": "0a1c2f27-8732-41da-b8a1-1dd825c4cf8a", "value": "T127B6BF217246C53AD5EA01B1992EDE5E5638AF7A0FB104C7B7DC3E6E1BB04C21236E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767736991, "uuid": "0f430a01-55fc-413c-a758-552bab6a2865", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767736991, "uuid": "f1fe98b2-f000-4a7d-b9ab-8f7ede54fd3d", "value": "196608:y9upko8Rr6rMBqyoSwr8Eam1+KKRRZnhledGZNyS9HsqfUCS:y9/o8HqbNCm4/ReGdpVfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767736991, "uuid": "c5d84922-548a-415f-97de-a9cd99fdfb26", "value": 11026856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767736991, "uuid": "bb106575-46aa-45c4-8614-060f2b298396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767736991, "uuid": "e913bcb7-94e1-489d-8dce-1ce6b2da7900", "value": "translate_X86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9cb8766-eac9-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767681364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681364, "uuid": "4b9e8776-710d-48a3-a49a-ef646e48ca70", "comment": "Malware payload (CoinMiner)", "value": "dca0b93032e1b0fe3a410396c9a23378", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681364, "uuid": "9fb24af9-0e00-4406-99e7-db46044b3055", "comment": "Malware payload (CoinMiner)", "value": "edf5b5b21ff39adc2e9803378b23f8563b43a4be9a4fdea07ac735db33b568b6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681364, "uuid": "491e6ff2-9cd8-4999-a140-d5fb10c25c12", "comment": "Malware payload (CoinMiner)", "value": "13f604c97a5b960a81da1a3a2745df9f002b3c37", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681364, "uuid": "b45d57e9-77df-4418-b328-5d7b186d049a", "comment": "Malware payload (CoinMiner)", "value": "625725c48cf9b6de07d5f5ecae63fe9d0d06f5c3060422348478e466297d4699918e537e66c960b08ae852b172154486", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681364, "uuid": "a5fee8e0-f9d7-45b7-9308-ca0e3160882c", "value": "T198C5E857E49590E4C0EEE174C726A213BEA13499073437E36FA19BF11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681364, "uuid": "4994397a-2df5-4f63-886c-5f4d66bd03bc", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2V:cqYUQuVDt0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681364, "uuid": "7230ba5f-e79a-4bc5-bb3b-f37ee7aa69cb", "value": 2621440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681364, "uuid": "8ff4a6a3-1438-4a45-8c76-875ca8a58faf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681364, "uuid": "0885e2d2-e3d2-4bca-821a-c37418d5d362", "value": "edf5b5b21ff39adc2e9803378b23f8563b43a4be9a4fdea07ac735db33b568b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe29b55-eac9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767681375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681375, "uuid": "8a216082-726e-493b-b5d7-432dae5a9879", "comment": "Malware payload (Mirai)", "value": "8a26b7ccdb3a2d0fec65a47139a3985d", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681375, "uuid": "9827f5bd-a6bd-4d19-b85f-9a69f9188a83", "comment": "Malware payload (Mirai)", "value": "ee0e78f2464f101997187a43ba6692b9d69fd6eee5f71eb23e824f624e0e16f4", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681375, "uuid": "bf01f49b-8e9c-48b7-9186-b5eae5c37833", "comment": "Malware payload (Mirai)", "value": "5486d78f4da7125d983876eec3a1680cf5f51ab8", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681375, "uuid": "fe4bb1df-a0aa-41da-a4f3-a769a630541e", "comment": "Malware payload (Mirai)", "value": "af9219f18de1ca1d03f818989b991ca72d67103a2670fdfd9cba9fd07f52a38557ab9ebe4877c6d2d4cb6ee86468fc0c", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681375, "uuid": "e70e9e8d-fdda-415a-af2b-caf6f6ae6f6b", "value": "T18B336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681375, "uuid": "c8049efa-cdc7-469b-ad75-1a4871b0378f", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681375, "uuid": "ad61b75c-3b71-4f3f-82b5-6c97147f7762", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681375, "uuid": "2c7f197d-e87b-408f-9142-609ab07c725c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681375, "uuid": "12bf8a9d-fb44-42a0-85fc-4f083718b3e5", "value": "ee0e78f2464f101997187a43ba6692b9d69fd6eee5f71eb23e824f624e0e16f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe43ec6-eac9-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767681341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681341, "uuid": "93c77531-1534-416f-bab9-6e850aac712a", "comment": "Malware payload (CoinMiner)", "value": "c33e4775b6db871b91e1a7fc671f2442", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681341, "uuid": "9405fb0f-1bfe-43fe-aabf-259827f1e346", "comment": "Malware payload (CoinMiner)", "value": "ef1ef1954560b13d5c13e2142210d187bcfa9bb86690e0ff8d6de70bf5c8b4f7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681341, "uuid": "5faf9c0c-07e3-4af9-ba81-1e32138ba608", "comment": "Malware payload (CoinMiner)", "value": "fad9dd565a3a85ec6ae712552d4690bb194cfc88", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767681341, "uuid": "8237ae3b-1a1c-407a-89cc-39436bd947f2", "comment": "Malware payload (CoinMiner)", "value": "379b491ec5216b5486edd7c988aa10a3d1d8bac2a3c685b71db9d69114a138c4252a27bb8bc904c4f98bbbc6e97b77fa", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681341, "uuid": "5000cb3b-0d1f-4491-b413-bf0e7c3efd66", "value": "T1DDE68C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681341, "uuid": "60824a76-d706-4177-9215-10cd323d9f0d", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQT:cqYUQuVDt0TZE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767681341, "uuid": "44a14144-9fd7-4b2b-bf2c-918d2e820853", "value": 14417920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767681341, "uuid": "a3cc0110-00ff-4234-9533-41b65d81718b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767681341, "uuid": "323faa02-2cb9-4a57-963c-3a1a0fa117ed", "value": "ef1ef1954560b13d5c13e2142210d187bcfa9bb86690e0ff8d6de70bf5c8b4f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04defa47-eaa7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767666351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666351, "uuid": "84b93f5e-61c8-4f28-852c-0f4722152729", "comment": "Malware payload (Mirai)", "value": "1a7ccb0022e2c48b176ed8d62929251e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666351, "uuid": "a690f710-dfae-47f4-838e-5930e0cc9d33", "comment": "Malware payload (Mirai)", "value": "f10ba9a0575d2a8aa95a1938d522fe3643ee3fba08000eb73ca65f46a58509be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666351, "uuid": "a0f9fb8b-1b36-4600-a0a5-aaaf9286453b", "comment": "Malware payload (Mirai)", "value": "0ae2c5ea4a655e42a89c6806c723146cc2a4d46b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666351, "uuid": "b0008dbb-89e8-410d-bb65-37fd6f6c8adf", "comment": "Malware payload (Mirai)", "value": "ca71da2c4d140d6335c99f98bae4de2f767024880154d7196057cc47a47d7fc499e3060c73b8fb7d56f83e3767507467", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666351, "uuid": "fcbd6604-806e-47fc-ade1-4e719cc1efc9", "value": "T12ED3E606BF251FFBD89FCD3746A51701298D651A22F97B35B630D818F64B22F1AE3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666351, "uuid": "a91e2c5d-f015-4b57-a1ad-5e9a7a7b6814", "value": "1536:tPBbRAuMueGjOcIHcDoWQsPO7LHvqAcGSBu9dmMa91ZhscInxrH3S4boOc:tPBbRAuMueGScBoW1POPHFQwa91A8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767666351, "uuid": "a80f76d6-ca38-40c9-9270-e85e426b8727", "value": 134396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767666351, "uuid": "77fc9ade-2f79-425a-805d-4875dc3104e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666351, "uuid": "bdb8cffa-dfca-4fa1-a0d4-37923e3f71d5", "value": "UnHAnaAW.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3a44f3-eafb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767702654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767702654, "uuid": "ee8de00f-ac69-41d6-b48c-313314b6385c", "comment": "Malware payload (Mirai)", "value": "9732f398a7c363426b3aee596e5c31aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767702654, "uuid": "5990e6ec-d071-4f18-823c-1da785e4d728", "comment": "Malware payload (Mirai)", "value": "f110c9722cc512ebcf524288b5008e842464ff61fa93350d7614e694e3686454", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767702654, "uuid": "e22a5e34-be1f-4b7c-a65a-cfbfac071e90", "comment": "Malware payload (Mirai)", "value": "37f1bb97a9ce9988609541bd34adff72ee65b6fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767702654, "uuid": "22397c6a-b09d-4afb-806e-1f544aead3c2", "comment": "Malware payload (Mirai)", "value": "52dc714d5e1f9fdb003efbd1c29b4fa4516d9ec915aab939cb3907a23b786e38a91427fa952f8bfb9cf29ee8d3649e4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767702654, "uuid": "5282cd3a-9697-47ac-ac50-7711edb44a93", "value": "T1DB437C20C6BC5DA4C4408EB1B668DA745743A805A6F7BFF5CA40CB68800BEEDF5497F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767702654, "uuid": "e4839464-16c9-40f2-bdb8-f085b8d10210", "value": "1536:waD/DsjwrZ1kAmJeW/ZusCHkrEbHXCPF:wmIjSIeWIHGEbHXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767702654, "uuid": "05feb30d-81af-4181-8948-eb80f0a44a46", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767702654, "uuid": "f5e0f875-7fc1-496e-9cd5-8c1ca9a07c84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767702654, "uuid": "13253cbb-de53-4193-8f63-bd2422a95e06", "value": "Fantazy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929fd223-ead4-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1767685916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685916, "uuid": "3636981f-72f3-4019-b7a4-e9921b55ab71", "comment": "Malware payload (XWorm)", "value": "025a2c9c114d9bfd1647e07f2f619787", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685916, "uuid": "a1655f79-93f9-41e1-a3a8-359bc1d0ac7c", "comment": "Malware payload (XWorm)", "value": "f112173b5d500c88b145622a0350ae02cfce06092d413b89af9c82d800ce0f4c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685916, "uuid": "f273e4fb-860d-4923-9d83-2f3282c4a140", "comment": "Malware payload (XWorm)", "value": "2131d9a3576c0fe38d517845ebb79910f7a88440", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685916, "uuid": "145d3947-542e-4a19-9208-cc29cf31fd65", "comment": "Malware payload (XWorm)", "value": "b0998ef957a6d7563211400017ada2b15437f8933869471286983c4d5d548d3390eb88ed53b8dba6b21d6f80122224fb", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685916, "uuid": "6d6f90e7-3601-4677-a4cb-4a7ab3bebd7d", "value": "T127F4126BE0397F22978478C32240E669DD3E16FBC396749A12427B430C91A36F75AD7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685916, "uuid": "b0c40fc3-a804-4d97-91b0-0259f1eda930", "value": "192:xNsTKGrkBS95Dc4KSDiRdo65XGc06aycE:xYKGrkBS95Dc4KSDiRdo65XGc06lcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767685916, "uuid": "336f8538-25f9-4fcb-8e52-e819d601ad05", "value": 761940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767685916, "uuid": "dbbb0b2c-f679-492c-8461-b6c9a8c12042", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685916, "uuid": "3ad88510-88d0-41a4-9fc9-40d944d8d6a3", "value": "FACTURA_00847_IMG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4ff6f2-ead4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767685907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685907, "uuid": "7967e0fb-196a-484d-a1ad-94d5b941df88", "comment": "Malware payload", "value": "8e0da9856d09e74a6b5b82e9dade2cc1", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685907, "uuid": "4946752b-a850-43d1-b136-4aec00e22605", "comment": "Malware payload", "value": "f45ab0d06f06385e003a7113b9223b20ad163a1a3b99e98384d25c4587b11c53", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685907, "uuid": "11d15517-838e-42cc-b6cf-f73b03d070aa", "comment": "Malware payload", "value": "e352adbf59d7b4a85d078635ad566e1cfb4c35a5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685907, "uuid": "acab9a56-f0f4-4371-9704-af8733641876", "comment": "Malware payload", "value": "f0b48bfacfdf6ce5306fde9c6925c2645b69003a96915f6c2f63f04d6dcd5b494f0394bae5c1b49c95530c2362a286a3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685907, "uuid": "6b93ff50-7acb-4d7b-a5f7-a467a3f4016b", "value": "T1F1D27E7C24021724123752B11797DB47BBA046FD7A79D8E01FEEC901B6FA2BC9E61C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685907, "uuid": "4fe0b35d-6758-438e-a47d-6da615f332af", "value": "768:YNf4JSNf4JrNf4JeNf4JrNf4JXNf4JrNf4J0:Yp/papzpapkpap1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767685907, "uuid": "a91ce12e-2ec5-4c12-90c1-a40f93a4bd9a", "value": 30346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767685907, "uuid": "0a0616f3-dff0-48e3-b40e-f0c11dc4eb34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685907, "uuid": "7ce70cc0-094d-4e00-8316-860526de1254", "value": "FA-21-12-2025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8d152d-eacb-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767682043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682043, "uuid": "d2137d0b-a6b7-43f8-b1d2-c8111a2b3990", "comment": "Malware payload (CoinMiner)", "value": "1065431be899bc13afe8822d6d777384", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682043, "uuid": "4ec091bf-c54e-4cab-a974-52b90943f5b2", "comment": "Malware payload (CoinMiner)", "value": "f4e2ae38225166f23089e03533336e08e19dd780fa766eddb698657203dd2af6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682043, "uuid": "806db714-68d8-4bef-8c69-205bce184c13", "comment": "Malware payload (CoinMiner)", "value": "9b56f1b2e197b502da0a82a7a7d2dfc7aeff1394", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767682043, "uuid": "34b45f83-dd23-45a7-9b32-9f454760175d", "comment": "Malware payload (CoinMiner)", "value": "270c489369e927b3e1a46e05478e61fc31823c075f46f7aa93260ab20addc2a94be61bfc0adf8e6a34d8ef8a021f0341", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767682043, "uuid": "055d9368-515d-4b54-b001-e75d51522b5d", "value": "T174B67C73905334D9E5A88DB4D11416526DBC388B5738A3CBBAC471F667BABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767682043, "uuid": "4b2cfbdb-2a35-4926-bc44-1b6b39f69f5f", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQC:cqYUQuVDt0TZEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767682043, "uuid": "571ff260-2ffc-4f8e-a9c1-7b34a678b5a9", "value": 11304960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767682043, "uuid": "4a65b0d3-a8fe-462c-8b8a-5c9fe672793a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767682043, "uuid": "221ad6af-5929-401e-b966-33460ffd28cf", "value": "f4e2ae38225166f23089e03533336e08e19dd780fa766eddb698657203dd2af6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61dab7ec-eb05-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767706879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706879, "uuid": "6780878f-f434-4b34-88fc-449e28ddcefc", "comment": "Malware payload (QuasarRAT)", "value": "27b327551331817c02b00f01727c720d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706879, "uuid": "6a33de86-6e79-48ae-ba1f-7100472556b5", "comment": "Malware payload (QuasarRAT)", "value": "f78238db552a2bcab1a68fcf3df9fbae50bba3c44d3bda6b7dddcfc007eee046", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706879, "uuid": "dcd9a8ee-1a69-4006-ba35-9d1d9c651092", "comment": "Malware payload (QuasarRAT)", "value": "0fa35cfc8be8175a4fe16239cb0421a8e607b06d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706879, "uuid": "bebbda65-5151-43ee-beed-58a47331553b", "comment": "Malware payload (QuasarRAT)", "value": "c934f6d07908acbda30e5db6115385f9bf091b5a1698dabd77759ff108ae258ea0f22b1783a3d4ea330c28367704f43f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706879, "uuid": "c99f22cf-d90c-4a53-a210-cd8e74d9cdda", "value": "T161C523853BFC4948F6BFAF702DB626648579B8A25D21EB5E05C5309C1930FD5ACA0F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706879, "uuid": "591a5db8-340d-4a39-b0b4-d4497ddce17f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706879, "uuid": "de8eba0d-eafa-4f10-bae6-10c098c62241", "value": "49152:CKoL+2upjBVhbAbXMtQl/wLz8r5S5l7KdVSZ4eY83TAcm:CL+2upjBVGVl/lQrCSZ4183Dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767706879, "uuid": "0c56d754-b5f4-4959-8a53-abc93b999cf7", "value": 2613248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767706879, "uuid": "1b63c6dc-a391-465d-a2ea-ffdc2f58acfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706879, "uuid": "e49b0a59-319c-406b-9bec-7ae0eff98fe7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1edd28-ead2-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1767685239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685239, "uuid": "bc4488cc-a35b-4bff-a85a-6922b022ec08", "comment": "Malware payload (RemcosRAT)", "value": "f24d9308bb70ccb74bff2bfbcdd3b89e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685239, "uuid": "95ab8583-0d8e-4095-a8da-524e0758a66a", "comment": "Malware payload (RemcosRAT)", "value": "f7ee227d17a1a53dfd57291d98ed6f7037145146d3bff2b5e23ea9bfb84d9b2d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685239, "uuid": "0c67cbaf-d744-48ed-b9e1-8966e6a9730f", "comment": "Malware payload (RemcosRAT)", "value": "92a71f230ff240e4d149061605a0388d1a10bec5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767685239, "uuid": "8ed1fe46-813d-4a66-9863-a4d104dc77f9", "comment": "Malware payload (RemcosRAT)", "value": "2d3453c3413b5c503e7f2c2459684e11568ef8aadd665617838fd6f463885fdc852127f09d5f7c28b56591a70c1a3de6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685239, "uuid": "6e487c5e-f4bf-4337-bea3-14a36deab9f0", "value": "T1031691CB433CC6C7C6664566BACF2E14F843196B8F0E6006F5866BEC971D166A7F4838", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685239, "uuid": "88f9a984-b2e4-4d74-affe-b35fd1bb52ec", "value": "384:6ebce0Ke7ObRexOe7EbvexGe2ObEe0Ue6OeUeV5eGeb8e0Ke1EeleaBe2Ubue0KK:92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767685239, "uuid": "dceeae35-cf86-4b88-aaae-a62fab52f04f", "value": 4043536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767685239, "uuid": "fbf05d96-79be-4906-9e7b-5bf3af67f5ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767685239, "uuid": "a456542a-f1a4-440b-8e52-6de0051eab77", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3703f97d-eb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767720981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720981, "uuid": "4ecadbca-98d5-47f6-b1a4-0eb4fe003796", "comment": "Malware payload (Mirai)", "value": "ea6b8019e0c3ac353c119f6a836e8b1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720981, "uuid": "33b18dc4-bd9a-4af4-8b00-e89e3c0abfed", "comment": "Malware payload (Mirai)", "value": "f836d085bef13ee053e9a13e60ac42e4514db399584d3ee9d7ba323bc97115ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720981, "uuid": "097f41d6-8af1-472b-8bae-aff9e42de3e8", "comment": "Malware payload (Mirai)", "value": "b92253b412c2a17a7c31bed70df9c704cbb62be8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720981, "uuid": "2c6534e4-a610-4b4d-81e0-8c64f7655f28", "comment": "Malware payload (Mirai)", "value": "262f729c8ae3a3714fc98a4d74d2ef40ee27e578552aa7ef8a582d957ffd1139434ce58767a2a1860828048181eba95b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720981, "uuid": "b6cc7fe9-4d51-4f25-918b-779f5618c13c", "value": "T1125302D24932367BF02460BD77B2589987C96DB09EA6A35B679C115B3270F49B11C0CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720981, "uuid": "99bb3c32-c5b0-4e5e-85a0-7d54b1cea3cc", "value": "1536:87S1symLz4ab7sU4Gpk+x5cpzT2M2h5cB5sUvDAQ6:8W63jsFhzKME5ANMQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767720981, "uuid": "b4247f9f-e9f5-4903-9fc9-c04bb664f4a1", "value": 60676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767720981, "uuid": "ca9652ef-c89d-4a2c-b1ae-ea8d13b5cd87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720981, "uuid": "d8dc440b-c561-4a38-a6dd-ce13a1bc2cb5", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8520f903-ea9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767661412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767661412, "uuid": "12bfb53d-2782-4795-8ff8-77fbe05ee096", "comment": "Malware payload (Mirai)", "value": "6c893a5658a496034611afef745180ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767661412, "uuid": "be75ecc6-3ece-4ecf-b86d-1a6f0e914022", "comment": "Malware payload (Mirai)", "value": "f8b55eb873faf9daf14bbddc6d890d9ad8cdcd1b4719f57d4dd12c622048e96b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767661412, "uuid": "a12b452d-d070-473f-b68d-01d3cc4e67c3", "comment": "Malware payload (Mirai)", "value": "9c776c02fc5e9ae172870e4b13a217570f48605b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767661412, "uuid": "7457abea-60d8-465c-907b-e438bf1acae9", "comment": "Malware payload (Mirai)", "value": "6cb9893bc43ac9112d77096c0e88c19346211e45d6803d8c5271dc5f858f9e59286dacec254041d3ceba3e78e2aa97f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767661412, "uuid": "8140eb49-80a4-483f-949b-a57fa4da2f51", "value": "T165231944B8819A23C5D4237EFA6E019D373563B8E1DF7213DD216F15778A82B0DBB642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767661412, "uuid": "2a29a4c0-ccec-430e-9932-7247cab6b903", "value": "768:4JkpG23cuevkkthJ6tppekNj49Ue5OgGukNmTPjp8Ou7:Tpn30J63pNW9Um9Gu/Hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767661412, "uuid": "2ce9745d-6b1d-486d-bf5f-ff3e17c7018a", "value": 50044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767661412, "uuid": "8c9b150e-af3a-4fd6-91ec-b6730c5d328f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767661412, "uuid": "391cf084-20e4-4d72-b8b4-d0efc52e3bbb", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a15a419-eac9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767680962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680962, "uuid": "56338467-fd1e-43a1-92c2-9549f3fa6bb2", "comment": "Malware payload (Mirai)", "value": "eb8fb64e84d5209edbebc9b886022873", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680962, "uuid": "b7c545b0-43cf-4ebb-aa88-e40339fc46e9", "comment": "Malware payload (Mirai)", "value": "f8b6942c7c8e78fe74e96df61f634dae66b74fddde6448548491ef1834be4bf1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680962, "uuid": "a79a3725-8abc-49ba-94a1-f985680bc792", "comment": "Malware payload (Mirai)", "value": "87efd68ed35d4ae4cf32e8e7ba53cd4c92d0bb12", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767680962, "uuid": "066909df-c554-4b74-9fc9-c5c2c614f527", "comment": "Malware payload (Mirai)", "value": "ca35ce3efc7ffd9cbec725cc96335549e32da6c54d896efb89afc1dcaf47224636bc087ec37ac6d191e99f4ae31e9eaa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680962, "uuid": "30df75d5-73e7-4000-ad49-3179e67084e7", "value": "T1E351DAC912B2C0B16CE7DFE776B9998073C090D398E7BF54E5D878E846DEE18A054B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680962, "uuid": "76a7f94b-0ccd-4370-b8c2-af2bc0ec25c8", "value": "48:vr3mvQE1AX8qoxaQQB0qmoJHlv3ELxJAOhm2XVF:vzmvQE14qmmGHlv3ELnAOhm2XVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767680962, "uuid": "8e1945bd-a6c5-44a5-8457-14776193de3e", "value": 2490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767680962, "uuid": "e2e12389-6ecd-46c7-8ed9-3d3b967c706b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767680962, "uuid": "a6221c5a-e879-48bd-beb2-cf1204197b74", "value": "wc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac3cdbe-eb3b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767730275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767730275, "uuid": "81b83c4e-3252-4265-a624-1b6b770163e5", "comment": "Malware payload", "value": "345c99a32477595d0d8b7808ffe91f67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767730275, "uuid": "96598906-4603-40bd-8a88-af033fe0df50", "comment": "Malware payload", "value": "f8dc8ab08e9ac3e9b68a81418546e413eb5bf1692a50de662f571e539bfff131", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767730275, "uuid": "c63bf407-a45f-4ad6-b9d2-427698b68c80", "comment": "Malware payload", "value": "7b0149371fd97a76dd010bd6cbe98dfd8c7b3eed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767730275, "uuid": "ea92bf12-b059-4a91-984d-dcc1f2c640bb", "comment": "Malware payload", "value": "5012da4cf3784b58407ce631f2a4a8a93ec42a5e35a019b0402b65fae2146647ae76b472a493f63ce800c285314a394a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767730275, "uuid": "77f76518-e91e-4d15-8a53-3e05e9be822b", "value": "T19745334067B99CE4E774D8498BCCACAE5339C411157A1F8BE4325CF326CCA67369AA34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767730275, "uuid": "aa9f992d-b93c-4bee-ae96-828ddf285e93", "value": "24576:hzfEtBkjj8t0D/p5fAZ6LNnw3sXQyXQ9enZM/CTC2c/w9p5:hzKB8j8y/fvNn005geS/AX99D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767730275, "uuid": "3addca99-713a-44b7-b7bc-c1c2f8f3292d", "value": 1212156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767730275, "uuid": "9e363c04-7a5e-4806-a062-e2c1960396c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767730275, "uuid": "0ac14d4c-cea1-407a-a38f-44cd22e2a742", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ed09a6-eb2b-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1767723309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767723309, "uuid": "b58e253a-de59-4fd8-934f-e0532cf4a455", "comment": "Malware payload (DCRat)", "value": "042294460498250324189c0f3b246b41", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767723309, "uuid": "c1699a56-1687-4858-9b4b-5317945d94ea", "comment": "Malware payload (DCRat)", "value": "f9f14b4c12fc02ab7429fdcc5d050fb33120b776947c9d205fd637e8207384aa", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767723309, "uuid": "a5fe6632-6dbd-43c7-b708-addb06b957dc", "comment": "Malware payload (DCRat)", "value": "eb942efb914acd951859c361a390ae3f9f3df99f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767723309, "uuid": "8c26f424-e7ff-41ed-bae4-e2332977794a", "comment": "Malware payload (DCRat)", "value": "3e265f46cb9878bae2990c914b891d073685391c7635c3b7fbb6c51a74b4fa4bd923901941e6c780d8d3c2230ed54893", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767723309, "uuid": "9ecb7310-3d9e-49a5-830c-455fb11c94a5", "value": "T1483538017E46CA41F4085233D2EF858847B5A85166E6F32B7DBE376D95223A73C0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767723309, "uuid": "deda04ce-91f5-4cf5-bcd6-4aae07429266", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767723309, "uuid": "2cea6789-fbf0-4a04-93de-6bc78fbaf4f5", "value": "24576:HqwleHPxfnTdr+Lo8UNUEa+7oa/S7ysA+CeiY3ai:HqTsLERacoYS+sA+Ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767723309, "uuid": "6f25de5a-67a5-42e5-afdd-a51023434c12", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767723309, "uuid": "ec5f02b1-1b8a-4b8b-8278-f5b76dcc3b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767723309, "uuid": "94909872-03d1-459b-bfc3-59552af0fb30", "value": "042294460498250324189c0f3b246b41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff9a1af-eaa6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767666342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666342, "uuid": "6343edbb-746e-4977-a6fe-c9b4babcb69c", "comment": "Malware payload (Mirai)", "value": "3d401e45233a3140522fcb230087a269", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666342, "uuid": "49350af6-e393-43e0-8e3c-4dd4fb8c6205", "comment": "Malware payload (Mirai)", "value": "fa73db3970e5b8c3e55fbbeaa1a147cc2349448d9884690256ebb0f353996389", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666342, "uuid": "20bb83f2-882e-4db8-8745-58e2359ea4d5", "comment": "Malware payload (Mirai)", "value": "4da9712a2257ea71c4efdd27abc882c092820b19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767666342, "uuid": "88402252-ccd5-4b48-8b33-fb30680decae", "comment": "Malware payload (Mirai)", "value": "459f4af9af197f31fa5838f8b780d476efe9682ee71e9a68f0814697eb965d773f26c8dff4ba47899967699a23da285c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666342, "uuid": "5cce5983-e0ef-44a6-b628-bdae52c9e9e2", "value": "T15EC3E81E6E258FBCF7A9863547F78E25965833CA37E1C581E15CDA001E6034E642FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666342, "uuid": "9b0b8f36-c488-49d2-b2bd-cbd098be706d", "value": "3072:YjjO6n6aMb1oz88NbqgzVOqzMrXASh9wxtDb:Yjjf6ard2ghOosQk+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767666342, "uuid": "7cd008e9-437e-4e6d-a5bd-46aaea9afe4b", "value": 129900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767666342, "uuid": "55037899-fc6f-4b3c-aed2-ef2ce6258279", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767666342, "uuid": "4ace4a10-6077-44b6-bbcc-249c3b6277ee", "value": "UnHAnaAW.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628a45f2-eafc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767703015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703015, "uuid": "8f988a98-3da4-4831-b75c-94fc8d9b4a83", "comment": "Malware payload (Mirai)", "value": "d515bf342d07caba906ff33cf209c954", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703015, "uuid": "a35881bc-d6d8-459c-8ce5-446266e428d0", "comment": "Malware payload (Mirai)", "value": "fa9cc515a7c82e8d4c0508138cce62a676d18d73ebb0779b0032f7d5471563e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703015, "uuid": "bb07b24d-0399-4aa6-8948-32ed5b7cad0e", "comment": "Malware payload (Mirai)", "value": "6929bfbe05290e0ff56f774210b15bc447c06844", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767703015, "uuid": "defd75d5-6ddf-4b19-8fe9-8d559b23f08e", "comment": "Malware payload (Mirai)", "value": "3c4525237fa46fcdaaf4c9615fa101ddb82cf813c725d490312909140eaa0dd51297e7f25b78a003ce3fbea2b9d05ee0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703015, "uuid": "4a27457a-5d66-4827-8442-77814c3c0600", "value": "T195534A8BD6C7F9F0DD42057C20ABAA35D436A8223174CFE7F7D9B513E966602A01236D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703015, "uuid": "e336b5c4-5e36-4903-a4e0-9de60a25066d", "value": "768:0HM+HZ7PporS5eFRMzFpQRPagnmaWqby2iLZ06jR3vrNpHFfhsIGExSmVDVexBuv:0HM+HlxqSE9N+/JR/rNpJGgxSHqjduQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767703015, "uuid": "18db6790-df6a-4a08-95cd-b71593c85692", "value": 62048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767703015, "uuid": "5944a02d-25ac-49be-8d26-c645fb107709", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767703015, "uuid": "cd718156-fcf5-4b44-9810-294d36c77bb5", "value": "Fantazy.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca9b005-eb24-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767720453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720453, "uuid": "ce47f95f-daf6-41f8-8248-3d281280ade3", "comment": "Malware payload (AsyncRAT)", "value": "242c4b7775e26699a4c85a156bac6e07", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720453, "uuid": "213e448b-a857-4c86-99ff-8fd35ef9b849", "comment": "Malware payload (AsyncRAT)", "value": "fba9f6b94479a924c563165dafb70f184d6b1e4a850863920ad2d274a4cd89c6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720453, "uuid": "802a3251-94e4-4801-975c-0310495047e3", "comment": "Malware payload (AsyncRAT)", "value": "7e80d0e7169457a23597c3d09b4c18fa6a93385d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767720453, "uuid": "ef3126da-0faf-4ee2-a094-921ef82735a8", "comment": "Malware payload (AsyncRAT)", "value": "91a60e5a243cc9edb00b21d932b39b81fa31e2670ab1b8a71e35f9b93b26474bd7aefd1e93a5ac5f9ec17b6e8ce36086", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720453, "uuid": "a22e4b70-b01a-4012-9e8d-50edd4c71725", "value": "T19D535B002B88C966E2BD4AF8ACF2550046B5D5772102DB5EBCC804DB6BAFFC645527FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720453, "uuid": "584a9c33-a42c-4df1-9b58-2ace0e9b36c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720453, "uuid": "724d2112-5ca9-46a9-a370-97d6f45e85e4", "value": "768:4HEkzqbHiPndMim9JabcXveeObMbNCl1+6SCv7mqb2nIpwH1okaEmf8GlJVc6KN:44bgYieeiMl8GbbXwDaEm0GlJVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767720453, "uuid": "78683433-c3a7-4449-a037-bed47eec7742", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767720453, "uuid": "7e1d2c63-2589-44d2-a283-6e2e38215941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767720453, "uuid": "e3e5fd7c-ea87-4e15-8857-1120d9279800", "value": "oddarium.platform.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af671fb0-ea98-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767660194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660194, "uuid": "8e3830f9-517b-454a-a2b3-1d2d3914ad96", "comment": "Malware payload (Mirai)", "value": "9acec5f324acb3e1854092a5ab942a20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660194, "uuid": "a30e80e8-52a0-46ba-8267-5891f1c9053f", "comment": "Malware payload (Mirai)", "value": "fbbe346984a148152b418c22587cb0fb103da9ce7b46fee454b7226317610a61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660194, "uuid": "988c9029-9635-4284-9c52-c45516133dc6", "comment": "Malware payload (Mirai)", "value": "9b5d85f0f8f1720d49744af365ee8e5c99f75ea7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767660194, "uuid": "6fb01c77-341c-4e3e-a337-e6dc62222606", "comment": "Malware payload (Mirai)", "value": "e082c35098e4ebd22b159425f2f8f2d326e0d4d82ee3f86a79d1be3d4adcde748d593b8b46ff3c112615fb8f724c4247", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660194, "uuid": "db655bb7-f040-4b78-984a-0bc2abe53bf4", "value": "T1BAE209A1590AB1ACF8E9013EB14B22B516E700683DFDF3DBF4275526EA5570C6CA6E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660194, "uuid": "8528e394-2e7c-4c7a-b9eb-903f7a5bae26", "value": "384:ZHrHDuM6czKlJMnLcdLDh+EbW+vZHodYrK+DCnVormyNrYBOStlzZ1yBlyLaYL:hKMWlja+r9DCnymyZYBm2BL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767660194, "uuid": "f0f73adf-1aad-4cac-b70e-7131b03789f1", "value": 34216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767660194, "uuid": "93998e73-95e4-41b1-9995-3ea186438e91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767660194, "uuid": "032bfde8-e17d-4917-927d-b75369b1b50b", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486a3620-eb05-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767706837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706837, "uuid": "d539edab-67e9-4d94-9692-2bd12634361e", "comment": "Malware payload", "value": "2a74801f32e53cdfe6f1b0f2d1f5f2d0", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706837, "uuid": "a5f770b4-86c5-4dd8-8136-20e2cd23c393", "comment": "Malware payload", "value": "fc801a8f1ea394d22e90a128add5854439b104df79392a18b26dfd8267484433", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706837, "uuid": "8f00dbd6-75d2-484b-a64b-354b58ba4233", "comment": "Malware payload", "value": "b685f7e63ea2636b1bc1f8d1f013adb8d1498065", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767706837, "uuid": "df5a7779-e09e-4ca4-b6da-848683107b1b", "comment": "Malware payload", "value": "ce9c91812eb731b0423587041abd8600b5d6c536ab770c51cfb67f9e0d7461491fd187b2c02ed424ab3b7451b75857cb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706837, "uuid": "09c77008-6990-4908-8c53-0eadd8f63f73", "value": "T150C4029643F2A991D905373DA79C08FA60FC6C9085E4BDC2D936CEEB512F128D4297BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706837, "uuid": "85c7c34e-d2d6-4e9e-b1c3-928938ee66a4", "value": "12288:F9RqXJp9RqXJu9RqXJc9RqXJ+9RqXJm9RqXJo9RqXJs9RqXJ39RqXJ89RqXJc:F/Kp/Ku/Kc/K+/Km/Ko/Ks/K3/K8/Kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767706837, "uuid": "d914d6dc-e315-4141-9410-45bed723b733", "value": 566786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767706837, "uuid": "3827d815-1e45-488c-af87-2db856dd0a54", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767706837, "uuid": "a8d1f467-eb43-41d1-8372-c52562473cdd", "value": "Package of documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d12e5ac-eb41-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1767732695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732695, "uuid": "acebc3d6-06b0-44d2-9d1e-9b39a1710eee", "comment": "Malware payload (ConnectWise)", "value": "064e882b5af2ac01453c741b62e9c4a9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732695, "uuid": "35a434c9-62d8-475f-90c5-b545d7b81e81", "comment": "Malware payload (ConnectWise)", "value": "fcac230c237ad424e5221feaa3978291c8c7e6da5f04f652fb2808a65847f157", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732695, "uuid": "c0b3c042-4d5d-4890-a395-fc5a2d931e78", "comment": "Malware payload (ConnectWise)", "value": "f1d37634c7804b28b80b18f1a4a96201ff7e6968", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767732695, "uuid": "360a7084-08be-4868-a538-9fc1fb658302", "comment": "Malware payload (ConnectWise)", "value": "5989c8540208fb32160d9430ed69d7eec932eb97b146e564b555beb9a33098069877fa84d3743abb616ecc0514fb7ecb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732695, "uuid": "5d28a7a6-b3ec-4b8c-9aa4-1d921c374513", "value": "T103D622136BF89E67E0B1DB74FF365464A7277E055922B1EE1214790E2F70A8089A3337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732695, "uuid": "4c2b27ae-f87f-4aa8-a6c2-97343f5bda30", "value": "196608:BHxcp9ym3nltDUJVnHxcp9ym3dHxcp9ym3xHxcp9ym3wHxcp9ym3gHxcp9ym37Hg:zGplp4GpPGpjGpeGpOGpFGpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767732695, "uuid": "e09e43c3-850c-40c8-aed3-eade6958ccaf", "value": 13541376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767732695, "uuid": "72ca676e-fb41-4d26-98d0-5f89d0233ed2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767732695, "uuid": "ca1cccd2-830e-4931-9fc0-4c8dbee59eb2", "value": "WindowsExplorerSupport.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd61655b-ead1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767684753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684753, "uuid": "844e6c3b-e747-4e44-8337-2995e4432d73", "comment": "Malware payload", "value": "7144bfd369c6070f8723bb8523cd9246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684753, "uuid": "99146a7b-2c0f-4ae8-8fef-ba54941eee2c", "comment": "Malware payload", "value": "fd1ce709645e820d6347b03a688cc2a5c1b4fd79c3138ddcc66d3da50e654030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684753, "uuid": "2a0409da-b037-49d3-b150-d99f7117bf43", "comment": "Malware payload", "value": "a4c14422ee001d4a6e35570707554d0e55d63c66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767684753, "uuid": "2e3661b8-e6bc-4a17-99e0-414593e1f0c4", "comment": "Malware payload", "value": "b0aab3174ac0599c547a1bd7d07a33301709bf986bdc796f1a99edcbf479169eac687f15b5cb83aeac6cbf4b2863b797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684753, "uuid": "08d1799a-eb05-446b-bc1c-74b5123f5538", "value": "T186835901F250C035F0F700FACBB54B7A5EA9AF11536890DB57D855EAAB31AC1BA3235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684753, "uuid": "07dc89e2-1e06-4eda-b3ee-8676041af850", "value": "3326b0ed8ca5d20f5013f8b3c04e7744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684753, "uuid": "74d936d6-6722-41bc-8755-7b95932f05be", "value": "1536:Z148CrfdXNM840VhyGzirik7okuAhoB2y:Z1zmM92yrCksB2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767684753, "uuid": "e028219f-3b3a-4e73-9a05-f7c7eecd871a", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767684753, "uuid": "916b218c-70c0-4e9a-b036-7233d5c9d93d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767684753, "uuid": "f0076ab5-d1a2-43c9-9f82-90c3a97d2de8", "value": "7144bfd369c6070f8723bb8523cd9246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }