{ "Event": { "published": true, "date": "2026-06-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-21", "timestamp": 1782086582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ada6ac94-b95b-44fe-8df7-d6b6d4d1ef86", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dad1e95-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021945, "uuid": "d53137c4-690e-4498-ada0-49e9ebe75e9e", "comment": "Malware payload", "value": "7ce9f562d6790dad02e0390237398e82", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021945, "uuid": "280216b2-032e-4ffc-be58-bd74721f13c0", "comment": "Malware payload", "value": "003b809bbe54f6a74d71fd12ea755073a9d7dfcf540fa3a885341c67f9042759", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021945, "uuid": "f83ad5a4-2c88-4c32-b8ff-f6d9d423f40f", "comment": "Malware payload", "value": "a8edece5894da8a32140264cb9e2a4b4c7dc659f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021945, "uuid": "7fb5e00f-02e9-47f2-9ad4-f7f2c5e6e896", "comment": "Malware payload", "value": "2db212e267f3d520fdc8f78de4d3658c47939df02af3f45f43e1e4b1433b82d17370e9a30d6247bb81aa92ae2e59e962", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021945, "uuid": "f6dba643-5a21-4d4b-852e-16af54fa9f08", "value": "T12F41BDCA7AA3D97197CBC4391FDAE501E35624430995A998B08EBC303F69120FCB1E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021945, "uuid": "7c0a2f57-2e87-42d1-a167-90e5b9a699ac", "value": "48:5VdxxzGG1eCFeZdzVKN5Q1f/neHuDmmlBFInKIYgQAul4N7vGxQ:bdnIu2mQlGaL2nKI3QaTGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021945, "uuid": "e931ad91-d433-47ea-97ec-6973725fb5fc", "value": 1967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021945, "uuid": "68bdf6c7-ce30-4f2c-8178-cc1dbaec814b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021945, "uuid": "d84aa6f0-d55b-4ec8-9a1e-25e2e77475e3", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d71092-6d8a-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782057601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782057601, "uuid": "4ab42ce7-382f-4077-907c-0e2666797484", "comment": "Malware payload (CoinMiner)", "value": "bada65a963c478694a6ebf97d80c6890", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782057601, "uuid": "f1e36021-4f7e-40cf-b6a9-72415654283e", "comment": "Malware payload (CoinMiner)", "value": "00e99856b30d2f75a452daf1dc13ed02396d38ff975db1f814668b8ff0b52eac", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782057601, "uuid": "bcbce938-7965-451a-acf4-8f97296466f8", "comment": "Malware payload (CoinMiner)", "value": "82f0775ea36f086c44a6e4e90f0ff034577aa20e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782057601, "uuid": "24b64d08-4ba5-4a2e-b6d4-f6af9d1ee2dd", "comment": "Malware payload (CoinMiner)", "value": "68b759e82a88872165130c29860810c3154653f4d3fa1974dd8ca118d07f79b6deddd3882ce10b04fde09e906aa44e5f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782057601, "uuid": "04f9e949-72a1-48d3-a258-33c3dc745969", "value": "T1F3D3129F290686FEDA26683A863177E8DF10093FD191BF44120BDBF6C4D508AFE47952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782057601, "uuid": "213033f7-0fb3-4ff1-b9c2-9cbc96d7ba54", "value": "3072:enfpWLk2Unh2ywuN0aVXe7x6EsFl/on9ihyddCI7VU:enfpx2QtwuN0AX0b0W9RdtpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782057601, "uuid": "fe1b5625-32f0-470d-835a-15c281acc27f", "value": 138468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782057601, "uuid": "880297fd-efd4-42a6-966c-a5d12f3b440d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782057601, "uuid": "c9b6e091-1764-4a67-985d-2e08a098beb0", "value": "kworkerd-netns-rt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281a69f9-6d1b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782009882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009882, "uuid": "821b0c14-4fdf-4b30-9c96-b467d309d60e", "comment": "Malware payload (Mirai)", "value": "e865467c78cb20321d7bb078f0f2513a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009882, "uuid": "9bd3d659-1329-4a1f-ad4f-9e18fbe8a2f4", "comment": "Malware payload (Mirai)", "value": "01899f61d9aa02184d66632a32a98c47a038dfebdeeb34dfd33c04d4216589ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009882, "uuid": "69dba506-3c1f-4ee9-ba11-d3b4d8b104cd", "comment": "Malware payload (Mirai)", "value": "4b890343939144da0a250e83ecec95053083c6ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009882, "uuid": "21bbe063-40ba-4312-8a70-45592043cb8e", "comment": "Malware payload (Mirai)", "value": "e36921bcc568354e693903ad86e349226b9bb8bc0ab8259e9973e15452a87a63e96460efea665a38b8a90f7bc5a00b16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009882, "uuid": "a3c51fde-2f88-4b16-9fea-3453d42a8e01", "value": "T1B1F30846EC818F16D5D512BAFE1E128E33231B7CE2DEB2029D146B24778AC6F0E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009882, "uuid": "f04d60e5-1ebb-45f3-a5bb-4729d49999bc", "value": "3072:HTcMYmroLmpMguHcUNVUHalw7W6uH0BsfCNPFQp9peXJEaWOx0ecVxXpRxD2N9:HTcMdoLmpMguHcUNVUHalw7W6uH0BsfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782009882, "uuid": "72d0205b-2a34-455a-8f20-5c8cc677d396", "value": 160976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782009882, "uuid": "b29b0b1a-4756-4aca-84bc-cc7cb4925931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009882, "uuid": "4c1eaa16-c653-43f5-8205-63ff78595afc", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae84fb5-6d86-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782055897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055897, "uuid": "1e2bb0f7-a4dd-4c45-a6f2-cf4f94a4ed17", "comment": "Malware payload (CoinMiner)", "value": "6de57935c77fa4eec94afcdf78380be7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055897, "uuid": "ef687bd2-e766-416b-8c4a-ad6a0f5f9bff", "comment": "Malware payload (CoinMiner)", "value": "0343cc89b06f7a6e45cb7d09f0328821c826d63216265d5d0c0a22902af835d1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055897, "uuid": "53b5ebc2-fbe3-4bc7-935b-3d46a88a6211", "comment": "Malware payload (CoinMiner)", "value": "234948b7f836fe90f02fed565f18aafd8eb9d3f1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055897, "uuid": "648094c1-4636-40e4-b4c0-7f78cd099257", "comment": "Malware payload (CoinMiner)", "value": "ab1f1bb96f8f34d75a45491e8e95068cc2ae3f0aa12e1a72c04e6cbb164fb5e709508ca8ef002007a4459a9651e64161", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055897, "uuid": "2d3de761-388d-40ad-b206-97f6ed2685d2", "value": "T128B31222D0592B42E258AB3763722784385DF8D4A9E42F53DF3417DDF28D702A22EF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055897, "uuid": "aa89a707-1363-40bf-a9d9-eb035a45666c", "value": "3072:rde+cNrMUXu3sC47UXIEN3Yn5qrB04HuRh3VDBPJ0kc:rdzcNHu334rq3Y5qNaXPPJ0kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782055897, "uuid": "774bee9d-1e46-4fc2-886a-3eca366895cf", "value": 110360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782055897, "uuid": "65fed165-46cd-44e9-adb5-89dce0d067cc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055897, "uuid": "7698b347-7762-439e-82b4-5f6aa4e25844", "value": "kworkerd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ceb2c5-6d3d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782024743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024743, "uuid": "b6bd99a3-1f97-45b2-b535-05c7f664ec67", "comment": "Malware payload", "value": "95ee6f425a7e185c0372374461450706", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024743, "uuid": "5aa6b5f8-225b-499e-8e57-2c02e36b3542", "comment": "Malware payload", "value": "040b95e8c50d9241d71038cfe3d06876b280243f59694314271c7dd619ce83db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024743, "uuid": "3032dd47-966a-4d91-a67a-9ea236696202", "comment": "Malware payload", "value": "a8bb5d708fd6743001cdfe40283cbb7b53750dd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024743, "uuid": "ea759584-3e3d-4731-bd4d-fc4a46554fdf", "comment": "Malware payload", "value": "5e82b7e3a9633c2489d8c7fe244654f04cc5514b59e8c9b91fefe159d0d346801ef8fcb96a8ac1a22d0cfe6d84ee1f3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024743, "uuid": "3ce8e1b6-101a-41bd-88a9-b912d9bd358e", "value": "T1BD043A86FD809B5BC5D167BDFFAD9389332627B8D2DF7113D8289725378D00A4E2A604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024743, "uuid": "661858f9-5cf2-491b-9ff2-9a2263ba8bc8", "value": "3072:iZYS4d9BuME7xQbRbo5El2pJ0LIq7J+8qpnIvkb02T2imoJaELqC87ZPHpAS/F:iZY/daME7xQbRs5Y2pqLIq7JVqpnIvX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782024743, "uuid": "7c58a3ea-048b-4e6f-9598-a43bac1976a7", "value": 176564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782024743, "uuid": "3dd9e6fc-f047-454a-81ad-c9bfafb86a73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024743, "uuid": "547ef29d-8589-49de-9055-c5d29a5f8259", "value": "binbattle.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b3ee29-6d87-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782056256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782056256, "uuid": "66a3f011-4292-4370-b23f-4b977c54fa3c", "comment": "Malware payload (CoinMiner)", "value": "4f8ef8ab36e030e2d9f18f09cc8a1263", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782056256, "uuid": "f546f83b-0268-4a29-805a-01c28d2e6303", "comment": "Malware payload (CoinMiner)", "value": "05a5138226c9bcda130f95e14b36c083fb4e0a7457a0647f4eba2fa147fd3bf5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782056256, "uuid": "a3b034c5-26b7-4d2f-bdb4-ab986f5c889f", "comment": "Malware payload (CoinMiner)", "value": "97bc1d26e325fae7e62b2c33bbbb26db1384f74b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782056256, "uuid": "f4cb0811-565d-4834-b8b2-448339d2e247", "comment": "Malware payload (CoinMiner)", "value": "38495a5bc8e886589caa26704167dc42c258cc35b0dbe43931d05152f86c67086fdf2695ed8911d3b4af99bdea73f6bc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782056256, "uuid": "71e9909c-d028-484d-91b1-76b024d4ad35", "value": "T19CA312A5E6D95E66E870207EED5940167BDF23BDF839B103290958DCEE327C4732C621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782056256, "uuid": "d0164df4-3cfb-4ee0-a5de-09f90c06236b", "value": "1536:0B7rDL/AOIwCkeUf8wwxSiheJ78HmYA2B6ihD8RG0sZz69Zv2sMwGMI51Oi/iJ4O:0RL/AoeL56JPOspw0QE2fJMDJSL3l69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782056256, "uuid": "aace39e1-daef-4518-93a2-277b10b3aaec", "value": 105272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782056256, "uuid": "d42a3359-705f-4ee3-b8cc-8dee7aed3831", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782056256, "uuid": "70020fb7-e06a-4595-bb47-12e2d1ac62d6", "value": "kworkerd-softirq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ef1b53-6dae-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782073360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073360, "uuid": "aa8f43ad-c452-46f3-b975-7096b65b37b3", "comment": "Malware payload", "value": "b96de001e0a5160f76a237920a0a4a6f", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073360, "uuid": "21d954b0-e82d-454b-bddd-13a3e7e898f8", "comment": "Malware payload", "value": "05d9390632b8587d961e4fb1b6deb836887852c496f110397121b567e98ac3b8", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073360, "uuid": "490588e3-b221-4433-add4-3ab3e5ad36fb", "comment": "Malware payload", "value": "492ab202a5395220894e6e0f3adfd574ad979d70", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073360, "uuid": "f5b517ce-c0f3-45a7-9cf2-18ae54aaed31", "comment": "Malware payload", "value": "2682cd99a165b8a0ce850ed542f8839fbbb9d52763b6dba93a04b022c99c998e6c005cded07f4dec3fa09fbdce9e8501", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073360, "uuid": "b5943373-d185-425b-8edd-5ed73f05890c", "value": "T179614C106AF98A14B573DA099ABFE491583BB6DDEE31CB4C8159C10C07F6A508817F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073360, "uuid": "6bd503ff-1f70-4c5e-995e-5b46ed7c728e", "value": "48:rsw1sAkD1aaPEYHDK37c6YyOvaHr7zXtT4oNQM7ktAGG5FF3F5UbJ0xXm7VA/Z:rsgsZ5ahQG46CGdMoO2zxbdo0RmsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782073360, "uuid": "a76a4a47-3dbc-44b8-b341-ee7f3cfadfe7", "value": 3268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782073360, "uuid": "e30f4ac7-24dc-4a05-ba3b-af4c24a86400", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073360, "uuid": "4a6eb23e-365a-4bd2-be70-dabc6946b9a2", "value": "NgOVP.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0c95c3-6d44-11f1-ae13-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782027604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027604, "uuid": "a20f1a2e-ac02-4d87-a0e2-fcfa211bb0fe", "comment": "Malware payload (NanoCore)", "value": "fe6daf3d6816030d2288947b6c0aa5ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027604, "uuid": "e881a089-760e-4fd1-a363-59cee4e4083c", "comment": "Malware payload (NanoCore)", "value": "063697f8cbaedc2a31af56896c9c2f2ef23c1bc5f8d839aa2c304daf8f809926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027604, "uuid": "c284200f-eae0-4752-8e4e-4681d0abc5a1", "comment": "Malware payload (NanoCore)", "value": "fafb5d550f47c6b808736cda42762d86c8f9a78c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027604, "uuid": "c7fea472-17e1-484b-b468-50f0c7e9f559", "comment": "Malware payload (NanoCore)", "value": "71c82da12b796f62f83b36988af8a3c2c2e498ce6ce1dd9572417a4253672116326285a68cdcdee2e94643f7734f095b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027604, "uuid": "3513a01a-942d-479f-8a96-cc793518b589", "value": "T1F714C0267BA84A2FE2DE85BD612202038379C2E3D8C3F3DE18D455B65F667E546071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027604, "uuid": "ecef785c-397a-4e8b-9e90-535f9ee69ec5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027604, "uuid": "eeefaf13-92c8-4838-9b3f-3fde4a14c5e1", "value": "3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIB3fO32vT/T6BQ1bxjOhdiinvt:wLV6Bta6dtJmakIM5KfO32vTj19B+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782027604, "uuid": "2d826986-f767-4b08-8df1-4481afcfe668", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782027604, "uuid": "9408abf8-1596-496d-b2f4-c6d1b36d446a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027604, "uuid": "860c3a27-4d48-4242-8243-285a5cb71500", "value": "iiwakashi.com.co.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264238bd-6d5c-11f1-ae13-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782037797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782037797, "uuid": "a00c1b31-363c-4bc7-adcf-dcfe0ab34baa", "comment": "Malware payload (ConnectWise)", "value": "30cb9db600cbd4a03defb987066e3956", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782037797, "uuid": "bb28d01f-68eb-4390-a3dd-5055e56ba27f", "comment": "Malware payload (ConnectWise)", "value": "077bfdd22b49adeeb86e80050de6bbf2ca9616279c426e21847f476761cba27d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782037797, "uuid": "9fa12c62-7425-4208-80a3-7e33ada81d2a", "comment": "Malware payload (ConnectWise)", "value": "d7313f4cbbc1ea4dca4954f58052fd671c0e3dfa", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782037797, "uuid": "0aeec708-acb6-49b1-9ea3-80178394cde7", "comment": "Malware payload (ConnectWise)", "value": "f0536da66cc8a53e8b20abe0b11578ece725501ecc3397ba00fed288d85b9f5f5784ad1a3090754ecfd3c42e2681ce9c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782037797, "uuid": "655128f0-61c8-414c-9b5c-02adf5e757b7", "value": "T1C7646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782037797, "uuid": "86c0af71-2935-4854-8d79-fd7eb2a864a1", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782037797, "uuid": "50cb735c-88a4-4ba3-8682-cb32ed5f7fc2", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji95:h1iw7gryNkSV1hy1Z1u2JLu95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782037797, "uuid": "57a06789-e7b8-4299-8db8-eade9e231f7e", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782037797, "uuid": "dc140ce5-d1d1-455f-985d-9a8487d20ac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782037797, "uuid": "1305b02a-6301-4222-813f-6ff64b6fe7cd", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721a4802-6d47-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782028904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782028904, "uuid": "80e6b4f5-d3fc-4bba-8464-e7dc8093751c", "comment": "Malware payload (Mirai)", "value": "66b8723c0723ed90f46cab4a3ebc3876", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782028904, "uuid": "2d14a453-332d-4d25-9f19-8b1abb00b638", "comment": "Malware payload (Mirai)", "value": "09c9ee2bdfc0191610aa9ebf5077582e9feca4c368c817f5afb3f84e6574d5d1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782028904, "uuid": "1a64d77b-be58-4ad1-94aa-e93eba3cf6bf", "comment": "Malware payload (Mirai)", "value": "aacbf833cdeaf7e0b905c62e643b320f1cdb64f8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782028904, "uuid": "8c73afcd-6680-4975-b599-56c96d4cd533", "comment": "Malware payload (Mirai)", "value": "a35107cdb5681a3e546600d2d99951376dae7bc7bcb7d17e56e02587ea925c106c775b67e614dc60fb72f2cf4d1c7d7f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782028904, "uuid": "e0e5074e-8d27-4c25-875d-baffd6560ba2", "value": "T1065123C830EF25756C017D97B11249D4F506F1EB68969F85FC44CEB0C9D6AB6302C798", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782028904, "uuid": "cfa6bed0-98e9-4749-9d87-e9c2878c6e78", "value": "24:Jp8pNI3K3pP2RpKs6p8FNImKuAyRpKW9Wp8Cy0NIakKiS7NXUMuUsRpKPIcdU:FFRpKsoyRpKE4sRpKHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782028904, "uuid": "b37ac094-2287-4139-973d-66ef000db12d", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782028904, "uuid": "fa579689-f79d-4101-bc80-17e51675d9a0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782028904, "uuid": "3cb4264d-687b-4d77-b71b-05178b098e47", "value": "womp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244acd93-6d4e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782031780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782031780, "uuid": "8a040519-7676-4eb2-9a81-8290b0b391a4", "comment": "Malware payload", "value": "01e53dcba958061b4b7368f5e03b10ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782031780, "uuid": "ed884dfe-a479-46c1-a718-6e933f9d27dd", "comment": "Malware payload", "value": "0ac8cf56f1c5544bac181cc00b36a711333a132be36a05c23714f7d1d76108ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782031780, "uuid": "a71b0fa9-cf2e-44e0-af58-9981a7534ebc", "comment": "Malware payload", "value": "2b683bff1ece7e5f10e8b41356c0c546c670444a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782031780, "uuid": "8fa344c0-1f2f-4664-920e-a9922fe86b64", "comment": "Malware payload", "value": "da99505c37eefe4f8da39a96163aa04cda2a78d8e1dfe1bec322adfcd77e4b729bb46b43a14b08f2e759dd2c7ca26163", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782031780, "uuid": "df05f7a5-65a6-4284-9730-a3995bf852ad", "value": "T104E423F14931A657ECE34426B9AE214091F2BBB1EE48F2650121BC79BE24EC6D30F4D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782031780, "uuid": "55fead08-fdf9-4750-8849-0a1f7cdbe4bd", "value": "12288:aejIro9698mOhbGFWoJWdB4QN/42HTp8mFCmGYNDHOTD1lWT1zxIKV6Oh:5IrSo8lbGgoJWdBfZlTp8hz5bWTLIKVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782031780, "uuid": "60b0ea4d-ee8d-4d2d-b4fb-64aec26d8efd", "value": 705120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782031780, "uuid": "478f6af5-d719-420c-b021-c6bd4bd7a6cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782031780, "uuid": "b87029e8-7579-49c0-94ac-18c27b7b0dfa", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca144e3-6d76-11f1-ae13-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782049270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782049270, "uuid": "8998c611-adfa-4966-a39c-85abdd585d5c", "comment": "Malware payload (SilentNet)", "value": "252fe77945fba9b1426dd4ec923dd8eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782049270, "uuid": "a8b03312-e5ca-4230-84eb-8fc5242284e5", "comment": "Malware payload (SilentNet)", "value": "0b3581ab2acd2099ec8d7de4f77608a0e9a1b7b4810009c7eb1cc4007d30d487", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782049270, "uuid": "4d6067a8-1b04-4705-abce-41646adab5ec", "comment": "Malware payload (SilentNet)", "value": "cb599fcb6ada4fc6143e9eccfdeaee1e5911a972", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782049270, "uuid": "3d42d9de-6434-4ab2-9e90-21ea1186ec83", "comment": "Malware payload (SilentNet)", "value": "4188cb0c2cc5229969638cd6bd24a685092e5eaec8665b8296efb123cf288b9b8e31ce64601da85553408f62ef2245bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782049270, "uuid": "da246ca5-29d5-49b7-a01c-c45624674c8b", "value": "T188357C83EBA385D8C156C8B5534FF137F9627C8E4A157196ABC41E633E67B64E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782049270, "uuid": "a875ed07-8c9b-48e8-a76c-c68c3c9c55d5", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782049270, "uuid": "207ed728-b31f-41f9-824f-69bdfeab4e16", "value": "12288:aZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGcvPqItNquB:acb4M06WpoPrwHvP3f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782049270, "uuid": "7e384330-515c-4a1c-9de7-fc448da06014", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782049270, "uuid": "ac502111-98ff-49b4-bf5d-b187a60efc74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782049270, "uuid": "c70b4b60-b5f7-40bb-8b91-c05c59eb7d1a", "value": "Sulur client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c56d3b-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782022044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022044, "uuid": "730824f6-690c-4b51-8d44-60a36259085e", "comment": "Malware payload", "value": "fcd0805772e1e5882c3b50b6c41b7f74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022044, "uuid": "f2932681-b5d5-42a4-8918-17e2bd81ace8", "comment": "Malware payload", "value": "0b404fdf117cd7f7c3e7d6b84a8cb94d84c2443a5ee3894cfe620a6885ab273a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022044, "uuid": "791fa0c1-496c-4684-83d4-f0c911aff5df", "comment": "Malware payload", "value": "37638b1ee3309c467e27a40209808fecab83b83a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022044, "uuid": "97e8fb29-9876-4d47-a700-6945f84f3f77", "comment": "Malware payload", "value": "7eb92c140755d2aa441d15c4a57a8852445c244e112d022f80ce67781ec5fcf357f180b96d491bc45edb5c6afb2ac1f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022044, "uuid": "4012786c-1482-49b7-bb99-c1037a65368b", "value": "T12A66F6176B2CE70FC628313459B1DE842B6A1C9645DB9527B385F309E9F20AC4DAECF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022044, "uuid": "0a9504a4-1f83-4e38-ae65-5bd8e0341fce", "value": "49152:6zhaV7WV2cNmVAYdmT53RTQrLKnpYbmPOGyDZzbOt1wwkrnOQAHHEt5EW:yTKbn21qnOQAnEjEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782022044, "uuid": "7eaa3f9b-84d2-441d-9ef6-efc6c15b5e92", "value": 6946995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782022044, "uuid": "3684851c-bb3b-4337-bf1d-a6f8d7b16ae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022044, "uuid": "198fdcec-c604-4d4f-8e03-516251352d1d", "value": "kswapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f023a5-6d29-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782016189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782016189, "uuid": "c82333d3-5194-40da-84fa-5ba1316c0f79", "comment": "Malware payload (Mirai)", "value": "49ec913ab7acc1e70a5195edbf4e0c89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782016189, "uuid": "86f3d56a-2ba5-49a8-9e1f-d99317d7fba7", "comment": "Malware payload (Mirai)", "value": "0d2be6fbd16d7d776d2918187773cc83ade3a35b7b083cf1a7b8c68581a5a3f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782016189, "uuid": "273c4a08-6fed-40f2-a78a-c8a09f4b7ee7", "comment": "Malware payload (Mirai)", "value": "55bad731639342c0957502ec70a7a624640aa5fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782016189, "uuid": "894dc4d7-37bc-41a6-bd2b-fec397c00ab5", "comment": "Malware payload (Mirai)", "value": "5cf1f0396ed10103f8a92c4e1faf7f8137ec03a1f7e65ef2ff13b3e24d6b0eaaffa3f2cd13e2eb18f9d8bb954db8a316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782016189, "uuid": "1a4721d7-878e-4208-a973-b92077ac6320", "value": "T1D3931949F881AB11D5D622BAFE5E018E33631BBCE3EE72129D105F2177CAA5B0E77501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782016189, "uuid": "5df5aec8-b392-4312-8158-a6c1b34fa945", "value": "1536:K5nQIslRphD0pi/eCTFV2ngIXiP+7Lz1gJ00RMaymH3NI3fNlbpi9z/mIss1Yk05:LxbhDqi/eqF6gT+PzSJ00eaymH3Nsezy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782016189, "uuid": "66bda698-b321-424e-ba7a-b1cfe43210fe", "value": 95576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782016189, "uuid": "9488b094-0fd4-408e-8220-ff96634518c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782016189, "uuid": "e11e496b-450e-46ff-b52a-4c8d9e02c1e4", "value": "lul.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0884d35-6d92-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782061302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061302, "uuid": "8026f8fb-e320-474a-aa92-80f83f4bb618", "comment": "Malware payload", "value": "c5c8639666455fa3cab557294df4e99d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061302, "uuid": "250ae10b-87f5-4f24-bc94-d4ccc56cfc88", "comment": "Malware payload", "value": "0d8f079819f13bf936af085a92067d8a05a496c4a3c740d8efcd4ffe73ce906e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061302, "uuid": "c59ab62f-7625-41d7-b98f-6246ddfbd528", "comment": "Malware payload", "value": "468f40e113524a21f996dc8c1f3ac1a6c4fddac8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061302, "uuid": "14e5c858-1124-4ffa-9ae1-f7698ed90bad", "comment": "Malware payload", "value": "e561af93d9e57aad1a3e0e0aa781b62ea6c7563391ca71ec019d0f179607f364fb98c8b718bb09ec09dc7ba8a47e1f13", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061302, "uuid": "16bb0491-13cb-465f-94dc-97c4637af25c", "value": "T1440175CD5A106E382946ED30FA672041558471C769F1DF5A768E59F53403BC0F15DDA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061302, "uuid": "ee374261-98db-4111-a1bc-c5f81f93ce7d", "value": "12:CAmgLARogLA+gLDgkHgUVxMoO5YR2ZX1QVFhZTGG8j1TeWqZF+O0ZMS1MoO5yH0j:CjW+oW7CbZVKeR8avPNeBgiLGbsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782061302, "uuid": "d76c74d3-20e9-4741-87ab-97f8e5122392", "value": 683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782061302, "uuid": "c7b2f8ab-bf05-4db6-896c-99f66a629fb1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061302, "uuid": "167ff99e-3ce9-4590-85c8-05d0c2af68c0", "value": "oto", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643aec90-6d49-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782029740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029740, "uuid": "b7f7c6a0-97f9-471a-8666-5b1b3a7675ed", "comment": "Malware payload (Mirai)", "value": "3f1f8b6c6f777846fa4c9afe479cdcf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029740, "uuid": "51e20348-eab5-4384-bae7-b28927b6d307", "comment": "Malware payload (Mirai)", "value": "0e722e5561626daf18aa3e633425f181de9fc5d67027d530a8d2219d0e9ca38a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029740, "uuid": "a5305466-fc08-4822-90d2-026c018b4104", "comment": "Malware payload (Mirai)", "value": "800152ae3e51e3ca7e842f31b04d980d3f5190f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029740, "uuid": "0f2239af-e5c4-4119-9446-39e24480c4fb", "comment": "Malware payload (Mirai)", "value": "744165c947b03e2c642c356b37e568da122236d2f1c42e2f4d0c51dd2e7938fe4444ec499218324f64f4173763a21ca6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029740, "uuid": "814d7184-27be-4106-b677-3e6a40a3d48c", "value": "T185D32956B9518B12D5C311BAFB9F914D33132FB8E3EE32029D246F60678B8DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029740, "uuid": "46ba1ead-bbaa-44d8-8965-8e42f5018c4d", "value": "3072:kceqK1zb4OZJuVXdul8/a2qHz/ixFi+C9Zad1WqZ0xy5qMpxBj3:kO0X4OZJuVtk8iixY+CbauqUy5RBj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782029740, "uuid": "7e144d68-dc19-4ad1-afb0-66aafbe04513", "value": 137468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782029740, "uuid": "252e1c41-42ec-4e3b-a0e7-2d90d79cc3eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029740, "uuid": "abe7a0b9-9d85-429e-b18d-a0f0bd25089a", "value": "data_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b18638-6d94-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782061894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061894, "uuid": "19545fdf-cc0b-47c1-a241-1161ccf99b17", "comment": "Malware payload", "value": "03b4fcaeaee25755de2404bd327e8d25", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061894, "uuid": "36e00d24-208d-4fe7-ba24-78dcafe971d4", "comment": "Malware payload", "value": "0fa79cd701aa3e5c634dfd83996ebf656da425bd6c522c3ead59e1a611c26ece", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061894, "uuid": "1a986e7f-dfc9-469c-923a-ad325ecc181c", "comment": "Malware payload", "value": "1a6ed9cf283f929542d428120ffb0f1e37bfce30", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061894, "uuid": "cc7dd00a-47af-43dc-9b08-6c6be6960d8d", "comment": "Malware payload", "value": "8ce39d82440fc9cf1a32d20ef09a61f72c322a40868bebb0e8af9ebbab80a838dfccc686d1dec7fee74c183ac179a057", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061894, "uuid": "34eaceb0-60e4-479a-9eca-32ea59a1ef51", "value": "T118136D6526953C25AE99883B5C7F2F0CBDA983E2304491DDBFCA3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061894, "uuid": "ab2b9ba5-7df5-4675-a18a-ab9909b12ad5", "value": "768:Tr9NyXsZztCf9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:nHusZhco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782061894, "uuid": "5eea8375-1f4f-4e09-b596-dfbe6ef395da", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782061894, "uuid": "ff79dcc6-932d-46ff-984f-74c67606cf24", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061894, "uuid": "8f0bf145-9c13-4183-824a-7726e2695103", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71a65bd-6d24-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782014095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782014095, "uuid": "50896950-c5a3-48bb-98ed-1c6cc6924b3f", "comment": "Malware payload", "value": "35327a0d41b9f2ae23822d4e757fb0c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782014095, "uuid": "7fc5d7c0-a1cb-40bd-9753-f8c69b36cd28", "comment": "Malware payload", "value": "0ffb79f36daa86e4b5ada078827f93024feb24cce891a1dfc6092ceaab990737", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782014095, "uuid": "e4fa40f8-8c40-4b44-ae10-b10acf447045", "comment": "Malware payload", "value": "a323f42407b92713d2ca3e364b54852509faf56b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782014095, "uuid": "79c662ff-c150-4145-930d-0609e18db11a", "comment": "Malware payload", "value": "b00f335239d77d346ce7ce24a38972a9569b0a3951d504f1991ff35ad2a3eb3e5cee7404b4badbab99b88df0c593292f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782014095, "uuid": "c3345a53-53bc-446f-9891-94b50c938ced", "value": "T1BE01AFDA8610A9100059A65E22975590B861C3CF059B0F787FAC0E3EFB98410B166F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782014095, "uuid": "5be142df-e4eb-4a36-8052-1807ea6b0111", "value": "24:kXCKysE2hi0ziQvZohaabJw/bXFvBG3whLTOcFvUC37:e9Qp+MsaS/jFQwhnOcF337", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782014095, "uuid": "c735b1ea-8dff-4ae8-97c5-853e82936e4e", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782014095, "uuid": "3a9227eb-d723-40b0-92ee-fe0fb88d979f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782014095, "uuid": "36ffe767-0d6a-414e-9edd-fff6ebe0a4f5", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a252e2b-6d1c-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782010289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010289, "uuid": "8cf2ede7-31a1-4d53-85a6-5a1b80f2c24e", "comment": "Malware payload (Mirai)", "value": "2f28d327ac834b094725634815ac6313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010289, "uuid": "293ecf8f-6389-49d9-84ec-d5471da628e8", "comment": "Malware payload (Mirai)", "value": "109d22afe56736c01ff93b597be3dbc5bb7086dd2d24efa11d48fef1868c5b52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010289, "uuid": "a3539eca-653e-4bfd-a802-3f35d3de3c46", "comment": "Malware payload (Mirai)", "value": "d66abee6cf6950bdd0142b2e781e3a32549054cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010289, "uuid": "c12fad04-dc2c-47ab-abf0-8e6d4dd4bf58", "comment": "Malware payload (Mirai)", "value": "090372a608182e8c5840d73b04a57f7aad850d0202e5a5533d485fc86baee944a9ec5c162295dd3c57edadf3c201ec43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010289, "uuid": "a28eaff5-b017-4d96-9b2e-e6014a19f2e5", "value": "T1639312E5E270BADB8C3E183EE06F1C31BB9873C33049560C9333A9DCB86189B7859494", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010289, "uuid": "8f097e03-a8ab-486e-b645-5720c4467593", "value": "1536:y7wbAyFqmYOREY917Lwkw46BU/qmPP3SWay+Til9I7BjjPBDy:ymRrYOWC7oxBUCs/Vb+G3mrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782010289, "uuid": "062e7f93-8c08-4859-9927-945731f91a33", "value": 90172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782010289, "uuid": "d12d43dc-c07b-41d6-9d02-05145a5e3883", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010289, "uuid": "9d68970d-6df1-4a26-bcce-dd2d9e41b4e1", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850a97b5-6d69-11f1-ae13-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782043539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043539, "uuid": "e442bfbb-8e02-4e45-aeed-af30e300088f", "comment": "Malware payload (SilentNet)", "value": "b8f5b51ecf230e52c3bd7bf4a30c59f0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043539, "uuid": "c87d709a-6653-4861-9b93-b586922400bd", "comment": "Malware payload (SilentNet)", "value": "10d1620dbbb762a94bea71602b7f6d3a3167bf5f4e1cd7f3ab49aeac74c2a573", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043539, "uuid": "7969f818-0b63-49fa-9cc3-a5506a780a5e", "comment": "Malware payload (SilentNet)", "value": "c08a7d452c22abb14f824d238582b607804d2546", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043539, "uuid": "71e18216-cec9-4054-96d7-db19ab90c14d", "comment": "Malware payload (SilentNet)", "value": "d6529c8aa153f7d768707986e075d2edc23e456df542d337e2d0e0ac40537bd38a3e59f151d13e653fb128ae7d5c135b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043539, "uuid": "03584dfe-6e93-4153-a436-afeffc7f522b", "value": "T153063329BEB84939FCA05969CE44DD3723C068785D22435C2F1A7FC3D48D58A8DF972A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043539, "uuid": "a5a7b064-c8cc-4d45-8cac-80039fff2f64", "value": "98304:C6xnC7pdVku1Idc4Kh3SSOUqy+gIkikgo:wfVkuIWVhSbUqyokizo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782043539, "uuid": "639a915d-9abf-4fe8-ba4f-b678263081f6", "value": 3827807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782043539, "uuid": "dae945c1-6aad-49e5-bda9-ae0bd11d7aa2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043539, "uuid": "7c82d278-631d-4845-a499-b4bda576f49b", "value": "DonutDupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c110423-6d85-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782055416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055416, "uuid": "36c5ee3d-50ef-4fd9-9d54-63e5dc5811b9", "comment": "Malware payload (CoinMiner)", "value": "50d7740df6a12a658b93fce277b3ab85", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055416, "uuid": "452dbf69-3f71-40d3-97dc-765c328d9a24", "comment": "Malware payload (CoinMiner)", "value": "112035d781a0b726569febbff97ded6401462c91b153e31e5bec7386dab34ff0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055416, "uuid": "63266500-3bae-4e53-af55-30352a536453", "comment": "Malware payload (CoinMiner)", "value": "d3386b5d9a18588d733b91bded1e1a50433d687a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055416, "uuid": "de03e966-e69d-4aef-88bc-946d08824f52", "comment": "Malware payload (CoinMiner)", "value": "18724d1dd114f896409e831ce999a398678db8c80a65152940910922441d674ff1467ae9dbacaf2ae2848e87d25fcfea", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055416, "uuid": "58b143b2-2fb2-4a0f-8c40-e36e746d82e2", "value": "T196A312A5E6D95E26E870207EED5940267BDF23BDF879A1032A0958D8EE327C4732C611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055416, "uuid": "d74dc816-29bd-4ff0-a80c-bca58b0b7616", "value": "1536:0B7rDL/AOIwCkeUf8wwxSiheJ78HmYA2B6ihD8RG0sZz69Zv2sMwGMI51Oi/iJ4S:0RL/AoeL56JPOspw0QE2fJMDJSL3l6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782055416, "uuid": "1d31bb5b-c532-4ac1-b564-330d177e2401", "value": 105272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782055416, "uuid": "468bdba1-8ad4-4696-a9c4-b88386f78668", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055416, "uuid": "709db90b-9b9b-4112-b21c-849e5afe3bda", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0dbab6-6db2-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782074746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074746, "uuid": "42137ac3-57b4-449b-9adc-90fa10def2a4", "comment": "Malware payload (Mirai)", "value": "b5199bf6d0966da9f31afa7c12b2e45d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074746, "uuid": "3377327f-9c30-4e5e-9a6a-d96a8f3f841d", "comment": "Malware payload (Mirai)", "value": "13db3cd49df1b6a09fae27045f6a87fa4ccc413732fa37fc6b1955f38ab0167f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074746, "uuid": "d496a09f-d51f-45ab-9ebf-9abf991e2e17", "comment": "Malware payload (Mirai)", "value": "70eb9f68b50ae1afaa8c6a3516595627adbd5f77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074746, "uuid": "e59f4c2d-4a0f-497e-9524-8ed104f89a5f", "comment": "Malware payload (Mirai)", "value": "9feb33be2b3f785e8b40b5212bfdf3b2e0ceeeb520b237f483b874de3b3b8dc75d9f1df17e46d62a292dd23ef5c1b658", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782074746, "uuid": "28e35e9f-217a-416a-86de-4fbe841c2ad3", "value": "T16A23F171665894D9E5F58CF0E978C98124A21C3DD3EFB46815062FACFE7E2952E33205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782074746, "uuid": "4b1dfa2c-3dd2-4d7d-907e-5091c9d8034a", "value": "768:U2TcdhwD6n/CMhjDnkY+1KkUUm9s5Se+0pO2Z2LbqV0YakA1s3UozA:zcdhU66cDkY7Uq9H0pZVrpzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782074746, "uuid": "f017745f-917d-4ed8-a935-6e7db7c6ca23", "value": 45804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782074746, "uuid": "2234908b-e258-4615-b72c-259e343ceb50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782074746, "uuid": "e01e201b-7d86-4866-b40a-d300750504dd", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d31a832-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021944, "uuid": "9f0b1a34-e254-43a8-a484-e82a9c1c8985", "comment": "Malware payload", "value": "2f5a8d3f1e705813cf0f932581b17276", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021944, "uuid": "a79dd23e-8838-413c-b3c3-e88271b7fb2e", "comment": "Malware payload", "value": "17c0f63d8ed6a64144d3a653885b131669836e645ae4d1c7a3f496d845374431", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021944, "uuid": "7301b920-9f50-40f8-ad25-49deb6c3e97b", "comment": "Malware payload", "value": "95f1ccd18dc2eb2417e2d7bca149c2816d6aac01", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021944, "uuid": "cd906108-1eeb-477b-87a6-b7fbf65e612d", "comment": "Malware payload", "value": "6518a3892ae06a331325921b1efc3f59dd48a1ca113e27128f318fb254fdb0a089b2b8980f2651fdcfce9d98cd91f12c", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021944, "uuid": "327b3691-4a8e-489d-a203-d8e2bb40570e", "value": "T1048533FE99674021DCC006FADE2F47F6A94E75C9A9124FAD03AF472CA23CF691851C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021944, "uuid": "dad7209d-d72a-45d8-9a0c-94e32fa75174", "value": "49152:yAAq3xZwKZ/rrOKZ/DOBI/cHtlgNRyCGBSnzs5R:yAAA7r/ZrOBIic+BSzAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021944, "uuid": "71969f49-9be7-420e-816e-61438dc66f06", "value": 1776820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021944, "uuid": "0dc27a19-a881-411d-88a5-d39af25acb9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021944, "uuid": "9ddb30b0-cd66-4512-97f6-f728167b2a1e", "value": "zswap_shrinkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b459ca33-6da5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782069388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069388, "uuid": "5b7e68aa-1e05-449e-b60e-d01b71afbb96", "comment": "Malware payload (Mirai)", "value": "73b4e393fd234c91b29176a1b67d6851", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069388, "uuid": "bdea3469-7dc7-462b-8331-1a043d058a97", "comment": "Malware payload (Mirai)", "value": "18cea76bfb55a67be23b9e006294566965c08ca336f2229bdb0dd114cd676e98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069388, "uuid": "57c97c6c-17d6-46bf-b8c8-d883973fa845", "comment": "Malware payload (Mirai)", "value": "3f35ca790d7f9a80daedc07733ad310c6ef2a67c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069388, "uuid": "19c64f60-7c34-4fd4-9511-390ae3b959fe", "comment": "Malware payload (Mirai)", "value": "faa24b62425eeccb43b695ec12532bc16ff07c8b199009757e867e5dd5f24a0e082b855468acfafcc6ccead20a15062b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069388, "uuid": "8559aaec-0589-48f8-ac37-25a9033fee6e", "value": "T135F38D81F747D5F5E81B45B020A7E7368B72E53A103BEE42CB689D36EC92601D61B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069388, "uuid": "a8b50dd3-398b-465b-9524-e2594d468e61", "value": "3072:sSoChb8YKhXpQTOlkUljnh+Khhhx+laqlhR400XrdsULalxPNjkEW1GxEQh:sSoChb8YKhXpQYRljkKhXx+laqlhexmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782069388, "uuid": "ec699b07-b72c-4f5b-a1dc-31521fc63efb", "value": 160968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782069388, "uuid": "0cc4ba2a-4e82-4e9a-b2a4-4faa8cdbb32f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069388, "uuid": "8e9c1dd9-6af5-4a3e-bb4e-338e1fb738a8", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e6ede8-6d25-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782014113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782014113, "uuid": "768fd771-d9e0-445d-a0ed-5b73ce8a060d", "comment": "Malware payload", "value": "2f97e0ef64426551968869f3a3b766e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782014113, "uuid": "54457361-f9bd-459e-9567-5e5158cd6028", "comment": "Malware payload", "value": "1a465543632340d6cb080c9a06b2187719c208e3de43c70708724d3e189de8f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782014113, "uuid": "4f9f5ba6-4b1f-40d2-b7c7-ae4d778f21f6", "comment": "Malware payload", "value": "975178cb5704b46eef260812373647da70c5bcc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782014113, "uuid": "b7a20ece-4d66-4d77-aba8-c222b5df9ac2", "comment": "Malware payload", "value": "1d164fe0814b20480b3c7626ebbf97641e622db061d9c4045976476d754546c5e396da0afaadfb3a3fc635932ff8649d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782014113, "uuid": "d3166bc7-be1c-4410-9f5b-f100f9fb85fe", "value": "T16EF457037F41E541D16A5E71CD64DBF89320FC48EE56838734E6AE2BBDEA6D25E012C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782014113, "uuid": "62abfc9e-ab49-4a10-bc68-4c8292f3bd46", "value": "4300f2f2a04784e185ac92756cde12c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782014113, "uuid": "72061f6c-e5fd-4325-bcc8-803fe7e9999e", "value": "12288:gzQi4ny4lIW2YThJE5E5SjQyK76zraVa/:gzQimy4lIE3lVn76zmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782014113, "uuid": "8dcc6b3e-ed7b-4cec-80dd-423bd7336637", "value": 771576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782014113, "uuid": "5b4f5bed-59d3-4b7d-a260-3e6c076e6fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782014113, "uuid": "35de8b9a-4421-4a43-86b3-ca6bdfdb1f67", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5893a3-6da6-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782069809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069809, "uuid": "6efa9931-6d3a-4504-93ad-c2950f7cfd5f", "comment": "Malware payload", "value": "2d7271335dea541bd2f265e0fe8ca9aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069809, "uuid": "18272655-3b25-4f30-9fbc-2a1eae6a5bbc", "comment": "Malware payload", "value": "1afe6cc58ebf0bffc4b2492af3bb24217a8ee4216a15a95fd17285c7000dabdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069809, "uuid": "3bbfe763-2e2f-4982-a8ba-722a2876862e", "comment": "Malware payload", "value": "1f776d42890bed6d91751ffc8c80bad16d83dd14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069809, "uuid": "06527242-8d6b-4fba-bee1-914aa6a8d6ab", "comment": "Malware payload", "value": "4f4d595905cd8ce62764dc6fce78c67f0f62422c346c52d76be94f41c50d7a9ae8c6cbc0072ed83baab8c6624b424a84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069809, "uuid": "f7e2ffd4-a2a7-4fb1-b451-b3f3b7a5f16b", "value": "T116D41B1BAF400EFBD82FCD3705A91A5635CCA58733A537353178DE14BA5A90A89E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069809, "uuid": "4308df59-76c3-404f-94ed-3a2f047de11e", "value": "6144:mh0ZAe3AtVrxPeBBnMPNWgamE4i1eRFuBLhnQbIQeDlaJ1YKaGJOn0s2:voruBnMPNWgalbeP8Qbl4lTeUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782069809, "uuid": "3e314e1a-7792-4715-aa48-5c2208629668", "value": 652356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782069809, "uuid": "e202987f-a0a9-42fc-b55c-d0132c30ac39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069809, "uuid": "bc376001-4c71-419b-9926-8ac1883f5deb", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08410f7a-6d1b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782009829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009829, "uuid": "75f88cf6-8308-409b-88fd-32201fb76e01", "comment": "Malware payload (Mirai)", "value": "753e06a8f38815a6571840ffa4216d3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009829, "uuid": "d7b6ad0a-ee29-4336-8a99-35db204e405a", "comment": "Malware payload (Mirai)", "value": "1b8150bf9a932e9d13a16396bb8398d6c5264bc58f5f9150014abe61ba690794", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009829, "uuid": "8404adff-56d8-488c-8a60-6e420f4a1a86", "comment": "Malware payload (Mirai)", "value": "61413b3812958356734c39874ad6fd69735c305d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009829, "uuid": "9d0924d7-9a8d-4fef-9c67-ebf3369e913f", "comment": "Malware payload (Mirai)", "value": "a651e3d7c6f284b242f3a5767c7476256f06fde55074fe9a014ddcee3688e39455ee3e872da124b3d552943be9873a15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009829, "uuid": "bac06c31-102d-4908-9cee-fa2fee15e51f", "value": "T11E731250336F4DA38F27E1F52B0AE04855668EB9DCEC73B53E084999DFD20BE60A5583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009829, "uuid": "902381a4-8d6a-40d4-abc4-e23f123746bb", "value": "1536:jmiKRBodlinlrDVj7OAuTLzJVXT9ZEFNeDEWiiPGwHPwhcjj0CuHPwUy0FTwFKzu:iNRBcUnlvBEHzJVDfEWxXHYh+c4UydK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782009829, "uuid": "36eded59-df88-4a8e-8b07-694dbd2ad331", "value": 79632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782009829, "uuid": "c866f744-ba88-4471-b74d-499ac958f127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009829, "uuid": "4abf9ce8-244b-4ac4-ab75-79aa21ae7727", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a18893-6d20-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782011991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782011991, "uuid": "285d2d98-3b07-4922-a9a4-3ae49c45e159", "comment": "Malware payload (Mirai)", "value": "a2e888b293fc49a5d5daf230474af497", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782011991, "uuid": "36db2a97-4f0a-438d-b212-ef43ce6e9cc6", "comment": "Malware payload (Mirai)", "value": "1ced28877bba453ff0a27548302dbdf2129afb103ab2fcb88fd06ef8c58ccd4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782011991, "uuid": "c5f7394b-3edc-451e-b55e-26a4c329232c", "comment": "Malware payload (Mirai)", "value": "05fd8e777e576de66f5ded87ac4ec0da94c33690", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782011991, "uuid": "64fe4d5e-9a08-484e-b5b9-3f95fb0b40c6", "comment": "Malware payload (Mirai)", "value": "ee1e1c7efe8fec2a5d95a2aa0f4bdcbe89002e0fb4617397c5b3082f1833fb8cb43016a63cb9313999d94fcc123c5548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782011991, "uuid": "df13272e-e26e-4f6e-821a-7e21c7da9f76", "value": "T14A43F17DE1A08DD5CD6E2874B1CE07724188F1D9674F2E8C533A9E4EBA39B2671920E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782011991, "uuid": "a27abc36-4a22-4858-8882-ba85e8996e8b", "value": "768:3WZDtJb/DUTD8BswonkLcMHsIhqB8d1tL/fBHLDVJjBP1UIT9XIIas8h8AI4aX9v:3atJG8BsuHrqi1RpL7BP/T9XY8IaX9xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782011991, "uuid": "dca91da2-17b5-4c12-9c3a-02e7cf2a819b", "value": 57620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782011991, "uuid": "8cc97c17-1b6a-4f57-8b90-1d70baf3e7ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782011991, "uuid": "f2f1f333-7348-4b77-b469-6bda0430b300", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a16dec7-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782022019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022019, "uuid": "61170bb7-ba93-40fc-999b-f5aa967c3e84", "comment": "Malware payload", "value": "e4b791906dcc559f6d6de8a2fa1c7fbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022019, "uuid": "a473d073-1fef-445e-86bc-8eefb4051f47", "comment": "Malware payload", "value": "1f2a0f2d9c2f118cb62fc186e4d41c6da8f4ef4b941b687db3033f9486613d1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022019, "uuid": "7655ef25-cc0f-4c18-8f2e-1c9e8133d7af", "comment": "Malware payload", "value": "c29f7de4bd7f8dee169f7031085dd5f8111685eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022019, "uuid": "d86a9ee2-3f04-4277-bade-462a914c7537", "comment": "Malware payload", "value": "3c1ec7dfebc44da844423c4544b270359b8496bd107aad85259b3dcffec4e1e6d6f20a7afcbb2961a97a6f72f01317c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022019, "uuid": "66bd2505-7d21-43aa-96be-ac884064bc9f", "value": "T10B66F819AC842BFAC02C4B7454EACA5623B05D144AF1467622A5FFEDFC762797F0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022019, "uuid": "e3b19e62-b3a4-444c-89fc-79363d9448ac", "value": "49152:n/sUwBk36QERmjKDYlKxhULkYopALIqtG7Itig5EV:CmjK0lKYPaEFEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782022019, "uuid": "c5a67968-e10c-4666-8919-67be45f8a603", "value": 6946995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782022019, "uuid": "effa7472-0165-4ebe-a727-35cbae8caaa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022019, "uuid": "dedc86fd-5355-44f9-aeb5-17833a2a71f3", "value": "ecryptfsd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa58ba89-6d8b-11f1-ae13-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782058205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782058205, "uuid": "2c540fa8-7ff5-4ec1-91ce-5c5c0a0ebd2b", "comment": "Malware payload (NanoCore)", "value": "ce8dbd9fce3e739bfed8a23a96a92fe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782058205, "uuid": "d327f53e-375f-436f-99dd-797ad667fbab", "comment": "Malware payload (NanoCore)", "value": "2011c98d44911abf78217ecc29dadb6c1dcb28506ac4970a1937eee54ccc31af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782058205, "uuid": "f37dc5da-ee76-4542-8d51-ba462dd035c1", "comment": "Malware payload (NanoCore)", "value": "e68d17c94b4d37b1a9639bbebc542dafec3f9db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782058205, "uuid": "3122ec0e-798c-4364-8d86-27a94524556b", "comment": "Malware payload (NanoCore)", "value": "6846b20fce6b4845760c2b5d6ad791158a23f4c2b6703a476c3b480ff6c6c6cf7aa3d115410f3b50c0d18430161bcd8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782058205, "uuid": "59a8afde-23d9-49f8-86dc-7ad8a6aca646", "value": "T1FC14D0553BA84A2FE2DE85B9702212139379C2E7E8C3F3DE28E451B64F567E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782058205, "uuid": "71bf6733-77eb-463e-bb97-bd623307a4d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782058205, "uuid": "da3c44c0-13cf-4919-bfcf-c7652b27c1e7", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIfRsC6wwBLsjAIZnB/nFgMbszn:sLV6Bta6dtJmakIM5q+LsjAcW/zhIRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782058205, "uuid": "2b91dfc0-154f-4d6e-bbdd-79bcd507b6e3", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782058205, "uuid": "21f7755f-6bd2-43c9-8a0a-20fca91ed084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782058205, "uuid": "477cc0c3-466b-49ae-82f3-734a9223e784", "value": "navent.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52eff94-6d5c-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782038144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038144, "uuid": "f6041eff-a8a7-4f0a-a2a1-27bb666ef046", "comment": "Malware payload (Mirai)", "value": "4f58e5061b5259560c98a7a7cd01ed75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038144, "uuid": "9eb0e459-6fc8-4c1a-8a53-d3092bfd181d", "comment": "Malware payload (Mirai)", "value": "20a09a7cc48b9c5a181f5100b21cd31b3dd974400602c13c45d6bd3e71162a3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038144, "uuid": "6ed50ee8-6474-43dd-a8d9-0396ce1111cf", "comment": "Malware payload (Mirai)", "value": "7488fb3a766ebd8dce022104306ba02f28962a3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038144, "uuid": "9849986c-6807-4a59-b687-444ec99a31e0", "comment": "Malware payload (Mirai)", "value": "fff17bbb8af6da94ae2abe8b4cb5befba66ea6c5984d18de196b916f4d449d6a71bd277c266585a989198703c05ff523", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038144, "uuid": "32998215-583c-4c18-a1ed-d6c06a333ca8", "value": "T10CB43955F8809F61C6D539B6F74D82A873474B79D3EBB2069A144B303BE786B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038144, "uuid": "82f82f13-f99d-4d17-9e85-645c0282501c", "value": "12288:oMuOa50iM6dnJl5axRl5vzZprtYIJaYfie8v8prPxBy:lVa50itn/5ORPvVprG5u7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782038144, "uuid": "2065b711-b389-43e7-95e2-0faa1fc94c36", "value": 518476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782038144, "uuid": "674f7932-06c1-4cb0-a6ed-2207afbec749", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038144, "uuid": "5f307991-a607-4d82-95ca-a1ace9d75adb", "value": "bot.armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c57d43-6d20-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782012269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012269, "uuid": "faa04e09-f22b-4be3-8f14-8d3b926fe33e", "comment": "Malware payload (Mirai)", "value": "11ba73aecd43164a634cf2f2b889e112", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012269, "uuid": "7dfff92c-ebdd-431a-8c68-168d2b8d6708", "comment": "Malware payload (Mirai)", "value": "20cd4bced2749ad5f2dcfa13a970f90b10b6e0fc464ef6fb9270d6cf67f5ae22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012269, "uuid": "276d9fbf-fcdd-4076-a8a4-507859028063", "comment": "Malware payload (Mirai)", "value": "19f1c80afaca62ebb1b3f23108a872ad258cfbcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012269, "uuid": "288b4386-f37f-4b8b-b060-f6631f65cb71", "comment": "Malware payload (Mirai)", "value": "e44a423ab4338bf087e17faafaaa8251e157e8beba23e801cd3a6255db03e6bf8d977a032ad275e5108411650a001a93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012269, "uuid": "74106c11-8ac9-4631-a187-478521915340", "value": "T1BA33F12872EF8476C5FB183CE56F87CA32A763B8D5E87015C94D0664A09F5243AF9781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012269, "uuid": "d240fda2-7254-4f97-8432-48e6c43dc151", "value": "768:ZfAeo4bZ52qY+/8DguYSpvtGcSqW8koPUBfWYwH4Edbos4slAOy2I4Aj7UN9cs3T:ZgY2qKVYSpm3oPgpwYEEuASI4EO9Zzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782012269, "uuid": "b1062ac5-c1b1-40af-9743-159a28208517", "value": 52440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782012269, "uuid": "8e320c3a-33dd-4c28-b4b8-61c0a909b0cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012269, "uuid": "1c6bc1b4-d133-44ef-9eee-c93b3bbc7223", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2cad07-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782022001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022001, "uuid": "d518cdb7-71c3-4a77-9b0a-153a2b80b862", "comment": "Malware payload", "value": "5a90695a18a17e7616343b7066e0164f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022001, "uuid": "9f08ea65-b612-4745-af14-6807a526980b", "comment": "Malware payload", "value": "20e638945f85064b4485a1d5d1b4e7a40bda627b642c1693a118007a1d0b1039", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022001, "uuid": "08e3b851-0f50-44d2-9c93-35931aab7e27", "comment": "Malware payload", "value": "38e4d31ca907d34761ee1913b9b3eee61600fe28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022001, "uuid": "716a489c-3a43-43c0-ba85-dcc6bc219c61", "comment": "Malware payload", "value": "141066c73e6a2a47cbbbe58167d7a58712f7f92f2384f3c81e94e1ed9f9909c3c3400e27223a150e70fd7ce7c08d9e90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022001, "uuid": "136e4f12-eae4-4881-8de1-9d4c677841d3", "value": "T1E1560857B8D24992C4E83637B8BE80C433635EFA9B8652566D05FE383EBE1D90E34714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022001, "uuid": "eb344447-5276-4c83-82e3-6b1a9f5a18fa", "value": "49152:zGGgFlpJSK+EqDntUTySycevW4vpCD4aK2Oa2Cg5EA:it27NIK2Oa2EA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782022001, "uuid": "c4c21a02-b366-42df-8e01-aef72658d75e", "value": 6226068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782022001, "uuid": "06c87abc-c422-488b-bb34-5d2cf1c0e3de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022001, "uuid": "3c7d7abf-eff7-4040-a860-baf550da0c3a", "value": "bioset0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ac01d0-6d1c-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782010286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010286, "uuid": "c7959fae-4ebf-408a-96a8-a4a4eaf3a6d6", "comment": "Malware payload (Mirai)", "value": "2d8f0df1db2d89abadad17b860ac2585", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010286, "uuid": "6f5e35db-b77e-4b48-af1c-863469f40ec2", "comment": "Malware payload (Mirai)", "value": "2256a5fd10730595951cea61b16e6b2dcf88ecf34c9eadff210cebe9503a043c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010286, "uuid": "777c2f30-96cd-4c0c-aff8-be35a6cfea16", "comment": "Malware payload (Mirai)", "value": "77958307eb4e959e233584492df875b2fe8d8edb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010286, "uuid": "c4e4268a-1155-4eee-8876-fe0b59bce0d1", "comment": "Malware payload (Mirai)", "value": "f58d42bea01344770f5ccb42dc5475f027702b2f674a2c9018c3aa9616267b11c119f9474d38d303f247af4852aae252", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010286, "uuid": "54ff007c-98e2-45fe-b270-7d1f11b7fbe9", "value": "T10EF32AC7F800DEFDF44BE7764863080AB530B7A150921B37625B7D6BEC3A1990967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010286, "uuid": "5f4d8533-6584-4a07-8b7c-bb7eb09b5a6e", "value": "3072:WCnyUY9PLBVZCZ0qfzDqStV4jbiZLn2oyy2wnqtn:FyBVZ00mvqSLL8y2Tt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782010286, "uuid": "54197843-ae82-43ac-85ae-3bf188a08792", "value": 165516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782010286, "uuid": "44daedc7-95dc-4b0d-a91a-0d2580b96fcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010286, "uuid": "2c4a276d-69e3-4c54-ad2e-532ccf0e2d29", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762df5d1-6da6-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782069713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069713, "uuid": "7187b7fd-27bd-4de9-a3c5-31eef1404462", "comment": "Malware payload (Mirai)", "value": "fdeba0a384df7ba957b127459244c544", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069713, "uuid": "2b2c30b8-9031-4480-b9b8-3a7ef05de3a3", "comment": "Malware payload (Mirai)", "value": "24911afd5f8561c5e7af01bf8ef9fd3d0b81e40029d748a348c1e5d296264fa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069713, "uuid": "2278f727-8062-4f93-8fbe-a2f74522c106", "comment": "Malware payload (Mirai)", "value": "17078db2a108786bdda3e342e1bd9f91adcb7e3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069713, "uuid": "fe6c4563-e02d-4f37-8db2-0bf2f2429fdf", "comment": "Malware payload (Mirai)", "value": "24e8f8229affb22731f25e9d8179d23587b31e9bb5bab81a3f7eff6ee096bd2c8654b09ea853fef1756d037e0edd1c93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069713, "uuid": "ad6333e6-ea2b-400d-92a1-7a3addb307d5", "value": "T18F33F856F9819B12D5C1027AFF0E124E73131B6CE3EE7312AE246F35678796B0E3A815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069713, "uuid": "c14986f1-dab8-440e-bb8c-058ea56b93f8", "value": "1536:tcnJ3P+z0yGKTa9MQAOCMpiQ6MtCJ0/e58YA:i3PEjTa7h6MtCJ0/eSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782069713, "uuid": "3f96674b-5826-438c-bae0-36ca1abf61bd", "value": 50560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782069713, "uuid": "20344081-9d88-4df1-a2fd-125a91bbd79a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069713, "uuid": "67ed70db-4874-4561-bb78-b25a7fe70b7b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6f6ca4-6d22-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782013197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013197, "uuid": "a147c758-62d1-49f0-b989-c56dc8258a1e", "comment": "Malware payload (Mirai)", "value": "6fa1c52a4ea53757e1eddf679a66afd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013197, "uuid": "53d1fe30-c175-43cb-afc3-2b19cc50c135", "comment": "Malware payload (Mirai)", "value": "26e805a0826a4a4080fd2582d4c5e10aae054a8cd529f64a60ff7951178a6f60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013197, "uuid": "e2068759-e4e3-4b47-8eec-b781cbe0c567", "comment": "Malware payload (Mirai)", "value": "77f37177b39d970b81ed9d010d7132f8843052a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013197, "uuid": "e21d3930-0224-43d8-b7ec-7e7776d341ab", "comment": "Malware payload (Mirai)", "value": "19c07381a0802ae4c97c842fa64b77987ae619a01d7594b199e4a4820192910311177a52dae2f4a32f0ef97004ebea4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013197, "uuid": "29401a8d-4f40-440d-a7ab-34600034b50d", "value": "T10B830236B119D622D21913B99D95C583BEDD0E70607839228B6F85DA3D84F33F2C6B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013197, "uuid": "1b07e843-0b93-4997-a4d8-74beee5e3c3e", "value": "1536:Eebg/MMihnAo6VYKdKMYCp5bInxefG1EsbhArEUESOfDRK0thAHMLrT:EeHJEVhIhcbaTb2EUEBfjhAsLrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782013197, "uuid": "13d1287b-f071-4792-a81b-b96a76c1a44d", "value": 84720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782013197, "uuid": "e7a78461-ccba-40b7-88f5-171d39101756", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013197, "uuid": "2102eeb3-eb57-4d9c-ac4e-f6d4c265081d", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4938b3-6da6-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782069912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069912, "uuid": "2c1aa44e-9014-4616-935e-3cf7f1944b38", "comment": "Malware payload", "value": "e0a7b7c9ab907476236149f5d0258183", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069912, "uuid": "f4b7c3e7-68b0-4318-b45a-a8b7e80122c9", "comment": "Malware payload", "value": "28f58061348a1c54fa6e7ff6618630259618d4afdf78514d5fccfc993797cdff", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069912, "uuid": "a16ea22d-a491-46a3-b58b-4649e0a7dca9", "comment": "Malware payload", "value": "82f0e23207f747295527279c58d4f203cd210b9b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069912, "uuid": "d98d4ff4-a130-4017-8e24-ecb2dda5d7aa", "comment": "Malware payload", "value": "f89e495b0da9c361b9bb81f8579561f1d60fd6636e5a74a2cf74195018e8c0f10a05180feeae0a1524b6f65040873174", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069912, "uuid": "a90080ef-58a4-4e01-ba9c-11f431b59059", "value": "T17BE733429ED965C2ED2AFFE12D3D94D3D89D1DDDA0D20077A082F7BEBD382806096746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069912, "uuid": "f8ef4d2e-1aa9-41f2-92a8-4169af1cf017", "value": "1572864:SGF2Gd33Fi7CA7ZUJ1R09O2SY/ceQ4PPUwlq:S8LnF9jm9JSCx91M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782069912, "uuid": "f7c612bd-4469-4a26-a9ff-341dc49b9bcb", "value": 64965906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782069912, "uuid": "298f8a3e-ab98-4e6f-a2bb-7bee0272fdc4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069912, "uuid": "05ebc673-5614-4e24-8347-c1cc8409a29f", "value": "Besomar_documentation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0690c11b-6daf-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782073392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073392, "uuid": "e689c6ca-efff-4139-8f34-c4894f506d76", "comment": "Malware payload", "value": "6c454fcac4d2d387af52521fa8d39e17", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073392, "uuid": "b20425bd-04d8-4df8-8bf9-6df03bbbe720", "comment": "Malware payload", "value": "28fcf6f84caeadf9245bb039a2057944eb34a47c1d3a88fd2a0eaefc48e9dbfd", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073392, "uuid": "92fb27ea-2501-4840-b772-9840cb4359d9", "comment": "Malware payload", "value": "82437512e039139a1b25f25c0226548521ebfb76", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073392, "uuid": "acbcab0e-a34b-47bd-99c0-3097191114d4", "comment": "Malware payload", "value": "0eae90e8d8e19ca58940906704901ff22373b52a2f3a1050b90059b9f3f6d5786e036b2308316f0261bbfd1235aedabc", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073392, "uuid": "1bc94b24-7df0-46e4-b228-292e584c1650", "value": "T1D5510B106AF94608B5B3AB09D6FEA461583FF91DAE76CB0C0055D14D0BB2A14C967F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073392, "uuid": "2c9de455-451f-400e-b5cc-79f9fc10a4f9", "value": "48:rsw1sAkD1aaPEYHDY9SAOvn7S5r0xX6YyNRX7Swwx6A4WmxZ5dxGE55Oh47C0/V:rsgsZ5ahQbn+5r0R6xx+z4xxZ5dsEHFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782073392, "uuid": "8c56ec71-0a33-4446-a55b-d307567ad61b", "value": 3012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782073392, "uuid": "0abb4845-f3fa-44a2-be4e-a318322ae28b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073392, "uuid": "4d5bbd3d-16ac-4d0a-9a9b-9c27e132176b", "value": "Vy(1).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fc98ad-6d5c-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782038147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038147, "uuid": "81315950-d66c-44a8-8226-fdb3ac62fb9b", "comment": "Malware payload (Mirai)", "value": "515d272a6c45443e42a7568accc4f74c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038147, "uuid": "0a34501d-ae52-4cfe-9d50-1cd4b5984380", "comment": "Malware payload (Mirai)", "value": "2916dbf3063abc63897bc200cff4230287d6f8b72277eb86104c97169f9bdb27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038147, "uuid": "6f92d882-daf6-45eb-9848-8cfa3b3e90b5", "comment": "Malware payload (Mirai)", "value": "b183e91c102180717b597a0032955c8ac60c8ffa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038147, "uuid": "0e30dc32-fef3-4a4d-8887-cdfc87e06ad8", "comment": "Malware payload (Mirai)", "value": "461558003c8566a731eb60e076feca2502ff5175e7e18fc9ad29724ec7614d99a647cde78c396c442135ad2b41ee4973", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038147, "uuid": "59e7e9eb-0812-41d5-8871-7872050bbec2", "value": "T162B43955F8809F61C6D539B6F74D82A873074779D3EBB2069A244B343BE786B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038147, "uuid": "8964b22c-baa3-469d-966d-a499ae67f614", "value": "12288:N75BaPR9AuKWxIE/5ejH1yzNR4stGhUlv3zTZ8prPxDM:hzaPR91Im5EVyb4sFYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782038147, "uuid": "9145d398-bb30-47d5-ba41-b9bb26aec4d2", "value": 522568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782038147, "uuid": "3675b191-64b8-45cf-b218-928fa30c4dfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038147, "uuid": "2b52659c-9758-4a77-a3b1-c1a607a5b5f1", "value": "bot.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1ea83f-6d3f-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782025408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025408, "uuid": "36957fdc-eaa6-4276-9b9a-739e4b015404", "comment": "Malware payload (Mirai)", "value": "9c4933a46a9a19ff105a3eee2289ee7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025408, "uuid": "98e9767d-9884-4adb-b85a-117f06c63551", "comment": "Malware payload (Mirai)", "value": "29bd3863397ab23a61bf44a08f6c936e3592e3792b0755a43b03e73e1a570c12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025408, "uuid": "e98ec9ee-fd47-4a0b-aad2-cf67fb1c90ee", "comment": "Malware payload (Mirai)", "value": "6d27f93d881c10e049f47a03a796a458285508ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025408, "uuid": "c6748598-8b5a-4a70-90a1-249ac594bc94", "comment": "Malware payload (Mirai)", "value": "3a347ba9645ecda54819b5323160f91f4986a42b15fcca75135cac44d990490f55aacb70273781ee8356a2fac051bd4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025408, "uuid": "f9c14531-a04e-436c-9eee-c2002684c36d", "value": "T110C30A427E429B13C5C311F7FBAE42583B136B79D7EA7102ED24AF91278B8DB0E26511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025408, "uuid": "deed1aed-5713-454a-9cc4-c2a34283a3e2", "value": "3072:4hbp9+xZJl1rpydHXHFiUrsrdzvZk/pzQ1ORTF2:dxPl1rMlliUSdzvZupaORTF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782025408, "uuid": "b2587caf-2508-462d-9318-e004f47a46bb", "value": 129620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782025408, "uuid": "e16a32a3-533b-4140-aca1-3e39c2aec9f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025408, "uuid": "d301007a-dc06-4000-8e6f-c7068d1ead46", "value": "data_arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd49ea4-6d45-11f1-ae13-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782028042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782028042, "uuid": "0502caaf-de18-4df4-b2af-6aef32e80fa3", "comment": "Malware payload (ValleyRAT)", "value": "5377b90a65cef26fcfd075a0ee2b9822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782028042, "uuid": "39a56046-c421-4405-8852-d2e9861fc7a5", "comment": "Malware payload (ValleyRAT)", "value": "2a97e8ffb5cfbbccd8e2c812fb6f86769ec014692f9bd598ad446c096630d577", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782028042, "uuid": "672eda2f-4668-4335-a377-4ddccd6220c4", "comment": "Malware payload (ValleyRAT)", "value": "5019d6cfd60cb67191f009f781f772a074b1ce89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782028042, "uuid": "1d3dac49-03e5-42c5-87f7-cf1c6332fae5", "comment": "Malware payload (ValleyRAT)", "value": "6d909149c7ff6b82f3f5fc09fb1a1536c535d56352de59e1d3a5171ad1a97d4c886a0241b4c66b9df319d12b1dc8599f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782028042, "uuid": "6dd0d894-be0f-43e8-8015-5a36a1fbcd4c", "value": "T180948D2AF3A41DF8F82AE178C9565512EA31FC55076096EB33A096252F733D02E3FB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782028042, "uuid": "56051ed9-8a8f-4d80-a04d-b3e28ee55336", "value": "1063679ca25a505b671b8681ecfc841e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782028042, "uuid": "004cd206-64de-4f39-b5eb-57c8e9844a8d", "value": "6144:ihgvqWVHEi02wuz2aXG2lNLuZYpV6wmOjfNoZYX/3PfcKrKywXJhm:i2S2HlwKXG2PaoQLOJHdGyqJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782028042, "uuid": "eb1b81a0-8ad3-422d-8796-7a7ffde10938", "value": 420768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782028042, "uuid": "8872917c-ffb7-4a2f-9250-12f360e1495c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782028042, "uuid": "78044bc1-1507-4251-a9f4-2880421cc91a", "value": "updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d528e2d3-6d53-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782034225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034225, "uuid": "57b153da-caf9-46a4-85e4-e81e0e6e15f7", "comment": "Malware payload", "value": "f54e580afa0ec72958494f3fc65c87be", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034225, "uuid": "a82e20fa-c3f4-4eab-9ed3-be86139d753c", "comment": "Malware payload", "value": "2b33df7907355444e551355ad0c4aa6f789cf1e3755f43295c4bbf2de02f7eed", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034225, "uuid": "982ae312-f97f-40c5-9c21-638976e329da", "comment": "Malware payload", "value": "5e9de6bd6fbd50cdc7b8b4ce0b8979dc5301f14d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034225, "uuid": "536904e0-2715-4971-bc4e-a71e6f43470d", "comment": "Malware payload", "value": "814515c3c6f78028f5b1b8bd78550301f45a6eaed94f5d4d6a312ebf2183248a32533bb215b3a4b97ce1f706f807694a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034225, "uuid": "b597a694-a7a5-4a15-ba0f-aaebd3780929", "value": "T1AEF73330B13579D9EA2FA37FA0A91FC5807074E0B31BD56F63787FB59A9124660B2843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034225, "uuid": "c7d25bb6-b695-48fb-aa80-0c74e485263e", "value": "1572864:LFELanPaFZBMczNsgRoJFTJQCQ5oFXY02NEbffoOd1cCnaPGwLzqoTQ:LnaF0cgdQ7mXYcbfoO5noGmXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782034225, "uuid": "b463c3eb-d7a2-412c-8c25-72ffa896541a", "value": 72047616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782034225, "uuid": "f3fc58eb-9b6a-4b86-8e23-4d8339b85c2d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034225, "uuid": "dfbbe11b-0245-41ad-aa3c-0fc439155c7e", "value": "LetsVPN.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603020dc-6d55-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782034887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034887, "uuid": "de230fb0-1dda-4282-b626-4ba41015bcc7", "comment": "Malware payload (RemcosRAT)", "value": "645b21ae90237079c4ff8d1c93442071", "object_relation": "md5", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034887, "uuid": "e9324766-3c1b-4363-974a-be49bcd5e760", "comment": "Malware payload (RemcosRAT)", "value": "2b48b4d74ec2b1cfbd9e732c2b4d1c58c82882007ab5624c74b15657feb9641d", "object_relation": "sha256", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034887, "uuid": "bdc7231b-90ef-42bd-b749-19512d1c952e", "comment": "Malware payload (RemcosRAT)", "value": "82569fcb91410f416ce12b966b91519d5ea89608", "object_relation": "sha1", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034887, "uuid": "1248e036-c591-4811-8314-060deb34a0b6", "comment": "Malware payload (RemcosRAT)", "value": "69685789093aef0c0d0756e967183ee4382785796f6640cb7b20e07d434ca755936088ee09cba554a942218b37494958", "object_relation": "sha3-384", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034887, "uuid": "60546640-d9e5-4868-9203-0215c4defeda", "value": "T14523D97DC7C195AE994FA7500E6E27C5332C63F542A96618FCDD81339EFD52B2316014", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034887, "uuid": "f8342b39-ee15-4d4f-837c-4ea4f8f755d5", "value": "192:X+lyG58UMd+8+ccQPd21282w2Q2+m242b2ff+2u2bGBf+SD7igrMxs3+++lF:XNqHs7PvW3af9Fbw17imMCvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782034887, "uuid": "855aab9c-b4b7-4157-98cc-a48cd09efb83", "value": 48509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782034887, "uuid": "2b4b9d76-7d8d-451b-93e1-8e1e874cd845", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034887, "uuid": "2c7cd692-01e3-47ee-b7c2-76468d5feca8", "value": "sweetnessgivenmebestthingsforever.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244f7b6b-6d1c-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782010306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010306, "uuid": "983991b8-65b3-4d36-816f-0f6e6ecdd4d7", "comment": "Malware payload (Mirai)", "value": "8b1d24ee85494ba4ef32fb5bc2daaa7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010306, "uuid": "161a47f7-7e83-44c4-b902-4487e6d83ec2", "comment": "Malware payload (Mirai)", "value": "2bd112418c7fdbe2d2170c65ecbc2c82c4c3754be32ff2361c79df0c21a6f057", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010306, "uuid": "faf293fa-d92f-4f2c-a72b-5ce6df728f4f", "comment": "Malware payload (Mirai)", "value": "2924a5db521df40a73557dc7ae14ebc631bca375", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010306, "uuid": "200095b5-f5c1-475b-a1f2-a529a83c0648", "comment": "Malware payload (Mirai)", "value": "3132f40dd6d888902fccd666d96dc5142f9eb8c0fcd7a77b10deb28e7190bb7d724a2ef1470b096669671a08e316cc43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010306, "uuid": "fc35b528-c94f-4556-ac4b-a8b87963b878", "value": "T11354080AAB611FFBE8AFCD3742E90B0525CC545722A83F397974D918F54A68B06D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010306, "uuid": "1ed7dd66-5dbc-4774-b5a2-327d38b0298e", "value": "3072:CBpAxppMsyfY1SGqVXkN4NahsedCnYnjY8qR9v9XKNMZ1XvOl/TUAyh:9xXeMSFVC4Nahan8MNDIYlvOlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782010306, "uuid": "4e0c4404-787d-4122-9f43-0c3ace366bda", "value": 281876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782010306, "uuid": "2076126f-2fa6-4dc5-b62f-135fda2d407a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010306, "uuid": "9b817964-0801-45e9-930b-051f8c6ba4b9", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3439dda4-6d1a-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782009473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009473, "uuid": "5a2ab88e-c3e5-4fcb-87b3-3ac39905f52b", "comment": "Malware payload (Mirai)", "value": "0103306716f2f0d6d086aec288161902", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009473, "uuid": "b36099cb-7743-4fab-8309-416bfa9d8c86", "comment": "Malware payload (Mirai)", "value": "2d2e31e8e8d537cc5fd296e73d3223e6109ef51e1830907eb44261f452a776a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009473, "uuid": "269fc11a-fb12-44a8-b26a-302da0a38935", "comment": "Malware payload (Mirai)", "value": "58e93d13a14ce3630554ad08ae9f754bebbf74c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009473, "uuid": "b028c2e6-c70a-4f86-8d41-bc327f5a62d5", "comment": "Malware payload (Mirai)", "value": "3fe80b34c2b62dad90ca7ebf11a276505e87f2c77a96d27828b9ce70348be635c5ff6c3fe13595cb25d760613495bc4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009473, "uuid": "887cf372-bae4-41ea-9729-f41c6f062791", "value": "T19A730250E02D12634B77F8B3B5D384206BE20D5E2AFC9DE55643D329633D8C688199FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009473, "uuid": "839835f2-c7a4-4c5d-bd12-0cdf444a8af7", "value": "1536:qakK3Vv8g7lbUNBjzT5hvHGCLEISx+bTI1fvOXgM/xspo04u+qgw09+:WGVY3T/uCLnTINWXgOi54u+qgwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782009473, "uuid": "3285dbd8-0bcd-435c-b1d5-0ce94aac77f7", "value": 79936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782009473, "uuid": "be369ffe-7e06-47b8-83f1-a349281852d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009473, "uuid": "363570be-3b43-48d9-8158-9a77ae655cea", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8512444-6d55-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782035035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035035, "uuid": "51c25e4f-2491-4bc0-be88-b976beccf336", "comment": "Malware payload (RemcosRAT)", "value": "e2f8bcbe8815b33869f87f1e99ab6f70", "object_relation": "md5", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035035, "uuid": "a1c92180-2a9b-4db3-bf8d-5962aebb4447", "comment": "Malware payload (RemcosRAT)", "value": "2dcdb89527b240984a85645a4a41e4fed7ed33891fd91da07e1f8b62180f2c33", "object_relation": "sha256", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035035, "uuid": "bf7a6a88-d691-4d9a-ac1c-5594116edaf1", "comment": "Malware payload (RemcosRAT)", "value": "39367cdbe465ccb091c30a9142d624a343f632ac", "object_relation": "sha1", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035035, "uuid": "acaf97eb-c539-46bd-9e3d-96cc8d8240f1", "comment": "Malware payload (RemcosRAT)", "value": "683ac464c18cf0b2de2071506fe52b4bdb399ba80ade304101628106569946380fc93590c0649d070f8de1fc2c622bb1", "object_relation": "sha3-384", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782035035, "uuid": "1abeec2f-b93e-4c58-86f2-7e032d295c7d", "value": "T1E9B4AF02BAD1C0B2D57514300D36F776EAB9BC202D354A7B73D51E5BFD31180BA2AAB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782035035, "uuid": "16574cf7-022a-4a27-971f-c5c4ef8cadbd", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782035035, "uuid": "5677fcfd-ce88-4a91-83e5-647c2a95d5b5", "value": "6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcN95Gvr:8X7tPMK8ctGe4Dzl4h2QnuPs/ZDAcvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782035035, "uuid": "7dc7eef8-eb67-4eb5-b3bc-444d0b3dd932", "value": 520897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782035035, "uuid": "faad0c2e-2799-4aca-922f-5cf96f907528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782035035, "uuid": "d1399230-f0b5-45c3-ae20-bf879b0eb321", "value": "2dcdb89527b240984a85645a4a41e4fed7ed33891fd91da07e1f8b62180f2c33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ec2c96-6d3d-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782024831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024831, "uuid": "84b12978-6416-49ef-a6bf-3a5179133753", "comment": "Malware payload (Mirai)", "value": "5d7ed19d1c8d833d442ec2879824139b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024831, "uuid": "90977e60-3636-42ef-b789-08267aad5320", "comment": "Malware payload (Mirai)", "value": "2e543376be7567e3b07b7d102773c33be9baa2c4cd214f441eee09403315a89f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024831, "uuid": "e3b48796-0a1c-4393-b61c-d0adf79c24b4", "comment": "Malware payload (Mirai)", "value": "8737c1a6085734de56e5fa97ecbd31e66562e941", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024831, "uuid": "b3cdf24b-6183-4e43-914b-37e447be5e95", "comment": "Malware payload (Mirai)", "value": "d5c3e361d0dec11a162bccead8c0012e72e012e392e12793953ceabc7fb60f8b69313fceb4489fcb6d468cf62e2cd114", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024831, "uuid": "ed5a7f2d-292b-4786-a4e8-3a4995bd94af", "value": "T1D1F3864A6F228F7EF269877447B38E31975877E616E1C680E1ACD5041E602CE641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024831, "uuid": "7956a691-fb43-490e-ae86-ca551904e5d0", "value": "3072:3oxwGha7c1fjc60PxwdvgPHicIMO/LrxNdPo6P:YxwGhG6fj70mpgvTa/5TPo6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782024831, "uuid": "195a7a89-2e3c-4ed3-8838-047bca35e22d", "value": 170348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782024831, "uuid": "3eef3448-a316-4670-8a1e-36b26e33ff25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024831, "uuid": "60e6bcac-9cf1-4994-8805-0306e3a1c8c0", "value": "data_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8452df25-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782022063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022063, "uuid": "36cc42fd-32d0-44fa-bf4c-44dfa8980b99", "comment": "Malware payload", "value": "ccd368df782dee423e2645ab79c4f2c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022063, "uuid": "1f4480c4-29fe-421e-89e3-be55089c5fc1", "comment": "Malware payload", "value": "300daf4c9bf0c372d8b30e1400367d655f0dd49ee1b0804d9e49b5663cb8b614", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022063, "uuid": "a6307670-43fa-4d24-9690-e524fd0ddc37", "comment": "Malware payload", "value": "1bd8224cec228be7a28ce9d9856b9dd272ca759d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022063, "uuid": "6efcbf46-2099-4504-a506-639ab0e0f5d9", "comment": "Malware payload", "value": "a09dff64062ef953935ebe358e0c612d6b5217bee0f8ed1b6c5dda76d032d69e261bdf2618f7788ca506754ec7f1c233", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022063, "uuid": "8a08412e-5082-49ba-abc7-f98475f7cbb3", "value": "T178563A42FA082F95C924893389B34EA127626D587B318752E754F37FACF63060F56F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022063, "uuid": "aa76f4ba-3249-413c-a074-c16baf6e6c86", "value": "49152:X92YsCPammEh/+7gh0mI31CsbjmPWMs34RySnHE335E1:t2YsCPaPEhW7ghtgyEDE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782022063, "uuid": "66e7a748-f34a-4a5c-999a-db5be93dde8f", "value": 6094996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782022063, "uuid": "266ac17f-1947-4775-97d2-1796ad4784de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022063, "uuid": "696ab260-86f0-4f14-bb48-54245688947c", "value": "zswap_shrinkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4580cd-6d3e-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782025007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025007, "uuid": "bd7e031d-306e-4125-b569-8ab5bda08806", "comment": "Malware payload (Mirai)", "value": "e94e5361bf9a60b94f29881542e92f21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025007, "uuid": "7b1c44eb-dfac-4f28-a234-51219c69a041", "comment": "Malware payload (Mirai)", "value": "30d9bce0922cdaa9643ee18da9a1cb651d5b0dc5caa0ce0cb0a5141f7bb882ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025007, "uuid": "f1a0be11-cc31-49c5-a3fe-15bd30afac8a", "comment": "Malware payload (Mirai)", "value": "121cd9d9ca07e8740350e73fc9f50af359e08f52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025007, "uuid": "b1a0df6e-7a63-4ba1-8e75-05fdf05b0d8e", "comment": "Malware payload (Mirai)", "value": "1dcec6323c38611478eb31bc94da7af8387fff74f59b6acb80d0e3da7b41fda5175364f746da22a4df1c7899760bb43c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025007, "uuid": "53c61179-0e71-443a-9207-58b92ba11e21", "value": "T106C30952BD418B17C5C321F7BBAE46583B136BBDD7EA3102ED247FA0274B89B0E26511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025007, "uuid": "88c7b00c-8451-41f1-8565-7a9dbc436c41", "value": "3072:kdPsnQs0sEjYJVbrlr4zeYPD9p12+xAm3q2:fQs0stJFt4zeYL9v2+f3q2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782025007, "uuid": "eaf5b718-d47e-4ab8-aa71-c85c9eb1d1e8", "value": 124996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782025007, "uuid": "68edd787-a50f-4f75-a9b4-0561ce3d5305", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025007, "uuid": "050439e3-3663-412c-a534-6a3fc12fdc0e", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384332b2-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021935, "uuid": "2c57d1fa-0595-4657-ba85-685418c867ce", "comment": "Malware payload", "value": "15e2bc3b747e235e66c025ad589ba811", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021935, "uuid": "8c1568db-4db1-4278-964b-b7cf9b0c12e1", "comment": "Malware payload", "value": "310dc73da1f9f347ace94a01fe405b74d8f176c0a18c7592b86fac9bfd22a967", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021935, "uuid": "8b7e861b-16e4-4e16-93ec-f89ac18de259", "comment": "Malware payload", "value": "3214817531b08f142128dec101f31d4bf38e9b89", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021935, "uuid": "6620b81e-f887-4495-a4be-ed519136404a", "comment": "Malware payload", "value": "e9ace61bb3ed13b751cde7b68b0672d162a708cd8b6215efeb7368a1967aa28f235b29df621219004232b065242dac03", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021935, "uuid": "ada9f26f-1b5d-4072-a48b-f94a0a4eebf0", "value": "T1D4566C0EFD24CFA5C6A003B649F912981331AD026FC74B03A239F77CBDB6694DE46695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021935, "uuid": "161b8579-2ae8-453e-9e00-5644738b3f05", "value": "49152:LIT5jZwCJmpBTce0uJmp3YYupigw+8p15zKxg5E4:4jdmpBTcicpE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021935, "uuid": "fec8d609-a86a-43aa-a713-ce924cb386f0", "value": 5963924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021935, "uuid": "2307ff4b-7781-4fbd-8219-ff361aef5afb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021935, "uuid": "a3119a2f-d621-4726-a576-5b0c8e8035e9", "value": "cfg80211d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611c4b17-6d90-11f1-ae13-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782060229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782060229, "uuid": "063c0784-4b34-4f3a-9f8e-0ed166feb317", "comment": "Malware payload (ValleyRAT)", "value": "6e13273ab36bfa0fdbc20698b712d9f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782060229, "uuid": "3ca12efe-6c83-447f-b4ee-690834fddf41", "comment": "Malware payload (ValleyRAT)", "value": "326bdadb9da3f7087d717412fb407f89fa2faf0df6d0b56307bc56b3ad8a9cf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782060229, "uuid": "895866bc-8fa6-4e92-9b0b-c7936f5ef2c2", "comment": "Malware payload (ValleyRAT)", "value": "b066e16df7578f499c173cfead42ce6e54f2b3a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782060229, "uuid": "1831afaf-dadf-4697-b5e1-e2871bfb3696", "comment": "Malware payload (ValleyRAT)", "value": "fd501ca683da31388b3781ec992a82c53badf68f5e05e89b4ff144cc3e92080ad659023cda4b596bd50bd7abe7dbcd69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782060229, "uuid": "72e30931-a8fe-468c-a243-2915d7f5aa73", "value": "T110F7C502B643DD9AF4664275885B0FA0A361ECB4977083A722A8761C7FFE7CC6EF1514", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782060229, "uuid": "0b397b66-b6ca-4228-86b1-82d11c25e7cf", "value": "380560563ebacca1589d8d38ac610187", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782060229, "uuid": "3857110c-e508-4c5c-8d96-93979d9c9cfd", "value": "98304:iuX9nmn1jJ6I/EoPZQi7kmeHh2yeH7rkfvVsJnndxMcGNUXhngr/GALvixMpfrfl:DNnmnbcoRQi7ZkfvVsZdW+RC+AzmMpKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782060229, "uuid": "a028692b-54a1-471e-9d9f-b7f4c9f997b6", "value": 73518592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782060229, "uuid": "170393f9-2827-43b6-9c30-f38e36061190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782060229, "uuid": "127cd8d8-9c15-44d4-b12e-8ecbcf924def", "value": "a-software85650005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd496c1c-6d10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782005462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005462, "uuid": "58812325-1d6b-403c-8385-bbd9bbd18a9e", "comment": "Malware payload", "value": "0436a94052424b19c3b8aebb3b23a134", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005462, "uuid": "fe4bc877-eaad-4f5c-a58f-927ae655bbda", "comment": "Malware payload", "value": "3380dce437bb40ca1df6e649af161beb8cf89a81c8a715b6b1706008fb38b328", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005462, "uuid": "816aaa15-f479-4046-932a-60572f5ad8c1", "comment": "Malware payload", "value": "d49a41a77a0d8cd0dcc601ccafcec1ff89d1c8d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005462, "uuid": "77691012-355d-461a-98cc-0295ec4816f8", "comment": "Malware payload", "value": "933e5d7622cbcfcdb2d6cd17184100a9e7d191d940f7354acf3a87efbe8aca8c2a76ef61230518a0ae6dc50026bd444b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005462, "uuid": "c8ec1d46-1487-4db0-93cf-c7a6912a49e4", "value": "T1BC24E45B6CA550E4D0EEE079C627F213BDB27458073837E72EA05A610F27EE1A4F8B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005462, "uuid": "b6753d52-f237-412c-9b49-389130c4669d", "value": "3072:FxeuFzOPWO/E48DZpyxZIsCLl1Z9xhqmFKYZFNezBAVIaoN:FqW48KxWLlrnUBgIaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782005462, "uuid": "79f6a97a-384e-40dd-8e2b-b20153f6d884", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782005462, "uuid": "ac1d9686-fea3-485d-be15-9f30127d4187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005462, "uuid": "0ccb2c67-f924-433f-b0ec-10f557b894f1", "value": "3380dce437bb40ca1df6e649af161beb8cf89a81c8a715b6b1706008fb38b328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0697f3d9-6d54-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782034308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034308, "uuid": "9373b7d7-8e6e-4398-bc78-0b55e705a4bc", "comment": "Malware payload", "value": "127d91b5a6b945bf7f4111745d786e1a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034308, "uuid": "d9158608-469b-40d1-8cbb-80b80364e801", "comment": "Malware payload", "value": "33b554e0ba3a5c402fe0442d2f98e72d18f5cb9e2c4ead4bfa6d1a0fe9bfb482", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034308, "uuid": "b891e66d-c846-4152-8a46-7578d2d07d93", "comment": "Malware payload", "value": "74c798eece8ac8486b418db8b57f265fa47236ed", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034308, "uuid": "0e51f36c-ab25-4c99-a043-fa33b6ae741c", "comment": "Malware payload", "value": "15579dedf0a199b913cfe2716f891d09c2b9da84fae0a1d15e19cacbe900dfb4ffe4a747b030b53522284818c2c17b16", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034308, "uuid": "786a1e7d-d569-44e9-8312-39fd483c5f46", "value": "T1593184CA72A309F12DE4ED6B367A884531D1F5CB91D7EFA82CEC34E9419DE44B440A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034308, "uuid": "b23ad684-3fed-4e0a-9e9e-bce29e6f38e2", "value": "48:vtgtEtc4ktcbtm9t4tEt0tSJtct0t3WLtOJtVh:vm6y4kabeu66uq6MLinh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782034308, "uuid": "c617cd16-171c-4fbc-97af-8801286797c4", "value": 1730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782034308, "uuid": "54cc0b82-4802-481e-9b62-8dd3e8963f80", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034308, "uuid": "f2d6defa-0f81-4d65-ae5a-ba01bb0bdbc7", "value": "Ciabins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbe39f3-6d1a-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782009513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009513, "uuid": "1ef8c044-64d5-45be-a634-44ae2ab69a07", "comment": "Malware payload (Mirai)", "value": "166774901d19c12bdbe6c2ab5d267005", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009513, "uuid": "f04faeea-3abc-405c-8959-7f398d0bf166", "comment": "Malware payload (Mirai)", "value": "3499f9afda47babc41635d029658cdae507b6d71691353e4050f7b2434c0fbbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009513, "uuid": "5133fc16-b374-43cb-aa43-512911dcb1be", "comment": "Malware payload (Mirai)", "value": "4917c4087ce3f0b1775b944b71c673af2c244551", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009513, "uuid": "6b9d3a0d-29a8-4ee4-aa49-0b30786d8b3a", "comment": "Malware payload (Mirai)", "value": "b9da07e5fa8a93aa791598c68a6500e541cceaf7050365a1e4dd91b350f4a95e352b4bcc3eb085d418cbf4bd8055c3c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009513, "uuid": "055e8c5b-a891-4163-9229-9e69e1d5796a", "value": "T14A244B02731C0947D1632DF02A3F27E193EF9AA124F4F645755FAB8A9272E361485ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009513, "uuid": "6d7ef7e9-8ee3-4524-a4db-6cf5b4f98e5a", "value": "3072:b3jCnI3LOc+5HGdRMf7f2gAWXoj2XLrZYf1yHBDx1Npryi7ezTi+5k:krjFXv69yhDx1NpryYev5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782009513, "uuid": "c05b10dc-85f1-4e4a-a254-9d7f33bc0209", "value": 212240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782009513, "uuid": "7b2708c4-8338-4527-98f7-3e278fb6fd8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009513, "uuid": "957f5d5e-55ac-46b3-af60-83fd5ac6e069", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2381afd2-6d4e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782031779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782031779, "uuid": "c355d63a-ca88-40c9-b2ce-bb2f2651d93a", "comment": "Malware payload", "value": "fdd1d37f1b6cc05cf665577aa6df3f46", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782031779, "uuid": "cd17e559-180e-4f9b-a690-39a3f92c7618", "comment": "Malware payload", "value": "35e66da427a1ad60fd9de1d0efc5ae98275cea581d21e2aebca59491b936caec", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782031779, "uuid": "8ae10d06-d864-49ad-b7db-3be77add7b8d", "comment": "Malware payload", "value": "13e0e3aabbbfa542c75a0a468474a7585b850207", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782031779, "uuid": "15431b34-4e98-4c7e-9ed9-d19b6d26240e", "comment": "Malware payload", "value": "54755efe57a8bf627a8b8e9d7ce28bb8ec0eae14038a2be3600fc20986fc1f600affdf53c178259a6201b58d0fe29877", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782031779, "uuid": "a7590772-9dc3-449d-9f1d-997f361393e0", "value": "T19D0148D686417D105059DA9972979290B812D3CE094F0FB87FDC5E3DFB88D14B066E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782031779, "uuid": "52e629b2-79ae-4eb6-bceb-f025f2f8849d", "value": "24:kXCKysE2hi0ziQvZohaFvftirT/epviIvz0O7:e9Qp+MsFvfITIBYO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782031779, "uuid": "f8492cc1-681e-4168-80fd-792c244141fe", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782031779, "uuid": "64eafe6d-c75d-4555-8d8f-a2b993a89be5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782031779, "uuid": "0a798dcb-3116-4778-9460-9b0790a2afda", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64bd2be-6dae-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782073338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073338, "uuid": "5c454637-41de-4d6f-80dc-d330121c1109", "comment": "Malware payload", "value": "288e28ea13225c33394aee9d2d8e4c02", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073338, "uuid": "a0a163e4-7ff2-4d65-a5c1-e2fe254f7b25", "comment": "Malware payload", "value": "363051592819af125a1b2b5e7b286d7e782267f41e4699db78c91fac2c0b26ee", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073338, "uuid": "af56d770-2dc2-4cd6-b03b-d95a81a37710", "comment": "Malware payload", "value": "ead8f8d3fdf1f35cba0672755a7c8a02c27378be", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073338, "uuid": "f6cf8d78-56fc-4f97-9115-85af3d43b202", "comment": "Malware payload", "value": "0d728c9fd39e55ff15d7fadee79719e2574b12430b46ada67ccbea6b277c627784aa6e755c29c71be571b544baa568b5", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073338, "uuid": "6dc55eab-7da3-4f6e-962c-656d455f26e7", "value": "T163219210AAFC8E157673DA0587BAE09059767ADCDD35C70CC354C10C06AE9449C56F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073338, "uuid": "f72908e1-2f4a-45ec-ac4c-8e67235ac3cb", "value": "24:Qlv4o4Kzyu52U/tMlBygklBRlB0P8wPMuZJBlBMwA6PFv+F5TqJMJ:A4oPtM7ktApDPwF5TbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782073338, "uuid": "d365fb63-5699-4f47-a145-57735f108e76", "value": 1306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782073338, "uuid": "b5627823-b168-4937-ae9a-7d257bb2c82b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073338, "uuid": "e3b1af82-ca28-40a4-9077-de4a9945e973", "value": "Lwoqo.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad1c9e0-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021940, "uuid": "c6b0af86-eb9d-4a50-ab80-027e2fc3897c", "comment": "Malware payload", "value": "21e112b4467c901c947219d45e354b83", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021940, "uuid": "bfb6a747-d826-41b2-aa9c-e1ca16cd3f69", "comment": "Malware payload", "value": "3750548bd67edfd12d1c07c905e35b00b06c2c0a5e193c6988f91ad92ef56146", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021940, "uuid": "2ad6996f-b1fd-4d02-b619-f9b0750a5d5a", "comment": "Malware payload", "value": "885156a410a96b50682924418dcce3ce93164c08", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021940, "uuid": "2bd8aa0a-95b2-4098-8977-2695f79b73cd", "comment": "Malware payload", "value": "2b0773c4c0fc9c68ab1b9f173340d384a9e72ec228d58d00676b29139bdcd7f8ec0abed053986ddfdb62a5bac65bde80", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021940, "uuid": "e55c81e1-f99d-4385-a80e-2b26cfbe1105", "value": "T1829533DACD6C0A3CCAA8EB89BF75F4121704637675427B23ACB9E96C2337A057C05395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021940, "uuid": "a695c67f-5e4a-4b10-a396-06187d5912dd", "value": "49152:nvKY09zHb+BcTCW2V5ghk8v2d4Vn9mSFxm:nv30hqBcGyuY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021940, "uuid": "090ffc4b-8865-4383-9bd2-71f0d65ffba8", "value": 1994992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021940, "uuid": "c9332835-b217-4b8e-bb3e-eee21fc890c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021940, "uuid": "7afa3aeb-42df-4fea-a953-fd4a32862833", "value": "kworker_u8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57058228-6d3e-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782024994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024994, "uuid": "aae433e7-5279-4f72-8f4c-6a31b2b8edf6", "comment": "Malware payload (Vidar)", "value": "564697f11bde8139c60f92cee6389b8e", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024994, "uuid": "ed391fdf-ca2e-465e-89fc-232d1d8e73b2", "comment": "Malware payload (Vidar)", "value": "38710fa6b5218e34f90935ea70f138136123aaabbcdab215d7337b2994c8d222", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024994, "uuid": "41207a97-5767-4805-bc83-8d3426d04e5f", "comment": "Malware payload (Vidar)", "value": "ca6415ffa1168b09b817994623d14368739c812c", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024994, "uuid": "651f02c9-76ee-4319-91f3-9e17135f9f67", "comment": "Malware payload (Vidar)", "value": "385263572827f4a3e216363f26ac280424cc4670bc68d795c70bf4040684709d9979048cb7926917c6a8c8d7e62c463e", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024994, "uuid": "7834dfb9-5336-461f-a27d-f6250fc89104", "value": "T186F58C03ED9605EAC069A2318DB36296BB747C492B3263D32EA077783F763D05D36B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024994, "uuid": "32af51c8-99be-4a12-9cec-38e36e3fc671", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024994, "uuid": "ac936f83-c456-40c5-b86c-8f326cfcd595", "value": "24576:0UqrKlmmaeLHAUN2/lxt5td2q0rCxpjuqkaNojABN28XKhphTlJ0BvA2Bele5IKx:0Uq2luedN2/3t7kburoVwiTY4ZBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782024994, "uuid": "2a45d67c-bbd0-4361-b510-3a578de3b66e", "value": 3392512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782024994, "uuid": "1930bd03-b483-4fcc-aeb7-f61b8f6bb5ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024994, "uuid": "ab6d7e3e-5b1d-43c3-945d-39803c608e44", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77acb3a2-6da6-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782069716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069716, "uuid": "483f78d5-d423-408a-8145-c8873472042b", "comment": "Malware payload (Mirai)", "value": "54f328326e0df67546ca3fc10d507aad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069716, "uuid": "66ceed83-3b94-4eb2-877b-22ae861994a2", "comment": "Malware payload (Mirai)", "value": "3887673e2132c610c6d8c9aa00abf5dc05a123752f58785efe16226d3f8b607a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069716, "uuid": "90072271-2c35-434c-9b37-f6e809b9c078", "comment": "Malware payload (Mirai)", "value": "1952cd3bde93ef16059fe83b2a084434df407a42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069716, "uuid": "e962e2ef-239c-40fa-a929-05aba938f504", "comment": "Malware payload (Mirai)", "value": "a5507beed4170474f2d54edc3e8e8b5c852972c4eefd532cdbc9a02e3973cfe2741082afb0e4df1bab1b2c3bd689c064", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069716, "uuid": "01487755-033d-4688-af3e-fc7b4290b948", "value": "T11453194AF9816F01E4D521BAFF0E124A33535B6CE3FE7212AD245B2563CB96B0F36416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069716, "uuid": "aa374901-4e47-4885-bfdb-158169de54ec", "value": "1536:f0nSY53fQma5a2c6AKY62MClbniVCwt9WY78Tt:fY5e5a2c6Ap0Cwt9WrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782069716, "uuid": "563405d0-78da-46c2-9339-c65251045f5d", "value": 63640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782069716, "uuid": "674c41ad-9f21-4078-94dd-d10e924bbc04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069716, "uuid": "2b6ec8ed-d976-49d4-abd6-def4875a48ca", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bc2cd8-6d4a-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782030223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030223, "uuid": "cbe1e8d2-881b-4e0d-b229-853aedd4def8", "comment": "Malware payload", "value": "dd897925a25bb0dad996f8c694e4178d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030223, "uuid": "cc041f48-18f8-4d87-bcc5-335a1e0cb376", "comment": "Malware payload", "value": "3b92622a7ff1323b5c647ac613d0cc78e113edc37acbe495cb060d986454dbf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030223, "uuid": "3f5a8327-7be9-46ec-af23-fcc00f5d79dd", "comment": "Malware payload", "value": "5a44577ffa459bd93f1b85291cf6dc3b6458995b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030223, "uuid": "5a04acaa-e5d9-48f5-9648-2ae6080326fd", "comment": "Malware payload", "value": "61cffe47f243b5cf3338073f8e866a4a2d866230218dd2617d3a183e422568acd644c5ae43025aa9dcfcb99da684b2d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030223, "uuid": "bdbe738d-abda-4434-b12c-1b51afddd75e", "value": "T15AF30985FC915F26C6C622BBFB5E42CC772A17B8D3EA310389255B24378B85B0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030223, "uuid": "3ffcdd02-4a9a-4a48-846c-dbae38b0f1ac", "value": "3072:0or0eAgv+WGOU5W9jzTj4BjnMbS4t3HGL:Lr0e7ZGOU5gjHj4B7Mb3t3mL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782030223, "uuid": "fb2b538c-404b-4d66-843a-901a3f7f3237", "value": 162476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782030223, "uuid": "2a6d5382-7c81-4035-939e-0fa71b9e9ac9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030223, "uuid": "c8b98383-aaaf-4c3f-82c6-d1d364b04082", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259e8cdf-6db1-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782074303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074303, "uuid": "0078d885-cebd-49c6-a4cd-c1a4b7476e82", "comment": "Malware payload (Mirai)", "value": "a75ff8f278a80932f6071baceb9bb68c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074303, "uuid": "801b3cb2-42d0-4777-80f4-327209ef826b", "comment": "Malware payload (Mirai)", "value": "3d21695cf0c4ed5889dac2d4f13e0b11e585b3ad06dd23e66630b0d86e3e866e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074303, "uuid": "107467bc-adce-4210-a099-9b9ecdfc90f9", "comment": "Malware payload (Mirai)", "value": "4577adc4a474294efc1123d2e29b884682b47869", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074303, "uuid": "b6e301a1-67b2-46ca-aefc-1808d7742930", "comment": "Malware payload (Mirai)", "value": "db1e04350be03d41ace9b3bc41b274ecff6dd61e035e81d17698d9ab0343b0cb6a3df1e9f21211d0b7ea9c8315da3f54", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782074303, "uuid": "2c837ac0-5ec5-4c4d-9df4-c11b13d27002", "value": "T17831639A00246B385612CADD73733588710C92EB1D9BDBA49D481EE9828C5CDB216FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782074303, "uuid": "e63ffd3b-3583-4541-a5e6-e93817a3544f", "value": "12:Uo76C76OUVXj65vl1E61SiiRY6PoxFg6XIJF6omABAS6MoM8z6i53bdiNNgSx6Nm:SBiilcIVmkGpbdreiC7bL/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782074303, "uuid": "2d4c0a7c-f9ed-4cd7-8eef-88e2d6dbb3a4", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782074303, "uuid": "e1b1c5d8-f4e7-4642-9d65-cd86469839ed", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782074303, "uuid": "83220ca4-4b48-434f-8101-bf7511fea79d", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c709f31-6d24-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782013916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013916, "uuid": "3d552104-8fb8-4b45-acb5-529f3ea0bcde", "comment": "Malware payload (Mirai)", "value": "fcbb17cc09bfc3a1abdcbb1cf6e0a0f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013916, "uuid": "eb9419d0-f13d-4bf0-8c62-86d9fa301af9", "comment": "Malware payload (Mirai)", "value": "3d5a56500e285a1a06739cb5bbd38812107a4e76c66c5d260ce1d4b422b7fc9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013916, "uuid": "2162cbc1-326e-477b-8a7f-14253bc5417b", "comment": "Malware payload (Mirai)", "value": "241a2937623af59080c483a6f5adc34f5bff4f62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013916, "uuid": "5d7bbaac-c1db-4336-8106-6ee1b350ff41", "comment": "Malware payload (Mirai)", "value": "5f1c16aa061d3e669011853d6f4be683cd409492217eff0440c95ec2519e5088b68c8cacb1d670b88bf57a789984bc76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013916, "uuid": "688d5f97-12c4-4e9a-bf36-24c8c016a8d7", "value": "T164149D63D8646DD8D62998F4B0F0DF781B436614825B1EBF2AE6C6754087E8CF90D3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013916, "uuid": "51467f7e-39da-457b-a76d-ca23cd19e719", "value": "3072:chPfhCVfGZg/mxYSpXIVWD/L8/FyY6VWQFnln33Uf7:UYGa/mV1IVW/xgQDnn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782013916, "uuid": "2f87982c-b4e6-41f7-a1e2-ef18684d40e4", "value": 193220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782013916, "uuid": "573fbc3b-dc4f-4f99-a1c9-f7cd6842a53e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013916, "uuid": "4be7a7ef-1a8b-4c28-8349-9f2bbc3e1d52", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0317612b-6daf-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782073386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073386, "uuid": "28176b2a-172d-4b8b-9787-55ef25abb1bb", "comment": "Malware payload", "value": "8686099cb96a2ff5224c753e5a1f6c7d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073386, "uuid": "10c2a3db-db5d-4788-a03a-b4fbb8490166", "comment": "Malware payload", "value": "3dda7724f33b2b89585cc36522f167260bda9314eb22e07a370079a51de48439", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073386, "uuid": "7d9587f9-3c8c-4213-8af9-219a06829d06", "comment": "Malware payload", "value": "caf177883cb3bf6523e1445df128573938af2cf3", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073386, "uuid": "366d7a82-b8d6-4e5b-ac4a-a4325fff7db4", "comment": "Malware payload", "value": "9c44e5b5c5075123fe03c14d147e6c225ebb4b29a06d25a4ee6be1f9ac80202754dd294b324cf86cdc8b137d084c4dc0", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073386, "uuid": "f6d07b09-3bd7-42b1-8fe3-0a46b69adbb1", "value": "T13B513C1066FD4608B1B3AB09DAFEA4A1583FF91DAE76CB0C0055D14C0BB2A14C967F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073386, "uuid": "f8d564a8-4f3f-4048-8fa0-ebccaa06eed4", "value": "48:rsw1sAkD1aaPEYHD0eI7S5r0xX6YyNRX7SwOA4WmxZ5dxGE55OhL7C0/V:rsgsZ5ahQm+5r0R6xx+U4xxZ5dsE0FV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782073386, "uuid": "8b3e392d-86e6-4bff-9164-456339202a21", "value": 3028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782073386, "uuid": "d7a90137-ae42-4bad-be3a-001f894ef863", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073386, "uuid": "1646b33e-df9f-4c9b-8bf3-a0fc0e46cec8", "value": "Vy.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31818cde-6d45-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782027937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027937, "uuid": "cf9f715e-94b3-407f-b862-40ff8db19f91", "comment": "Malware payload (Mirai)", "value": "e9f92b0190b311e5423430dd0bf9a667", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027937, "uuid": "abbcf838-e277-4ef4-b470-45eeb7980417", "comment": "Malware payload (Mirai)", "value": "3fccd74f67cb1caa7a9e972109a104a70303a11e6ad8e9c110381675d59b8a7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027937, "uuid": "f7f2d448-8412-445d-bfaa-040d290696b3", "comment": "Malware payload (Mirai)", "value": "4b6847b7bf6a008a2f3bf060d862489986aa9517", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027937, "uuid": "f5ad179b-5cb5-4468-8ab5-1cf733e4ff4c", "comment": "Malware payload (Mirai)", "value": "591caedab21669804d17ccc4210567ff6edabd0548ed57c2c44ede6555895cd8a66c03cc3c5d9d699f2990d911e5b3ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027937, "uuid": "a05ccc3d-c7e7-4725-a971-013556ff12fa", "value": "T1D7144B46EB804E17C0D62775BAAF83413323DB74D7E773068928ABB43F8679A4E72505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027937, "uuid": "c92d44c5-a389-46e5-9317-4371da6bc1f7", "value": "6144:/Gq3cybJpIvZaEI7RySmBlKrqcG2NiL/KlzH:/GXybJavZaEI7RySwW5bo/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782027937, "uuid": "51db1700-5e54-487a-9797-85ef3987d280", "value": 202249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782027937, "uuid": "33f58c09-0cdd-48f2-9303-d56476af5cc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027937, "uuid": "f4293dd0-0043-4b1e-96be-5de6e1f083b9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5bde6a-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021942, "uuid": "2a294d1a-c517-49fb-a63f-c128b2d3e1d9", "comment": "Malware payload", "value": "f4f8f4b302a25b9d5e342130947d3d64", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021942, "uuid": "cbbb307b-2de6-4335-bd5a-568e0a6d8cad", "comment": "Malware payload", "value": "3ff78da6948ba8f29ff31598fad053051486ee3f36184e578ee8c5aa786ed9aa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021942, "uuid": "4b58c6f2-ae81-46f1-8449-f1428dde9dfd", "comment": "Malware payload", "value": "9faf19414a418547767481481cea681a4865227c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021942, "uuid": "0a55323f-57e3-4fcd-9603-9be87d002c96", "comment": "Malware payload", "value": "7ca3fc16a507115914801ba4f0c218c2e5d06204aa02713245a838feedccbf1a390fae98ad7a43b5c80cad8242c40e35", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021942, "uuid": "f6a701ec-3ff3-4ff3-8cab-31718e3adecb", "value": "T1B4661712BF88DE5BD2A821358EB7C23833D53D04C1B060369656F71D1EBE2A49D6BDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021942, "uuid": "90c51182-6bdd-4473-b2a1-e340dc51b610", "value": "49152:XZWPhNYvlY9TR+5XgQNOYyL+6bSK+fDXHHEt5Et:rlDItGK+fDXnEjEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021942, "uuid": "31affb22-94cf-40f2-879a-7dc089d005e1", "value": 6815892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021942, "uuid": "705f70bf-b3e6-49d8-acfd-a2bf348e3454", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021942, "uuid": "38f17ef3-aecf-45cd-8d06-b4a4a5c37102", "value": "xfsaild_sda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd7a3b2-6dae-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782073323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073323, "uuid": "c1ed43d8-40b4-42da-8b3a-af5b19b1dae3", "comment": "Malware payload", "value": "87ccad3fc97fdedf942ca98ae3686fc4", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073323, "uuid": "75b1b125-b2dc-4399-84f7-29e13c3deb84", "comment": "Malware payload", "value": "400ca3bc5a546716fec62a3f5e5730585d2d0acb24b973e40e4321a4be3ea9d3", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073323, "uuid": "99862176-ee94-442c-9360-a6f7cf7f9bf8", "comment": "Malware payload", "value": "8377f54bd6f278b38d887454fd4c3f2280b87d46", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073323, "uuid": "8c9f18dc-f42e-42df-baf5-f15c5f94b6fd", "comment": "Malware payload", "value": "03efec9948de0fa352f4a3b3a2a94d0ab82e8d6264c61d8e7ac30b84eadc2c56c56f739a596d8e587bb2b9f44e8128aa", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073323, "uuid": "b662de2e-2da2-4e5c-93cf-d0a599afc3ad", "value": "T1CFF512270F9ADE980940BB3460DB52BD88E62B364C48B6B3A9E7BDE51CC5DB4404DCF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073323, "uuid": "96c05dde-0d08-4e43-a237-547b6c1b9fad", "value": "49152:2Xqh1HgN3tYGxOsTX2kzSk4JE3BfggLEFx8MSjhnuR:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782073323, "uuid": "c7353141-5ad7-48a5-af90-7477b87043c8", "value": 3343296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782073323, "uuid": "d23155e6-a98e-469b-9c31-bf4ba7516ea0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073323, "uuid": "678c4d4e-ae8a-498c-a981-a0d90ac8578e", "value": "42662A7F.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b229bb-6d47-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782028778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782028778, "uuid": "a3ac8314-98b4-42c1-842a-aa6bb1d906e5", "comment": "Malware payload", "value": "88c38702d8d4bbcabc9fb8db7f1aae91", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782028778, "uuid": "625a554a-6549-4398-86f0-345ad5fd8423", "comment": "Malware payload", "value": "409f260ddaaf01908f13af576dd0e8e9cfbc7fea549f1f461fea0cb2d5d4b8bc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782028778, "uuid": "83bd457c-8e92-4615-9cb7-d643d4041c31", "comment": "Malware payload", "value": "e579f6195a8338002f390aa8cd1dc8c4933fdb91", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782028778, "uuid": "de31e900-42a3-46dc-bc47-2f168de079b6", "comment": "Malware payload", "value": "1747cc2f78993c6bc7e2540112d00a17cab4205d7d672f7291f4d45db7055039d795bf0a23a4408fe7c17aae55dede17", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782028778, "uuid": "aacd7444-2e4e-4fe2-a5bf-7e1f97b553c3", "value": "T171137D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49ADCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782028778, "uuid": "cdec216e-0664-4cdc-adb6-d8412ea23372", "value": "768:N+Jx9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:N+cco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782028778, "uuid": "ad00a42b-20e4-494d-b268-b958ba04c37d", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782028778, "uuid": "abb18337-8c90-4c7c-815c-58c04bed65f3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782028778, "uuid": "7c23079f-2ac0-481f-b7c4-b17b534b9039", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce906df0-6d23-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782013598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013598, "uuid": "1e4f4a7d-b6eb-4f43-a577-3a769aaf2953", "comment": "Malware payload (Mirai)", "value": "9c4a4f053d490d63a659e07566d2d7c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013598, "uuid": "12e58c74-f158-4172-991a-35fc93d8a6f2", "comment": "Malware payload (Mirai)", "value": "4120843a2a5392f97cb33611bb4f3a7c20bf13ab544b77733e2d805de6fd01e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013598, "uuid": "e1afebe7-d3ec-4f75-bb56-967a61d8b0e0", "comment": "Malware payload (Mirai)", "value": "85f61f076ad59340924d6a2bd97685d6e0be676d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013598, "uuid": "da5aeb57-4816-4459-b4a4-5a6b9891b884", "comment": "Malware payload (Mirai)", "value": "d223f7f87d22e3e06ae1004b0e245098992f6133a82d9170fd22114f263eb5ede20714d8f96514621fbafc6d418feeee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013598, "uuid": "8c5aae90-a435-474e-9711-c5f538ad90eb", "value": "T1D5E32945FC805E17C6D512BBFB9E42CD372A27A9D2EE72038D115F20378A95B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013598, "uuid": "2a4cdc4e-4362-421a-b4c9-cf14240b5144", "value": "3072:iHFQ0juwKl0lZ6emN8V4ADREez4rsEvI:iHFQnl0lYjuV42Rr8rlvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782013598, "uuid": "395a6c92-d805-427a-bbfb-35c6b2df4672", "value": 146508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782013598, "uuid": "08a8302d-6857-4fff-bcb1-e793b0abfdd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013598, "uuid": "7cc6a531-936a-44db-9324-dac7bbb4505b", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bd32bb-6da9-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782071080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782071080, "uuid": "a0007ee5-6d27-4835-a810-538a8f5eea80", "comment": "Malware payload", "value": "4f26d0e7c3833f31217861a93ce07159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782071080, "uuid": "539f5ce4-f215-43cc-a551-2909a829c989", "comment": "Malware payload", "value": "4125afdfe531e51f61e5dc698220165d6156820419cfce201ebf333bbf5413b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782071080, "uuid": "7f127d5d-8053-4e9d-90fe-15bace3d167e", "comment": "Malware payload", "value": "aa5809a817afc447ae3131ddfced67c7ffc8596c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782071080, "uuid": "79fbbc0a-c201-49ad-90a3-f3c444962be4", "comment": "Malware payload", "value": "acd9e6b633cca823a52a07d39edd43474119369c558cdcf3a3c643f897af45bb23be4d59dc75b7a1390a21d19f008abd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782071080, "uuid": "18d363e7-171a-4c00-9acf-c68a7e3cd633", "value": "T1F7083318405385B0C7FA74F179A7F724FC35A6B66AF2007DEA8AB8D53276599000CBBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782071080, "uuid": "b04e88e5-b744-470b-b8a4-14fb5c8fb491", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782071080, "uuid": "2dbcbbe8-9a9b-465b-b893-5fd3f54d3603", "value": "1572864:ut9IKPh0DtsRWYKrrtU1GfPiw0P9myNR24Vkb/3UwW22QOn+j2V0k03Bm7:uUK8GRWFr5U1Gfm99R24VkbvXWko2Rm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782071080, "uuid": "17d13182-5456-46a2-af16-4128428d6b99", "value": 77394513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782071080, "uuid": "bf2ef850-deca-4d45-ab37-b7e12748cfce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782071080, "uuid": "e4191da2-798b-4403-9446-0808438ef61a", "value": "SheILL_Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151dc983-6d57-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782035620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035620, "uuid": "0dc8942a-28c9-4dac-be20-b0b6d027de6d", "comment": "Malware payload", "value": "9771aec8ffc9422f6133d485b0005d6a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035620, "uuid": "02a5c9a6-eadd-4779-bce7-4fc292860013", "comment": "Malware payload", "value": "41a9d327fd31b4b512dd4b916db3e0458b5819303d940e56005be135f9872ee3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035620, "uuid": "b2bfa65a-7bf2-45df-957d-34008b23cea0", "comment": "Malware payload", "value": "f8f79d959d8e894dfcf2aa0dcada167d6a96ba47", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035620, "uuid": "409b5759-d375-41fc-961b-670bb9e81438", "comment": "Malware payload", "value": "7470882642dd1cc6b559c598914357fad993aa52cd105b9b1a00a52889cb69e6572f2c3c98bb3055d9d2d7bb70309c81", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782035620, "uuid": "3fcfc41d-0ad7-42fe-9e99-48c8135312e4", "value": "T15AD05EBA68B321B5186A6C44F2D2A545B65197BE8C46D628FA9320706F8464DF5803A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782035620, "uuid": "e4760f9a-b1ab-49b3-a209-04930090231a", "value": "6:hTP2+90vzrrNqYiSFbAulNXYq9DG+NjVsNXYrkJ:VPGz9JLbPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782035620, "uuid": "6d4dc08b-a893-47f1-ad1a-6e15d3f8df87", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782035620, "uuid": "f87c72a8-a277-4ddc-89f8-4f6a2a4dd30c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782035620, "uuid": "922bf0fc-76b4-4c0f-a585-319ab3708aea", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c7d771-6d27-11f1-ae13-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782015326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015326, "uuid": "6b9064f6-9041-464c-aedc-27a09b0b4845", "comment": "Malware payload (WannaCry)", "value": "b6f366e487fbf740c0479a8c286d7cd8", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015326, "uuid": "89fed057-1db8-48b7-b284-7891792d687a", "comment": "Malware payload (WannaCry)", "value": "41c710a185e6a5e81c76f71d078c377bc3852381d712cbb1d409e9ab8647569e", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015326, "uuid": "d9df2cf6-1029-46af-9c4d-5aecd3867038", "comment": "Malware payload (WannaCry)", "value": "69f92c76ec8c824a34d7b5c426ee41e47435e9ae", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015326, "uuid": "e9898197-5c59-4730-9f3f-c4b092e0a8d0", "comment": "Malware payload (WannaCry)", "value": "a31af0817b2b61361bc4fd750628d5ad12885a284da77d0a01f816d05f98cd3a37eb04cc0be5cfcc0175607d808b107a", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015326, "uuid": "7bd757ab-f7e3-438c-8f8e-009ea5ffba8e", "value": "T125361205B1E85AB4D7B32EB221BB8B0053767D5599BB924E1760905F1C33F0CDEA2F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015326, "uuid": "7f8684ab-baa8-441a-baea-3d9b70a65eda", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015326, "uuid": "72dc3647-cfa0-43f9-9ded-c8778b88c2c1", "value": "49152:jnsnGMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAnv:DMGPoBhz1aRxcSUDk36SAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782015326, "uuid": "32e716f2-63fe-4eb2-be0b-d18066f720b0", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782015326, "uuid": "fd07337b-5a82-4528-914d-111a06fe288c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015326, "uuid": "86aae475-0c20-48d7-8d23-2e8e62d15315", "value": "41c710a185e6a5e81c76f71d078c377bc3852381d712cbb1d409e9ab8647569e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b7aeef-6d92-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782061257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061257, "uuid": "6d6d6df3-a5b0-4317-8c71-345ea3aafbe8", "comment": "Malware payload", "value": "bf7a46e80585822103bed1cf04ca27fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061257, "uuid": "3044911a-d1eb-40dd-ae75-b1dbb43fbfb5", "comment": "Malware payload", "value": "41da7415697d2806ef90e1a1bc6f084ce0cda4ae519508d7b0a8c9c48a855a8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061257, "uuid": "873a9982-1533-4375-a1a5-82568ed3c1e5", "comment": "Malware payload", "value": "06676805e5028baa3236e7d2e1208ead782c422e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061257, "uuid": "5b998923-188d-46f3-98cd-a6418c8a8f44", "comment": "Malware payload", "value": "8988df10e22847f9a0891565d3481d7684f278b771bef89645b9499a8ff80131ee2472ffaf7cd60fabd33b258829bd47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061257, "uuid": "67b86101-d5bf-4600-b132-4df51cbb3317", "value": "T1B217BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061257, "uuid": "0211eaee-09db-4366-8d0f-0af0530425fb", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQf:cqYUQuVDt0TZEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782061257, "uuid": "4318c395-7d93-4ac5-b5a1-3413976122ee", "value": 18808832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782061257, "uuid": "97f1c3a1-ecaf-4e9a-a064-c68de3fa7146", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061257, "uuid": "8fc5eceb-1ef4-4ca9-9fc1-1e5143be6a9d", "value": "41da7415697d2806ef90e1a1bc6f084ce0cda4ae519508d7b0a8c9c48a855a8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342eb207-6d20-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782012050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012050, "uuid": "1f73b807-45d4-4b2b-ab26-8f0f4cd89be1", "comment": "Malware payload (Mirai)", "value": "65701191e09529ebb32ed661b73cdc8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012050, "uuid": "68621e6f-b7f8-42a9-b3ad-adddafd2f64c", "comment": "Malware payload (Mirai)", "value": "4356f236653d9e40147a230764670947f1399abf05d25495227e2cfecc1bb2fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012050, "uuid": "10005f52-e529-48fb-bb66-2710af22b23d", "comment": "Malware payload (Mirai)", "value": "cb963cfac2b476f56bd71be8d35a78fc51b432fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012050, "uuid": "397a2571-f21d-4e21-b713-7f3f4705f615", "comment": "Malware payload (Mirai)", "value": "4f55be7c42e12e00535416731c550e05f46703db13ac872b29c790725d0b8ddb2cc70fec5cccb230c3fb92ebe6d98e5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012050, "uuid": "1ae60dcc-2c70-4360-9030-7669298cabb0", "value": "T1A414B40A6F610EBBDCABCD3706E9174228CD641B21A93B757674D924F10B64F1AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012050, "uuid": "d8ddddbe-c6f2-4cbf-bd8e-e119596a9f38", "value": "3072:KV7i6QdQcBO93r35hzreeULE9lLoO0R56:KV7ifdZOp51XQSLoNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782012050, "uuid": "309099fd-a1bb-4d00-ad0c-51e6d3e4d222", "value": 198148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782012050, "uuid": "37d90d7c-b1cb-4677-b03f-76c1058f3802", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012050, "uuid": "99cecc15-3130-43a7-9928-3e77cb39ec59", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a008f4-6d71-11f1-ae13-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1782046951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782046951, "uuid": "2862ae4f-8304-4c0a-9bd5-cf4f97739ecd", "comment": "Malware payload (MassLogger)", "value": "c50f07c5da5e6dc8d165c5e98719a763", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782046951, "uuid": "543e901d-a0ef-4e22-bdfe-51a2c41cd0fc", "comment": "Malware payload (MassLogger)", "value": "4374049d24a766eac84cdd1995bbd236d14956a11123de0402a8cd4669aa0be0", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782046951, "uuid": "d8d661fd-4649-4a7d-8149-a134e5c30c99", "comment": "Malware payload (MassLogger)", "value": "a9746611bca26ba53c61ea3cf15f2775868789a4", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782046951, "uuid": "209bd060-4ef6-4da4-a11f-bb5b18769bfd", "comment": "Malware payload (MassLogger)", "value": "79ec37defa3ed8fd066b639633ad5ccdbcc2561ebd115a46f89e09896a08b66b4b532c693d5f300560f42c0da79b3259", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782046951, "uuid": "b4aec917-c7c2-4994-b31f-11b3f247eeec", "value": "T11B853A38ADFA002B71B3EE998AD475D6EA5FB6733B1E6429109303CA4713941EDC163D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782046951, "uuid": "99c49ef6-8646-4201-a68a-ea997001eb64", "value": "24576:9nS3wQRgzoQnQ0/JiV8wLnDFoxItVzhAFBKcJHuJS8:y3V5o0Vov+S8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782046951, "uuid": "30001cd8-896e-4236-93c0-4edcbee9fe56", "value": 1834790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782046951, "uuid": "03d81f5f-d7f2-4c3c-83f0-107a71f90388", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782046951, "uuid": "43035161-c822-4ecc-a33c-892c81532f03", "value": "RFQ#PO - PO25-08-888.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87fc9b4a-6d55-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782034954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034954, "uuid": "90ab24d8-770a-4bb1-b903-69517aaed0aa", "comment": "Malware payload (RemcosRAT)", "value": "5a4dcdc6cbe2bb676b37f9a24bd593a3", "object_relation": "md5", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034954, "uuid": "870faa63-660f-43ce-a484-24494a66f491", "comment": "Malware payload (RemcosRAT)", "value": "43ee2409e135916fab34e910035ff437eb1eaa670000c4f0948ba33f11a7083b", "object_relation": "sha256", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034954, "uuid": "4afecf46-9f3a-4bcc-9968-f25bc91a28b2", "comment": "Malware payload (RemcosRAT)", "value": "d4d165ba51a52baff5e187f62e5d970f378ec119", "object_relation": "sha1", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034954, "uuid": "2ec5794a-80f8-4a04-8c09-fd0910b92173", "comment": "Malware payload (RemcosRAT)", "value": "48e987f100d14120120f17e498a4591df30ee15dcea8787bc981b9c078cab476997f79010b39153bcc2bb1ad8034fba9", "object_relation": "sha3-384", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034954, "uuid": "57fa289d-2418-4580-a7e2-c2a84c38e410", "value": "T127E59C13EB918AE8E65D09365F284150D62EF621AADF132175AC120DCF93387BF25E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034954, "uuid": "72ba3e89-16a2-4d48-8837-2010ae96a1a9", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034954, "uuid": "b5215cec-c28b-42a8-a050-cfe60360b07a", "value": "49152:RAQuyZpVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/B+q:R7uDnLrHp/qKm2/Sb/gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782034954, "uuid": "85c80d24-e1e9-420a-88aa-6d725619078a", "value": 3175424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782034954, "uuid": "f4186102-ca76-49bd-aa01-ad7033e2b591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034954, "uuid": "b8793404-8170-421c-913b-9b298c8753da", "value": "43ee2409e135916fab34e910035ff437eb1eaa670000c4f0948ba33f11a7083b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e1dddc-6d42-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782026867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026867, "uuid": "4ca4efec-6350-4b61-b18d-e529b4527c45", "comment": "Malware payload (Mirai)", "value": "f72ab1e2b39b8a68d4536cfd959f401d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026867, "uuid": "f2fab5af-80e9-45d1-b207-837e5defa1da", "comment": "Malware payload (Mirai)", "value": "45ee32938be4c01a092ea4d31d8466fa8cd84f1ee856b557cda7cb517c7850de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026867, "uuid": "456f92df-97ea-4790-965b-c3dc3a23500c", "comment": "Malware payload (Mirai)", "value": "e31cc8be2799b066972cfd3163ac136cd25cc9f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026867, "uuid": "69797afa-9da1-4077-b6cf-9c4b70b59fd3", "comment": "Malware payload (Mirai)", "value": "524ca09d6d7aa4b6e97c08be1724315e6f542b2f5fa252ae92fbfc9417102ab37beef946d8bf9cd3874f6c2a99452695", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026867, "uuid": "722f4712-9987-461a-bb4f-73b7ace79526", "value": "T186633984BC819623C6D5237AFF5E428D372627A8D3EB3207DD164F61378A96B0E37641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026867, "uuid": "0ec20532-6abe-4983-a4a6-aabb949c1efe", "value": "1536:/nbvM0J1E48opWSVxDkDhEvr5xhCL6Tb:/nbvM0J1ERowExwEdxAub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782026867, "uuid": "ad999128-48d8-40a8-abcb-9bf513954d58", "value": 68700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782026867, "uuid": "b0c34cc4-b81a-44b8-824c-8ec9761cb94f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026867, "uuid": "5ddc57f0-1ce0-4e77-b534-af4963ab54ea", "value": "karm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78619534-6da6-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782069717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069717, "uuid": "b696da32-9c6e-47ac-b2a8-15a0017c6b67", "comment": "Malware payload (Mirai)", "value": "9eb22f25f13587916ccaaf325807ca66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069717, "uuid": "b9799905-3265-4496-9f91-ad4b8cf7f57d", "comment": "Malware payload (Mirai)", "value": "47e8b4ec162aa621799c1d9d96783dba6a8c91966a167e209061a267a2ac7667", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069717, "uuid": "559089fb-3fe1-414b-96b9-355913fb85e6", "comment": "Malware payload (Mirai)", "value": "6edffc701527db3ba3d054f3815dec9786aa0b0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069717, "uuid": "ad71e48a-5a26-484d-bcc0-6711b0b39a16", "comment": "Malware payload (Mirai)", "value": "093f274af4dbbadf8da4ae02f3e97aa9c0ee07178e42cfe89cf16c9199e9276a07c2b5d95fb4d70fedf209c572ef500b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069717, "uuid": "7dfba815-836c-4152-b7e7-7838eebb1c01", "value": "T1EE032A85FD859A03C5C552B7FB0E038D7B26475CE2FA7303AE295F21378796A0E3A152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069717, "uuid": "de4fb58b-c369-4450-b2df-fa573f15abbc", "value": "768:MPBwAUi0eA9d7qew0WueK1MuGwXu9ZdCa5TF+aRV+cEvUI:759d7qN0Vyu21TpFZHEvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782069717, "uuid": "02f9ed99-87d2-4e6a-b858-93e39e49f085", "value": 39812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782069717, "uuid": "d3ed8fa2-f4a2-4211-9598-9e619970c4a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069717, "uuid": "80dac760-fdad-46ec-ad91-43519e04116f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0dd01e7-6d41-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782026513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026513, "uuid": "1f1bb260-5c9c-4277-b5e1-0f1d6b8951b0", "comment": "Malware payload (Mirai)", "value": "11908ea28e51e99ff4693809b732b275", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026513, "uuid": "a872e5b7-c18b-49f1-9709-3364d228bb03", "comment": "Malware payload (Mirai)", "value": "48e03ec3fc526e27d50fce1757c505acb9cd7dc8df1b98bcd2bf22032368dab3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026513, "uuid": "87fc6923-c994-4895-aadb-755a145dd037", "comment": "Malware payload (Mirai)", "value": "c513c5f6bccf40bed32a541389ab20c94208219b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026513, "uuid": "99049cae-5f0a-407a-9810-8761829c2e6d", "comment": "Malware payload (Mirai)", "value": "b0a8ae8a56a67c00e3a225a70bd9ab6d7cce130ff084d89b05db8e14b9ca8b5988020eb3b72a809b2f4dcef8f98a4409", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026513, "uuid": "1049ed44-97e4-4844-87b8-392a0d5931b2", "value": "T104B2F642730C0957D1676EB5763F2BD193AFAEA021E4F2C0751F9B8A8175E3202D6E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026513, "uuid": "2f327287-5000-4a37-aea2-ef399312f568", "value": "384:Y21wxQLA3s3CSOjd1n8XXgvQ40yr6GVedgjPZ5Q2xcC6R9YY8Va6ymR6sJ:vKK3unkyrFAa1xcBROpVa6yY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782026513, "uuid": "76eb9104-ac16-4762-9ea1-82c37f60557c", "value": 25692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782026513, "uuid": "13df37af-86a4-48c1-a8a4-2ad25a3e3798", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026513, "uuid": "5202fd6f-6843-47fb-a340-af16af58e92d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a425f3b2-6d43-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782027270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027270, "uuid": "28556331-4ac8-489c-8f5d-b6d920b53353", "comment": "Malware payload", "value": "b93710525513f2bfcb81d2a7b7c8feb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027270, "uuid": "947b3ef4-41cc-4680-bcdd-69114359d130", "comment": "Malware payload", "value": "4af44279693304f1462070d863c57f8f583fbe023685ff27fa61419192cf4ad5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027270, "uuid": "f0b436d1-5fd7-4ebf-829c-87a1de7c2e75", "comment": "Malware payload", "value": "436ab6e98e3656ef94385eda89c62457424ed06f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027270, "uuid": "d005ba07-41b5-4037-a598-02a2f102ce8d", "comment": "Malware payload", "value": "8c2736565be22e8bf889a3e4d874265ae4cc57d34df74ffe6b3bc834bbc5aa8e1654e5c42b1414c1dfe3f0d04a3bf025", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027270, "uuid": "e72b71fa-43a9-492e-9383-9d7c63495d26", "value": "T1DE24DA1A6E228F7DF7A8C73447B78A30A75933D626E0D944D1ACD5141F2039E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027270, "uuid": "d691051e-8fcb-490b-ab60-a16a45d0c5c6", "value": "3072:nZmNaAKecRMYNH/GHzsmdFrVZR/W4XohIsRBdO9xAc4:nZ3AKee1UrdBVy43svdSxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782027270, "uuid": "d3c76a91-bdd0-4677-9e54-738b1a1628e2", "value": 212496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782027270, "uuid": "5b9d9314-7586-49e7-8f19-cb6fb8f327a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027270, "uuid": "e73dd2c9-a0bc-4c20-95f0-a37c2444aacf", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd97e52-6d53-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782034108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034108, "uuid": "954ed35a-0319-456f-aa2d-89211c8301ed", "comment": "Malware payload", "value": "ba5cf574a9f7a064fddbd51355ed428c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034108, "uuid": "79c59872-6a0d-4ea2-9bbc-e51419860ae3", "comment": "Malware payload", "value": "4b416e7b71b3a46854f08618d76d1146159d8da5c5061b9336dcf30b50cf6725", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034108, "uuid": "d059c910-bf89-4d76-a8ca-da0692b4b712", "comment": "Malware payload", "value": "9c42abd02102e2b466763338b581f44b7093f1f8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034108, "uuid": "0d078aaa-eedf-44be-be90-07448f6cf1fe", "comment": "Malware payload", "value": "c95426e7f1b85f8d12d0e0c2a528be3bd38561b26d5c0f4a803923ec40d4763d74269eb4c2c867328dac4dbea0842a08", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034108, "uuid": "431c5acd-b335-4822-8b63-744b8cd335b5", "value": "T1BEF73334717669E9EB3BD27FA0B84FE5805075E09365D5EF63782FA95EA028210F2D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034108, "uuid": "1ca5b71e-fa9a-49f3-bf2d-e55bfbdead33", "value": "1572864:cvV75w5itmpJfqdg9xF5BUEtjBm0V9JApmanieTJv5vDFx0eoX9PA2CiNJ:05wpJUgzdmMApmWdv5v8ei9YCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782034108, "uuid": "bf6a9870-e09d-4ff6-84d2-d479c976c1ed", "value": 74753536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782034108, "uuid": "bd251bb4-987a-4a47-8b9a-1fc7987eeb33", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034108, "uuid": "ffc49577-3aa4-4961-8a83-08099e269064", "value": "LetsVPN.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba0e19e-6dae-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782073373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073373, "uuid": "eb85147d-e3ac-4227-9380-1488bd9455f2", "comment": "Malware payload", "value": "4ef0e07bd94b4bb9ad682fd92ae4ffc6", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073373, "uuid": "bddad005-8bb8-4556-bf28-b7296e47175f", "comment": "Malware payload", "value": "50264e6ef48f2bdff1180fa72733a8a8a693990d84d1a6ce0009898d81b09a92", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073373, "uuid": "391687dc-b71f-4c26-8b28-1c1bab289447", "comment": "Malware payload", "value": "041f12a4aad97a76e65b449e8a4d6514f4b81c0d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073373, "uuid": "1ffa96fd-1057-4d27-b9f7-65bd58fa4511", "comment": "Malware payload", "value": "d7b4f44a71d9800987817f88dfb53ee546e0e31b20cd65231bb3821439ae1903cb72af17caaf084e08665f8724014fd9", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073373, "uuid": "389a59c1-6e48-4c29-bf25-43323fc86325", "value": "T1DC611A106AF99F14B573DA099ABEE492543BBADDEE31CB4C8159C10C07B5A408917F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073373, "uuid": "ca9ca75d-4b19-478a-8ad3-01edc8083b9f", "value": "48:rsw1sAkD1aaPEYHDK37c6YyOvaHr7zXtT4oNQM7ktAGG5FF3F5UHk0xXm7VA/Z:rsgsZ5ahQG46CGdMoO2zxbdQk0RmsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782073373, "uuid": "345a9111-024c-4bbe-8a54-7921e151dfa9", "value": 3268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782073373, "uuid": "35e36024-2c73-4af2-bda2-e01f60d1b5ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073373, "uuid": "94deeea6-c681-49bd-81f4-083fb4508b31", "value": "NgOVP(2).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0314f16-6da6-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782069811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069811, "uuid": "78dae5e7-b1ee-4294-bc79-9ce6a7e05f2e", "comment": "Malware payload", "value": "52bc392618b3255e035de00914a9d25c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069811, "uuid": "47d18ac7-94c5-4cef-902b-9d9a6dde5883", "comment": "Malware payload", "value": "50b285bef7b1ef41d14224c72e1d403b96f467609c598372ffc331c015862731", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069811, "uuid": "5e0dc29c-1202-48b7-a70e-e5413fa8b5aa", "comment": "Malware payload", "value": "4efa1ae6672197df7b405be131d27fbc3c50fd29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069811, "uuid": "b34388c4-010c-46dc-9654-a2b3db158a31", "comment": "Malware payload", "value": "a3d7282a1886b53ec77de4eab39d3e736cfca1b422e607653055624e203c6c2725bf0b6196d29a8d3785fbd83390a60c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069811, "uuid": "4d90217f-e97a-40d8-934f-f5725c73aa0a", "value": "T161A42A95EC809B91DAD12ABEFF1E824973131B78F3EE72119D155B3163CB84A0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069811, "uuid": "0719cc6c-d421-44e9-9e07-ff35d786e94b", "value": "12288:ld2Zq85Y1r0GywWZTujK2t4kEipA/0KpgZEda8DqYjrDSfqB:yZQ+In+0S3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782069811, "uuid": "19fbe02e-213c-436a-be52-d9e875086abb", "value": 472728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782069811, "uuid": "a05be9d1-6b57-4679-a3ac-bed0349c5a59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069811, "uuid": "7651fcef-348b-4ad9-a73e-dd7b95deb947", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a690bc1b-6d1f-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782011813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782011813, "uuid": "f836c3b5-8b98-4aa1-8a9f-05a2ee5e175d", "comment": "Malware payload (Mirai)", "value": "ffbc8d10bc616860c76a426821c5e775", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782011813, "uuid": "0281a8d8-9756-41da-a1ac-76c702a90a78", "comment": "Malware payload (Mirai)", "value": "51784ed910b91a5dc11bc045127222d67f537695db6aa6ecd7ea2338265b8342", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782011813, "uuid": "c14f58d6-0617-4ad5-85e1-408a2bdc4214", "comment": "Malware payload (Mirai)", "value": "5ac2a4a449f6f23a350d9c3b25f2c095c1a6346b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782011813, "uuid": "a54f72cf-09f6-4d3f-b03d-bf4f33d73ae3", "comment": "Malware payload (Mirai)", "value": "0fb8b84f50c3a09e88c0f3cfb78cbed7cf27632e8817237cd09709fc9810899b2389e350ce3432b1ea0d55793589c653", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782011813, "uuid": "fa4970b9-6663-4e84-b9d7-b958a1d202f3", "value": "T1F8A3122B15040949EE9350F8330EB08F3D0EEB9D26E2706655965EC3FA951D3EAF284F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782011813, "uuid": "4f606b37-0508-446c-856a-3ffbd504b632", "value": "3072:5VjSWGL1aUj5B2/SRTMcHKWGLajneYo+Z:5VebaUj72uTMcHjGLajDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782011813, "uuid": "a0d73daa-c998-40dc-b819-6e0c230d844f", "value": 104648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782011813, "uuid": "8be6dfb6-49db-4f60-ad96-bb31e756559b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782011813, "uuid": "d7ce2adc-fe8d-4f5f-8022-0b13d9196181", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1f17b2-6d24-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782013917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013917, "uuid": "cc14983e-e76e-49f0-ae1a-dc85b99e2ce6", "comment": "Malware payload", "value": "84fc2d48e778dc218905ac862abbc33c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013917, "uuid": "5e39c12b-af59-49c2-beed-da759ad425c9", "comment": "Malware payload", "value": "525ede4f72f413dac2902b7dd5e506ca9415d12da69a832386fd98903c91e752", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013917, "uuid": "9ed0c159-8628-4109-96b6-dd0f0be8fc34", "comment": "Malware payload", "value": "a63c197f16d935b2a8f609d3f1df4c1e92ab4c8f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013917, "uuid": "31ad4a36-e5ac-494b-a6f8-d05be7183f03", "comment": "Malware payload", "value": "fb913b6101b110f744d52c7ec7a8e29f0b6b317d0b80ab6b4642c3e5e2aa2d902c89262c4ea482c10979ff0150050009", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013917, "uuid": "5d0de12f-4f6d-4bad-8ee3-8815c0a03042", "value": "T14F312FDF10155A3A2252DACEB3733249640C85EB28DBC390DD485EED82889DCB276FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013917, "uuid": "64bd0c4b-9cea-4755-a295-236d30b4e618", "value": "12:Uv6FfhX3Uf676Uf0NUV6U/vtvjnSjmy6UJtdbDX76VtowNEI6NEI49EL46LEfXId:5E+8mvN7KVtuZEdEI368U7wCnRTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782013917, "uuid": "2ce9e9d8-efd5-4647-9855-d8df2c3607d9", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782013917, "uuid": "fc172279-43c8-4f8d-823b-dbd221890b0c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013917, "uuid": "d9c7bc11-3b8d-4634-9efe-b8c5bdfb6310", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250bb113-6d7b-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782051109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782051109, "uuid": "5cc49460-2802-408e-8caf-3432b09aa2df", "comment": "Malware payload", "value": "79a8a09790eb9eef3e9620b596788089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782051109, "uuid": "925d7794-2751-4426-9091-d1bce3a4d065", "comment": "Malware payload", "value": "53cdbce7ef4a497839babe6574569cf65a46ab2b204c0eef3350dfa50cb4a3e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782051109, "uuid": "e2c89467-cb8a-45ed-a4ca-158588055894", "comment": "Malware payload", "value": "bb5402bbd2e883175f96c3729aa5662e47b3f14e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782051109, "uuid": "39f1dc24-b21a-4ea5-a755-e09076791cc8", "comment": "Malware payload", "value": "21b15c0907377a2dd3d8daf3b4586a0514726de0780391e99c0bc28427afad58524f3f8c12bd8079dc1e6af53c82a352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782051109, "uuid": "fefd896c-5bb9-442d-86bd-95f308216451", "value": "T10D08332CCAFAB69FED3E5CF811709632FA3964692D1C34D7ABF868617133009057D58A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782051109, "uuid": "40bb409e-9a87-49b6-8803-444be0e85e2e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782051109, "uuid": "f09a2add-08a7-4243-a997-238b79268c17", "value": "1572864:Nt9IKP0SdMP6YtIheTqowzKYypCPRfYLgRLlPBnU6InslA2GAd7:NUK8SeP6YtCoyKYyuB/5PU6InsDGAd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782051109, "uuid": "283d0a4d-ade3-41ca-9380-e5ed17484479", "value": 77820497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782051109, "uuid": "11946522-a6dd-42c4-bc56-e5f4391f107e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782051109, "uuid": "0097d5b0-dd36-4284-8e90-53cdfeab93ff", "value": "CapCut-Template-Pro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec5470d0-6d20-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782012359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012359, "uuid": "b8a21114-a9f2-48a5-9266-fc15fde498b0", "comment": "Malware payload", "value": "051a0dba4b369231eee96477548f78a7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012359, "uuid": "2bc8b984-408d-4c68-a002-f94294016421", "comment": "Malware payload", "value": "53fc7b523d949b2ba89cd0c054aaf35f61fa72d3e6bb1c315f64b2539eb31bc4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012359, "uuid": "955252fc-b6a5-4ce0-a191-2bbf379f670b", "comment": "Malware payload", "value": "b8e7111de763815c00208810c5b128ad1e912243", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012359, "uuid": "cb555bf0-2ac0-45ed-8b08-1c09b1721bcf", "comment": "Malware payload", "value": "31171249879ecbb3e8cecb151451136b58545f4eb8724945d5199972f921b582fb6c38164fbe60f3087a0a7e72b5910f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012359, "uuid": "a31b2fcf-0b6c-4411-b863-505fec90b6fc", "value": "T1E6136D6526953C25AE99883B5C7F2F0CBDA983E1304491DDBFCA3CF18C15A9CE318B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012359, "uuid": "62cf21e5-897b-431d-a6f4-5c7d2dfe3a38", "value": "768:/r9NyXsZztC+9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:DHusZCco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782012359, "uuid": "6794ebe3-5785-40f2-904b-3b2ba7a7ba1a", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782012359, "uuid": "3f6c9230-9e71-425b-a3bd-2a6a71bec226", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012359, "uuid": "1d019e20-b51b-4180-8c56-7df549138c3b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef78d90-6d9e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782066265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782066265, "uuid": "9c99cf91-11c5-435f-b2df-62e1e6f4ee50", "comment": "Malware payload", "value": "e706734ffda7788ac46420b067d0ba3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782066265, "uuid": "7dcadddd-1b8b-4083-b25c-61eb59717131", "comment": "Malware payload", "value": "545152659a15195ce49904ce00c19921537066b80b691321f7c50f50c9a359af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782066265, "uuid": "07125ecc-f58f-44c0-ab85-0451d6ab427c", "comment": "Malware payload", "value": "45a179deb4cb9914f8359a302eb1c309690c7cad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782066265, "uuid": "bd28d376-130f-48b1-97df-d1d75d513f06", "comment": "Malware payload", "value": "e3697ea3c28a21e04578fb0ca8f303a468f47458fe96a2c3aaafd683cf3a6c72c310db8bd2e4a98f6cfbd80a10cbda9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782066265, "uuid": "e1084147-25c4-47c9-8178-68f34adee52f", "value": "T1B997338D4661F0FCFBDA90BD130ECAAD5A957AFD772144F02CF16188077864E22A9E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782066265, "uuid": "ec873ee6-3cee-435c-8a31-eccdb5d3085e", "value": "db825f9d0679ad49fb427a7618466cb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782066265, "uuid": "114d045c-02ea-4c73-8cae-a37b0fb84fbb", "value": "786432:dkkd2P8Z1ioYsRdTOtqF/QhVNJR1chC95xbW/1vGW1XtdaV:zm8fiBsmA9Qhf1co9PelXXuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782066265, "uuid": "c7a04149-2908-4898-84c2-f32493ff470a", "value": 43217141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782066265, "uuid": "dfcc7a8e-17d1-4d5a-800a-714e6bd41364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782066265, "uuid": "fbfbd7b6-f297-4452-a472-a3610ce0cf90", "value": "azura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76806b32-6d6a-11f1-ae13-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782043944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043944, "uuid": "3e8db18a-6fc8-4c3f-9750-64f5fbe1b015", "comment": "Malware payload (SilentNet)", "value": "868065ae9448e3d2e6a1af009101795a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043944, "uuid": "2f74fd58-ad25-42ba-8b5b-1332c04e0430", "comment": "Malware payload (SilentNet)", "value": "54a62444672de4d11e9a3ebd67289f1afc4401d7f7631ac02e404c7d0ca257ca", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043944, "uuid": "153ac782-f53d-45d1-a89b-0a40a9473b65", "comment": "Malware payload (SilentNet)", "value": "ae0cbd55f27128e1de36690f0a5d385d4deb18a0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043944, "uuid": "6f68b961-4bb5-4987-94a5-c81572200f20", "comment": "Malware payload (SilentNet)", "value": "74005ff208898876f3e80b817f6985ba000a6e25865a8ce1ed9a3d620ca7dae745f6a2298ec12d91b13b7dec62e8b5bc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043944, "uuid": "46eb143f-e0b5-44d2-9a6c-c611704033ec", "value": "T1AD661221DA5D003AF833FB339082B9E174FBEF91520BF06A3A7D154D4855A838B7E956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043944, "uuid": "751fdb1b-c53e-4e12-81df-2a9e7dc92b32", "value": "196608:uyqbondS2mGwoqTJ0FgMgNz7H5wDod6cCtr:u/ondoLoKzBziDsQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782043944, "uuid": "0ac889e6-588a-4230-9ce1-b674584a9fb5", "value": 7013924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782043944, "uuid": "7a2b20f6-a54b-49bc-97ad-efb5d6399499", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043944, "uuid": "99a0859c-78bd-47dd-a72e-af192b29306b", "value": "meteor-client-1.21.11-82.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d1d731-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021936, "uuid": "229a3054-1a2a-4b6e-9af6-9390253fbf1c", "comment": "Malware payload", "value": "e770f20396e23e803af779f2e0f3650f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021936, "uuid": "da5faa97-b1e2-4ea2-8b3f-ff3ab2e45a31", "comment": "Malware payload", "value": "553c7d1b0941f501f8a9a40aa211881b0dde1e388eddb7a1006d07b2de647307", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021936, "uuid": "5d16a1b7-bac2-4dab-ac94-3536069295b7", "comment": "Malware payload", "value": "ce2c39351fa970664ea1680526f17d0202ddd394", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021936, "uuid": "4cfeef12-3e16-4d97-9e40-4100bfc57f35", "comment": "Malware payload", "value": "c7d58c181c74ffd8b805b732e0a8ae4b0d39572c72fc5f254282ec4e829bcd452b5836c07039b969cc1713dfbee1aa00", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021936, "uuid": "b3aa0eb6-3913-441f-9adf-3cb84726140a", "value": "T12966F6C1E991D24AC63D6D31EFE6EFD8E26B2F315C885A4AC9C8F73E18B314580B5560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021936, "uuid": "35bdbbe8-c36c-47eb-ae79-166cc753304c", "value": "49152:1gOQa8PbfGmpt+gy/KxGGJMVXcJPmNakW3bE+8ddgIc4whY73Tvuy+HHDt5Ej:1gOQa8PbfHtOTVsQtEw7t+nDjEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021936, "uuid": "141dde72-9e00-4467-91f4-5793149168d9", "value": 6553748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021936, "uuid": "ff5cc7d9-8d9a-4fff-b0b3-d23b54d0fa9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021936, "uuid": "2c69094c-9a2b-446c-9c73-3a5900bae0b1", "value": "edac_polld", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bafd1b1a-6d4f-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782032463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782032463, "uuid": "5c5d66a8-3c26-417a-a59f-86fbbb4de0e1", "comment": "Malware payload", "value": "574716308fa6311590858118226c974c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782032463, "uuid": "45ded7a4-ce77-460e-9df2-f482ac8ee8fd", "comment": "Malware payload", "value": "57e48ba67040567734000242541a9eeb4c9dafb008bfede2ade8057c3d9754a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782032463, "uuid": "c4e5abb7-2c63-4bd7-97f8-15170893cc8b", "comment": "Malware payload", "value": "02fc44ecfdd8bc5b65e2e95271c5ed2d5e2db482", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782032463, "uuid": "604bf2bd-23d7-40e3-b1c4-a60fffa24125", "comment": "Malware payload", "value": "453e6251907acce41d7e3446da03a6c6727eb9263e2c75dc7cc206c1ec7ebcf1de3ef480c906591c1575a8aa420ba3a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782032463, "uuid": "c730bfcb-cc50-46fc-bf02-3d61120e7669", "value": "T1D747DF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782032463, "uuid": "22e66db0-31f5-4cf1-b0b3-50a7c8c6b168", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ1:cqYUQuVDt0TZEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782032463, "uuid": "3c6f1ad3-70c4-4efe-b263-2afd19045668", "value": 24707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782032463, "uuid": "a7c14095-76d7-496e-b997-0422f99fef55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782032463, "uuid": "ba70afd8-d99e-4655-9f31-2c92ecf1149b", "value": "57e48ba67040567734000242541a9eeb4c9dafb008bfede2ade8057c3d9754a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d9020e-6d4a-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782030092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030092, "uuid": "6a0e953c-1ecc-473d-8076-fb0f032a55b4", "comment": "Malware payload", "value": "c47314dc583ff4f95be4ddfb5dd39f2f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030092, "uuid": "00498bc9-e381-480d-bb37-0a695d234053", "comment": "Malware payload", "value": "5a0bc5c4731aae2c5445ed0cf17aa3a22470496a27d4f330341b5a70645c3c3c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030092, "uuid": "2ea39d9d-b03f-4089-83e5-a12f504d4765", "comment": "Malware payload", "value": "3afe74a59d000cb8cb72ce3cfbf1e588a6fc66cd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030092, "uuid": "49c640bc-6216-4608-a049-07ece5d14ab4", "comment": "Malware payload", "value": "163a4c430484e3f5d08b0b3cda751a43a2456fcb8924bc2498315913092422c0ef26ea76a0c403ef1d98c3c76c0a1e45", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030092, "uuid": "7883b95e-9f09-4234-9b8a-9769a8193a78", "value": "T1CB83D71E7E618FADF7AD823447B78E259358238737E1C685D29CD6002F6034D646FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030092, "uuid": "621afe17-2317-4d91-a611-0735681d8e3d", "value": "1536:avStdbLlg12bDXp39T6j6F/cPy9zy9nD96E2U8ff8Soe7q/OC:avStdKyDN92j6F0SUmf8SG/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782030092, "uuid": "c2f49dc4-9842-4fb3-9875-ca4cd7ff7725", "value": 84532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782030092, "uuid": "68f7a77c-63ba-4f79-ad8c-b8d536ab0d5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030092, "uuid": "fc1db7fa-420d-4cd0-99f2-13f5299e3dfa", "value": "kmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4199c7b-6db9-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782077951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782077951, "uuid": "2e68f9ed-86bf-4a39-86e7-a8913f9652f8", "comment": "Malware payload", "value": "355073b65e37439ec8f33925d21c229b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782077951, "uuid": "51007f57-af67-4fb7-9ec1-98be4bd62cb0", "comment": "Malware payload", "value": "5a7c140bec69c33b8d5cf065040c6239a231091976e1b8725680539ca5910640", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782077951, "uuid": "907d0452-3ef1-465e-83f3-2b595c4a0a4d", "comment": "Malware payload", "value": "2f73b3c67790b65694b39b0810a8f277b0f0c382", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782077951, "uuid": "e3cf6f1c-6531-4f2c-9c24-a9a38bfb859d", "comment": "Malware payload", "value": "5e09d76a832f0d75f88919c16bc3d2b13e5e75d71207069cb6f1f24acfd4c1a7ca1a727774834c25815b98b8d70a2e8e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782077951, "uuid": "ac1d3a91-2699-42e1-b43c-a9855c4a6fa5", "value": "T19E137D6526853C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782077951, "uuid": "17f36bfe-4d2a-4b50-b587-74b41c10a713", "value": "768:aXRWNGxVg9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:mlxnco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782077951, "uuid": "f9c95104-b08f-480c-86c7-8688874f8b2f", "value": 45517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782077951, "uuid": "f52fcca2-120c-4096-9a03-9e334be01178", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782077951, "uuid": "a0e5e211-11b5-4506-9771-af7bbb29649e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6daebefe-6d67-11f1-ae13-42010a9c0009", "comment": "Malware payload (AnyDesk)", "timestamp": 1782042641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782042641, "uuid": "41529655-3d6d-4c27-aa65-f285b8b2a842", "comment": "Malware payload (AnyDesk)", "value": "34651af99f5f8d4334fe37e2c7989e06", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782042641, "uuid": "538961af-8379-4bf3-b359-c8d84c7e44cc", "comment": "Malware payload (AnyDesk)", "value": "5b5434cc8bb3556075c6967d2ffee5a6b33793de07b9d4701bc63d369de63861", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782042641, "uuid": "052180d6-4cec-491e-8af1-9c5a753879f8", "comment": "Malware payload (AnyDesk)", "value": "7c0f669cd06e5ba8fdcdba107b9519fe73519368", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782042641, "uuid": "1806a930-063a-47ed-a52f-7d51afb5a663", "comment": "Malware payload (AnyDesk)", "value": "7948bb393031ef71e980c6722b496ad48b15143608ec43b7c5d3e37b7301e39c5d6a7a411273a29df2b9ba990cf4b093", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782042641, "uuid": "0b80dfbb-6e33-4f05-9ae0-2effa84017dc", "value": "T14417339F11B894D4E43632B39529BF0EAE39BCE915A052CF0B064365F86E94D8D1F633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782042641, "uuid": "43a43d93-9252-4932-ac78-b4286726dfcd", "value": "393216:PX2Vw3ByMNus0YfLBc2pDic8L0KstVadqouPycSLItG/WZm/W9pcYEmV5pTs:/2VwRLNustVv8LbstU89ZFZt9ebmV5p4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782042641, "uuid": "1689d62b-768c-4882-a802-97bd84ff84b1", "value": 18707760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782042641, "uuid": "4ea652d5-13e5-4f40-b73f-6b895abb96f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782042641, "uuid": "f7a2531a-22fb-4afe-876d-de2c690ba0a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c276bfb-6d80-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782053376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053376, "uuid": "e1c308c9-b0a3-40f4-a549-9627eb9ac7f7", "comment": "Malware payload (CoinMiner)", "value": "e0ab61f53c129c7bf71fd5d691c8556d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053376, "uuid": "5b92e169-07b8-4455-b484-693e522defd6", "comment": "Malware payload (CoinMiner)", "value": "5c72bdfe8c816a153926f00cb2c34c21352570e00a43df9e0fab939cd5a3889b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053376, "uuid": "4229ba29-1b08-43fd-91ea-9ac26507e650", "comment": "Malware payload (CoinMiner)", "value": "8f677ecc4912730be9fe34496fe9d3154ed4b733", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053376, "uuid": "207c4d72-de65-4cd3-a254-d5b5dd444c15", "comment": "Malware payload (CoinMiner)", "value": "c73d20d7d4196ee4396f0ab06c0793a970cb57f3ac2fc648898433e74dc18f6bb0bb13867db59c2fece43d5527b312a6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053376, "uuid": "119ce9e5-16c9-43a5-9599-4788f477f791", "value": "T1D4D313452162FDC9F9AF477824BD3192E4123A80F5DA2D8DFB213ECA8595C09B34D36E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053376, "uuid": "ecc679bc-ee17-46c0-8990-394c8111be70", "value": "3072:gDu53z5rFnQHDYPWdKZDmETWKxcTN0LZqO0SDrg:553z5ajOFYEivN0TDrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782053376, "uuid": "a8876608-ad6f-4baa-aaa7-75e472e1d6dd", "value": 140188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782053376, "uuid": "fede72b1-4adf-420e-992d-8908386248e6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053376, "uuid": "3355867b-90fb-418f-bdee-690e3b7ad5f2", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c363f6a3-6d3d-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782024746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024746, "uuid": "c51881b5-ef72-445a-b0c9-ba47c028fa0f", "comment": "Malware payload (Mirai)", "value": "3a9a7ed83477860472f999ca9900ee77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024746, "uuid": "1aad8c55-5511-43cb-8545-be39687d02db", "comment": "Malware payload (Mirai)", "value": "5ceec6be255ee897643a2fcdcc2a1a4eaed020bce43828fcfcab4f137b310100", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024746, "uuid": "dbcfeb5b-8805-4e63-a476-ef71123da29f", "comment": "Malware payload (Mirai)", "value": "b6113a0130e8bb87a4e85a53d92105f3369bfd1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024746, "uuid": "543aa2ac-13db-4834-b4f8-8585dfb134cd", "comment": "Malware payload (Mirai)", "value": "caad08111001287b0d9e8e058618245125180eca895c69289a0c8a3a6e1915c46b069e66e87792f70c7fc71dace92047", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024746, "uuid": "83287c85-4633-4ab0-817d-fb203574b118", "value": "T1EA075B07F9A214E8C1AEC470866B9652BE717C49072177F72B94B6342F37FE06A79B10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024746, "uuid": "03a6ced4-111c-4520-95ed-ddde435c0088", "value": "196608:fLlsxYIqzCvl4lcmDi1WIPFCBNcJ7oEkLsQXX:fQY7zuOqUqFCIkLsQXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782024746, "uuid": "77a67279-c110-47c8-a9b2-67dc631cb08b", "value": 16859298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782024746, "uuid": "6bc2e049-8a09-4f68-b98e-0c8d487f8a96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024746, "uuid": "7c650e7b-8626-40d2-9e86-30ea1d5cee4a", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ee7ace-6db1-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782074302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074302, "uuid": "e368cb6a-d09f-43ff-8cf7-28ff1044106d", "comment": "Malware payload", "value": "432002c05710ec5eff6bcaebd53dcc44", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074302, "uuid": "96d99f1d-99ae-4916-82f2-14567c51cff3", "comment": "Malware payload", "value": "5e0771444dbdd0f4263d10b3918fa0982191b12494d3cf93002a0ab22bc7ab38", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074302, "uuid": "32dbd112-58f6-4084-a0fd-3bb255e32605", "comment": "Malware payload", "value": "cd0055ddb4a30bbca87f2e73b0f1a842cb13a404", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074302, "uuid": "a282256c-abf8-4111-9ccf-f02b1f8cab2e", "comment": "Malware payload", "value": "cbb33e7558057346c2c563aef3c73ecb9cff1abbb4035acc8a6a6290553707b9f26b95d58ed5c328ef399c30304eb504", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782074302, "uuid": "4e67d7f2-91e5-4e34-b7b0-7167d75e091a", "value": "T1200148DB8250AD104029DA5E62E76190B46093CF055A1F787FAC9A3DFB9CE14B037F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782074302, "uuid": "7fe27d38-e457-4cc5-ba93-3e4c047433da", "value": "24:kXCKysE2hi0ziQvZohap8c17/zh95aJZQ7:e9Qp+Msp8s7LoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782074302, "uuid": "ab8a8b38-e3c6-4514-8db5-097b17482f13", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782074302, "uuid": "42c5d35f-8348-4f70-9794-dc96d9b6130f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782074302, "uuid": "cc9198e7-f70b-48b6-a3ef-b48a0d376eb4", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a982a9f3-6d95-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782062498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062498, "uuid": "004aaef2-1809-4fc0-bbdd-a50dfaafd59e", "comment": "Malware payload (Mirai)", "value": "4c0077fe5f8ce74942a55261357ed3ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062498, "uuid": "3e5da92e-c7d6-40de-8899-8cda9655a3ac", "comment": "Malware payload (Mirai)", "value": "60df34593f36a73900830831719ab13c51c7a3ad5f6b6ab057592299d7f9e517", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062498, "uuid": "8010e196-91c5-4cec-a73e-f32535fdd869", "comment": "Malware payload (Mirai)", "value": "3fbdaae1821063d2186ea56397362b3bcccdb2af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062498, "uuid": "1d248f4b-4336-4e95-b124-bffda4cc0cfa", "comment": "Malware payload (Mirai)", "value": "c85c83a8de40748adccb7ca948df3f403e8296e165f756d92644161f60d78d7d92ee4e3d2648be92bf9f15a5d0679857", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062498, "uuid": "f50f6478-36ec-4162-84c2-1ae4ff193896", "value": "T1BC73026027CB7E90C6602B3FCD71488650731B5495EEF355E530462E3BDB50872FEA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062498, "uuid": "a2cd52de-d2ec-4f89-91ab-44ee8b792454", "value": "1536:5QvoSGd/vcmGfLb1HZJIf1Ofs9pwPy2GpiWMV4axCpWzN:wonY336fIfsHOypiWMV/iWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782062498, "uuid": "917fefe6-2ae3-42b3-be16-06d46412ced2", "value": 79664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782062498, "uuid": "7dd19ee2-161a-461c-9f96-3944930ddda3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062498, "uuid": "1273e956-1bac-45fa-aabe-fb66be5f8397", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e2904c-6d23-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782013558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013558, "uuid": "6a147f7d-cae6-40ff-94fd-476b5ad66873", "comment": "Malware payload (Mirai)", "value": "e1891e050b23cc6663b088b4589594aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013558, "uuid": "c85cac9c-1749-4c28-b531-a5316eb80261", "comment": "Malware payload (Mirai)", "value": "638435c64d215a45049ed971cfab7c995396d0c269bc54f02f8f18d62988c916", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013558, "uuid": "c3cfbcb7-8dbb-4b02-86d7-541b7206e7da", "comment": "Malware payload (Mirai)", "value": "f82a7a8de7f0ca92219e8ff4cd2e1fed6830f7c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013558, "uuid": "a25c74f8-5666-4b59-82a0-2991480c5748", "comment": "Malware payload (Mirai)", "value": "2ee60c2af457bbbf66ff5a91c1f302e266a836f00012e2dfdd3017d0be61130913550501f568081e0dc7f20c24a887ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013558, "uuid": "530e4cde-025f-43a8-a511-7e00f702db03", "value": "T1158312AE5500A3BCE9C4C07B3E3ADB513F66E75AE03186438945BF12A7B43BAB4471D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013558, "uuid": "19c31e9c-5786-4cc1-916e-3bb1f72f3d99", "value": "1536:WVkTgJ9e0vAaAP5F/7MnJC1zftm7kBOj95SuhIs2KT0R088JNtivx93v47zKtQ0L:mQnYnMJBAosl2KTkSivL/A6Q03VQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782013558, "uuid": "1a46ad39-8453-4a0a-abb6-74b063003e7a", "value": 87500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782013558, "uuid": "4fcc7214-5145-485c-9636-1450d4141408", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013558, "uuid": "5865b6d8-d76a-45d5-863e-e3eed3e7405a", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff089b55-6d92-11f1-ae13-42010a9c0009", "comment": "Malware payload (RapidStealer)", "timestamp": 1782061353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061353, "uuid": "7fc7976d-16ff-4ea4-9c1b-d1d2076dc616", "comment": "Malware payload (RapidStealer)", "value": "9136b4d4ca6bd5f6d57a024586c44f53", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061353, "uuid": "b1a56f36-d14c-4328-a198-f1f9844133b4", "comment": "Malware payload (RapidStealer)", "value": "65ae4d83335bd235d3f60beecf534bff614b3285f52d484eea299d6d70d91af5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061353, "uuid": "1c01a675-0af4-4036-8bc6-1b779d3d771f", "comment": "Malware payload (RapidStealer)", "value": "cf9ed9448bb2c21cb630f7ec7409dd6ab5c7438b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061353, "uuid": "c4996032-cc01-4eed-94aa-c8b21530d259", "comment": "Malware payload (RapidStealer)", "value": "bd8559befa49d6c1735b7cb6245bda5d61bd48dbae913cc855637fb2f176b76667c9d6277ace7f837e0234ab3149a01a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061353, "uuid": "9aa527dc-9743-4c1d-9137-f612e0bf6db5", "value": "T1F8671214E137BE60FC4F913961310043F4B0AF72994CB0DE75B666767ECE8A66D09A3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061353, "uuid": "2562c736-f909-4cbf-ae75-81e8542bf916", "value": "393216:VBE47FYOGuVe6jW9qDNMHaRCcRSUoKGuVe6jW9qDNxHaJ/8kn050tE:VBEwFbHdNOaRCcoUfHdNlaJjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782061353, "uuid": "4a18dc81-b23b-41ca-b290-450e312502aa", "value": 29826871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782061353, "uuid": "e3077624-f935-491c-a1fd-495bb8942f74", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061353, "uuid": "b69fc769-1e7a-48fa-acb5-7500e8e420b5", "value": "client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060f040d-6d21-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782012402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012402, "uuid": "bfc239fa-adcc-480a-859f-c3b1a854b5d0", "comment": "Malware payload (Mirai)", "value": "2db83517f67d531fda696f5c98988692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012402, "uuid": "831ddcf4-1458-420e-ab23-07f5eb78a15a", "comment": "Malware payload (Mirai)", "value": "66c1170a087bcb0bfaeb25d96e037b502b64a15b5cfbbaa38d2a4d53f429d773", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012402, "uuid": "b9932963-61b6-4cc2-9e99-038d8ded3192", "comment": "Malware payload (Mirai)", "value": "43da0b4a1e41f97acaac225abe4393271095990e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012402, "uuid": "247d2125-f894-4e04-8654-e0014c4130f7", "comment": "Malware payload (Mirai)", "value": "50d85430d48cb206f391708ee5fb3f0bfce21c6944986a13de49429a39cfdd16f9adf8f2661e97aa0d5a2b1f6ff13877", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012402, "uuid": "141c368f-3779-4033-ab59-b5ab527c1ebb", "value": "T182B32A41BC82565AC2D1637ABA6E5A8C336613F8C3DF3126CD158F25378A92F0E77B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012402, "uuid": "288141fc-d52d-4e08-894d-f12f9588344f", "value": "3072:iZxlwffMG4k+u7QLtn+apEXxbF5bJ/6laqmG8:iZxktkoQLmxbFb/pqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782012402, "uuid": "b734d15f-7695-43a2-ae06-1fa208635bd1", "value": 109644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782012402, "uuid": "d2e1f29e-f803-4907-a6a1-422536c4361e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012402, "uuid": "4f33a0ba-3183-4561-91b8-974d247c742a", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdce07c-6d56-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782035258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035258, "uuid": "88e4cef8-7cba-4a95-a58b-f33796ff366d", "comment": "Malware payload", "value": "d54b4e66f795452852e8891afc81d4e7", "object_relation": "md5", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035258, "uuid": "abbe2d08-afd0-4526-b948-c73a01049b22", "comment": "Malware payload", "value": "682d29d3a9b484ca17caa23022b1d04643b46470ad94e5f8184a650527a70f6f", "object_relation": "sha256", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035258, "uuid": "e9d2cd89-2718-4447-ac6e-7ab7a303f22d", "comment": "Malware payload", "value": "7936969c204907cd28299090e703281bde4acfbd", "object_relation": "sha1", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035258, "uuid": "689b406a-34c0-4643-9737-330869533b12", "comment": "Malware payload", "value": "b12207a340867762d3854b51cde88a8895d57e7675ee1586e530a16cdc61361950680310aa196f227c7d9540d69431fe", "object_relation": "sha3-384", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782035258, "uuid": "eaa47a1d-c521-4ebe-bc53-b710a1d6a814", "value": "T1D7017AD4A667E501FD36C1B58B61DDF818C132317E5836EFA47555322C15E81BD1C242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782035258, "uuid": "352a2036-1999-4d03-91a3-3e1334ef25f4", "value": "12:5js29JAhj3pw3VTqixsNbUTafR9CcOtq+j3zxU0GoNYqaPfxz78jlKuK12uVtaj:9PU13QTT/Ts9Cd8w39U0GooxEKuK8uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782035258, "uuid": "4d3b8ada-a374-4864-ab8a-a40bf849ff07", "value": 837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782035258, "uuid": "817388cf-6d62-44e8-973b-402fe294c09a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782035258, "uuid": "69acb1db-bc96-427a-892c-84ef13ec3a4f", "value": "sleestak_payload_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3455ae3-6d4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782032020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782032020, "uuid": "5e47ae1c-06a2-4883-aec7-a6023159cdd7", "comment": "Malware payload (Mirai)", "value": "b4e97af863eb5db6e0d95ff67e5fed43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782032020, "uuid": "2a746c51-545b-4466-a32c-7f6b1fcbe071", "comment": "Malware payload (Mirai)", "value": "6a05487baf63509da9f48302827bdf5b5c239fb1018a42ab6a37b18b0bf100a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782032020, "uuid": "90d24677-62a8-41b4-9615-ff253d34e3b0", "comment": "Malware payload (Mirai)", "value": "cbd4e6600e3e486d7e69b2e0332acfd3ed73cc9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782032020, "uuid": "0b82aebe-45cb-45d2-8039-4906dee4f148", "comment": "Malware payload (Mirai)", "value": "748845cdcd564df4ff63a93cbd3a4f7cfccc106d32160949c0bd8b745fab1b549cc6e1201cd07e2f9a570853abaaf5d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782032020, "uuid": "6fc22b88-2340-4ab8-a88a-ca06eced9e7e", "value": "T187074A47F9A214E8C0AEC43486679653BE717C88072177F72B94B6342F76FE06A79B10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782032020, "uuid": "b9a510be-1eb6-4425-9ce6-95113beb5837", "value": "196608:BgT3Hb8RHkVl4lcmDi1WIPFCBNcJ7oEkLsQXX:BSb0kTOqUqFCIkLsQXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782032020, "uuid": "b7723670-2f67-4256-8dfd-f403a8977805", "value": 16859298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782032020, "uuid": "efd3cc56-44b7-463c-9667-1001a53bd995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782032020, "uuid": "c75672dd-8082-4a36-be22-093f9a897144", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e07be7b-6d88-11f1-ae13-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782056869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782056869, "uuid": "76187c19-3cbb-490e-bcac-b9e7059e454f", "comment": "Malware payload (AsyncRAT)", "value": "1e3c5aa594c8beaefb73e35b563379d7", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782056869, "uuid": "397fb270-a704-489c-999f-338450fa1154", "comment": "Malware payload (AsyncRAT)", "value": "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782056869, "uuid": "22626dea-225d-4e49-a96a-46352b56d709", "comment": "Malware payload (AsyncRAT)", "value": "5f8e51e3cbc4530d86c2ee6cf77ccaf77e7189a2", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782056869, "uuid": "e374b038-916f-451f-8888-e28199ad1385", "comment": "Malware payload (AsyncRAT)", "value": "58c13dbdef96be845294446e8c46e28688e256176f801add984cb79ed1d82570e444ef2d3d28518ec2706852fb87f37c", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782056869, "uuid": "c655ea61-1dc9-4a86-9ac6-0c9ca125caa9", "value": "T15C57345CA490A7A09BC2759313DFE4CC6F903E91409C897B3CF746EB43666B4E86B364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782056869, "uuid": "7dcd5d23-2a78-47d9-b86a-393713673a28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782056869, "uuid": "9e7ad8af-ee82-4014-9a8c-8daa00c9bc6a", "value": "393216:YoSBaQl1q1Y0kUBNQ1B4BoC6fcRMenFe/s9ojyhRV5eICqDVkms9o83QcmcrS:PSH1UYwPScMwYJmhR/A4kmwtmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782056869, "uuid": "1949ceb9-6348-4baf-93b4-856f572b847f", "value": 28895232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782056869, "uuid": "8e97a3ec-85f7-40d2-8065-92036da04985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782056869, "uuid": "98f62835-277c-468d-8f46-04e5ba33339d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c13b30-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021938, "uuid": "320d801d-921e-4791-b67a-14189007a44c", "comment": "Malware payload", "value": "94576492ffd2646f2c7775753285d865", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021938, "uuid": "7cfb3ca8-6724-4684-b1b1-8092688cfae0", "comment": "Malware payload", "value": "6d723dc5f9de2c9b9ac4b1ca62b51c1e68a72eb2544e092bd16eb7e89e28a823", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021938, "uuid": "d918e7b8-8709-4eb2-9045-f75d6f3689aa", "comment": "Malware payload", "value": "50a2b3619c432164cbff80569c10f06037390856", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021938, "uuid": "217d0a06-a4d5-4967-9edd-04016e8b9d0c", "comment": "Malware payload", "value": "310626e68bfc8aaaa06f0e3512b4010ff9693e0ec93dd5d0b1cdf09501f5305b928a8a298dd5fc3515a354891c1105ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021938, "uuid": "7e1bea65-8993-4243-bfa4-c4a4960f1006", "value": "T1668533DC04B8A3BF5881E8693D4DA02F3A50BCD1430EF17F59FBD155A8B93A4A159EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021938, "uuid": "c0fd4caa-68fe-44fc-b49d-e7e2f79d6c21", "value": "49152:5lhUZBpccbIHNhnPduiYK81NBlD8x75CnlkYWYGu/CJ:zhUZBpxuvP/OnD8xFCWdYhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021938, "uuid": "57b34b0c-6ccf-4bd4-9e4b-dc39e3c7a09b", "value": 1857332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021938, "uuid": "2f1eec95-ae9a-4582-8cc9-090fa49fad83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021938, "uuid": "a3ebec55-6298-4435-a818-3ba1eaa041e9", "value": "ksoftirqd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb9a53e-6d85-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782055476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055476, "uuid": "7b458fb2-41e9-459d-9541-f47b27d058b1", "comment": "Malware payload (CoinMiner)", "value": "cf16a82b969204392cc11eb249da57c1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055476, "uuid": "f5651c09-ae2c-44c6-a4d2-9097aeba44b1", "comment": "Malware payload (CoinMiner)", "value": "6e0593be7fe7b6a0789e78610de47a3c76c49bf39e66feaeb6c3169390bc1b91", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055476, "uuid": "784fb94a-d1fb-46d2-941e-34ef78dd6d8c", "comment": "Malware payload (CoinMiner)", "value": "b46720fa28a0d70cbc6bd9746f61b34d35dc2f58", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055476, "uuid": "0dfcc79f-0920-4c99-8e7d-c5a63ec01e7e", "comment": "Malware payload (CoinMiner)", "value": "4c2de1a88764b3f06030ec714734c9044a721a3cb92391e19a3d13649777d27cd9fc2ae9d8ab9571070a94c8076e8744", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055476, "uuid": "10c27354-7089-477a-80f4-1d3cf81af84f", "value": "T1023418A5BC40DB62C6D427BAFB5D829933134F74C3DE3506CC241F2976EA55F0A3A682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055476, "uuid": "2c77d207-64c2-443a-aa7d-e1b00e3073fb", "value": "6144:EiLiCwf8+wOqoGq0e7s8aMJBD77ZdqXpLSkkOM:9LiCwfvGq0ejJB7ZQ1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782055476, "uuid": "115b823f-3f48-480e-b310-142d27b2d0f2", "value": 243552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782055476, "uuid": "abac931e-372d-4d70-abdd-f73ccba046bb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055476, "uuid": "cb712aa8-5fa4-45bf-b382-fd9ae0112900", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba0f9c6-6d22-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782012895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012895, "uuid": "e26aeedf-ba9f-4fb7-8ff6-56b83118dafd", "comment": "Malware payload", "value": "a3885bc122e9bcd272f9347b33c3f039", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012895, "uuid": "70ce49c0-f82b-4d68-98e9-2ea99adf22cf", "comment": "Malware payload", "value": "703f9dc09a2733589edbcf06c5803162a6f09b3270e8da96eed069103dde1372", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012895, "uuid": "5d9b78c3-40c3-4351-8b70-20d5f76bfc26", "comment": "Malware payload", "value": "d7e62b3c2eb9b60b98a769d16ed965cd90b24b8c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012895, "uuid": "9e599997-e988-449a-b3b9-5cb167431b16", "comment": "Malware payload", "value": "edf60ff15bc7ebe9fb2212d6e5c5c5dae4fe5ad29bf6f83a9b2aeebf5ba964d5cc4d21a3e7b037abf5ecd5e7be471b87", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012895, "uuid": "6cc27abd-4305-42e5-b86b-5f1f23b3cf91", "value": "T178018CCA49806910405EEA5D36D75290B810D38E058B0BB87F9C592DFB8C808F166F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012895, "uuid": "6ddef84c-39b7-4954-9def-c5cef7313357", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkauXCqxjhjXCygzjDCPLnCMg2COLrUauD:kXCKysE2hi0ziQvZohamhR/WPOnd9Jk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782012895, "uuid": "73cba83b-f8cf-4f0a-aa8d-c415c2903278", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782012895, "uuid": "4dff31c1-1922-4bd4-9dea-ac1872c70ad0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012895, "uuid": "608317dd-3664-4005-915a-8840a85b08d0", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d951de-6d5c-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782038152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038152, "uuid": "301834f4-e675-479f-ba81-d46ecf88f26d", "comment": "Malware payload", "value": "18ada948f636f83d3d109e7821ca0583", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038152, "uuid": "d98e4f71-cfbb-4384-b41a-d833063edc13", "comment": "Malware payload", "value": "70c8c4f63455ca66b3ec8113a954122a3b31267b6841c43ce163e53b5720b04a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038152, "uuid": "6b16692e-545c-47b0-9e81-602131b72ef4", "comment": "Malware payload", "value": "a8ebd8d722fc5ea29b0688c098898d435e4fd427", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038152, "uuid": "0c367dc6-e95e-4f22-b4ff-a1aedfd343ef", "comment": "Malware payload", "value": "786f5fe2ac7b48b0cc51b2d46497aefed19439020358a9f41f11e1368d627b72d2cdf9046daf9e2747935c847761ce7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038152, "uuid": "d9295328-ba15-4fcb-824c-9aa800faa6ac", "value": "T131D44B02BF405EEBC0AFCD30492EC21B11DDD9D752D1A72A71FC4A9DBA6D25A0BD3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038152, "uuid": "53ca4051-4607-42d1-acff-0f6f5017652b", "value": "12288:3P25y9mIqJafoSDLkvSkN0fFapRGBK1Iv9Jntq7uZHTLVKoa76hgOGkxgACKrbdl:IM3rxtTXKmFv8HE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782038152, "uuid": "aba58502-7737-4cbc-a4cc-971052ab89de", "value": 653652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782038152, "uuid": "983e5188-bfd4-4fb8-ac7a-ed7e9d38131c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038152, "uuid": "f6c8ab24-841a-406a-b391-578c7fa4d3ae", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1dac326-6da6-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782069814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069814, "uuid": "817d3b02-f02a-4336-a368-6f976042f440", "comment": "Malware payload", "value": "98f87316ef6342dcf270101dd94f7270", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069814, "uuid": "98ff3174-1e02-45bb-9a0a-65db4875e734", "comment": "Malware payload", "value": "7336c10b64f1533ba21a2884e2724e5e9e7d9a177b2b3425bf6fd94d593edca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069814, "uuid": "0c482152-668a-4e8a-845b-dedbd5d65812", "comment": "Malware payload", "value": "a2139fb5a7436e9475be296a6499d482f8b41fa6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069814, "uuid": "d1c62ee4-a1df-4baf-8437-963262e944fb", "comment": "Malware payload", "value": "4176d9325da5b423930527cdbde20636ed7c64201fc62273261e77e929583e18bea335e651b827d7da87b945179cad61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069814, "uuid": "f8eeca36-7e52-4593-a07f-c428ab1e12e1", "value": "T11EA43A52FD419B96C6D12ABFFF6D8288331317B8E2DE7112DD194B2063DB85A0E7B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069814, "uuid": "30d0e8ff-b42d-4894-8cfd-065b17ab8b27", "value": "12288:fGaNnrmVuP0GwhyUJeDz12gliYLBSnkSUaF1r4eKo7S2Bqe:+aNnjPOm1d3L3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782069814, "uuid": "8b54d6fb-6127-4fec-bbfc-ff2dbdf48b48", "value": 490112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782069814, "uuid": "d627e0fd-9138-4394-b4f4-039422bbe691", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069814, "uuid": "4a383ab5-620f-436b-9f83-1cee76ccf3f7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caacd222-6d11-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782005860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005860, "uuid": "e4125a37-a386-4cdf-9684-5b89781c0bcd", "comment": "Malware payload (Mirai)", "value": "35a294f5ee39f0f33aaa443de52618d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005860, "uuid": "35627cb4-1e3c-4996-87cf-6a78a9a927f1", "comment": "Malware payload (Mirai)", "value": "739bdfcff9752f649c0e2faf3d354959b7a0d511e62a9836c97e2e8e60f623cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005860, "uuid": "7eb8dec5-a82c-476d-bd9c-e78818be4897", "comment": "Malware payload (Mirai)", "value": "5d889298e553246a114553e498f8fcccb0aba315", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005860, "uuid": "54782cfe-f5c8-4d86-9010-359d799b0e33", "comment": "Malware payload (Mirai)", "value": "901badd07e91ad564a17e4c6270c4256716d27003792a669c00bfadccfbd112c9215b3f6fe30da52a801943c5b8a45d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005860, "uuid": "3585560d-857e-48a3-874c-9d14845dbd57", "value": "T1BA14B60E2F228F7DFA78873547B75E24A75C23D626E1D685D1ACD2112E2024E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005860, "uuid": "7c5c0872-4588-41be-b898-ee9a886b17cf", "value": "3072:s6A8mmifLI7H3QfJWvl9h8PHmNew6xnJQYIS9ed:bA8m/fLI7H3Qfkv+fYL6xeYv9ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782005860, "uuid": "28f862be-bafb-4793-ab6d-2286d8fd8390", "value": 197732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782005860, "uuid": "9d66d37f-13c0-4dc6-9f5d-979cfea7beae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005860, "uuid": "2e6a19e8-9769-43c2-b985-efae74358013", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2433b6d7-6d80-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782053255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053255, "uuid": "6284b589-8189-4aba-a947-5894214137c5", "comment": "Malware payload (CoinMiner)", "value": "eda8b66cfe7971b27e97921928a1793d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053255, "uuid": "2b317fcc-9ab7-48da-8197-8b41eeab9668", "comment": "Malware payload (CoinMiner)", "value": "745b2d3cd229fe218a8869e80100fe60c16ecc788c68a6d093a86291c63ac0cd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053255, "uuid": "73fceb0c-082a-47d4-955c-42a87faf7053", "comment": "Malware payload (CoinMiner)", "value": "c8efb24eae4cd482886f0c81e1ad110647a44de7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053255, "uuid": "e29f36fc-1f25-4865-91d8-69f5cb512c3f", "comment": "Malware payload (CoinMiner)", "value": "32b683a4ec264dc0db1b8fefaeaf7d6db02ea3322623107874202e0bc648182d6247a07c107220e0a40b697626f79b13", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053255, "uuid": "cbd029fb-f0ac-4ade-a418-42b780399f56", "value": "T122A302527D4DDC14D4902D726E4FA70C02A1AEF8E22D3E196A07E6307ADCD196974ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053255, "uuid": "06aafe42-4a66-44c4-bab0-fbce8a56e444", "value": "3072:fq7F1/ZsLvWqXlPkcKRdXw3RXGzRmoy6z0OzYJdzV:fqp1CLvWqXlccKbXw35Mmm0OzYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782053255, "uuid": "3d3a1dc2-44a1-475e-b854-692b13bedd93", "value": 107268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782053255, "uuid": "dabcd0a3-a205-4089-bef1-bd55b2dbec60", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053255, "uuid": "ee60c300-19bc-4aeb-84f3-43706f8ff8a9", "value": "kworkerd-irq-bal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca23e3d7-6d84-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782055251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055251, "uuid": "1dc8c068-9ce2-4d38-8a73-0d5c20bdbad4", "comment": "Malware payload (CoinMiner)", "value": "a3c4bfe9e60d96744898f7216ac961e2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055251, "uuid": "444e5426-66b4-41d0-944f-af1e6c48dc62", "comment": "Malware payload (CoinMiner)", "value": "74f5df72efa6a4e3e19363f5aa04a2ffb37d86499df7055d1414953ea684f618", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055251, "uuid": "05a7adb0-71b0-4e5b-82cc-52d61d0c7eeb", "comment": "Malware payload (CoinMiner)", "value": "73af120035b14b35ac432d56199b2ea4a71db88b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055251, "uuid": "54a6c0c3-6009-4eb4-ad76-555bd0337643", "comment": "Malware payload (CoinMiner)", "value": "242fc7a70a17ea02f3b7fe23d0288dd9f3b006bd602cebaf7a7ad85b973d4b78c19cd9e53f4658cf1915312bb272f3c8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055251, "uuid": "da41e5c7-c5dc-458f-8778-60a540430e41", "value": "T1D4645B02FF441E13C5411FB05D7B07B6E3AD48926CA9E13D9E0A7F2506B28B9A5CF789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055251, "uuid": "33eb94f4-e0a7-4ecd-aab0-b5b68888f1dd", "value": "6144:SSAkbkVI06XG3d7NrJrV2GaCeh13f6JJN2sukGO4YbCFiGJOlcBX:Q1aCKGf0FlAlc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782055251, "uuid": "a20359b1-7836-4465-8acb-93db5a584fcd", "value": 329176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782055251, "uuid": "c7abe4c9-4827-4a92-9099-2e9ec3a05eaa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055251, "uuid": "bcb93fb7-72c6-4d70-9307-705e07209d2d", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4056d0-6d7b-11f1-ae13-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1782051150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782051150, "uuid": "674e5ad4-5747-4239-bf61-0e7ec9423aa4", "comment": "Malware payload (MassLogger)", "value": "0fde1288ef288731aef0855b08be049a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782051150, "uuid": "abbb9afe-b1f4-49ca-b0e1-d3983b46a51c", "comment": "Malware payload (MassLogger)", "value": "76771c0cfe10218fc1e8ba4ad2adfde996e1f5fd4b9987294da57e5b2a496e50", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782051150, "uuid": "8ad73004-d02d-48e2-b806-8717d25ce9e7", "comment": "Malware payload (MassLogger)", "value": "827749fd69bc733ab31a00d2376f5fcdcf58968d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782051150, "uuid": "fca5f298-0677-4710-a7bf-0f7a75a321e4", "comment": "Malware payload (MassLogger)", "value": "c48a9387ba8b13c67b0478e7e6d5477fd9506c30de49272c617816b39c1c89f42a1742824e8036b5434de3417fb43f6b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782051150, "uuid": "28eb4886-bc8a-46da-9b0b-0dfe667636d7", "value": "T1A8863734C5ACE41AF6FAF4FA5F865300DF318ED45A2CE40A37C6930EA409959D9EB24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782051150, "uuid": "2a6e8310-75c2-49d1-b0ab-9c77cd06f680", "value": "3072:m8MLTZMDDcC2nyrQEyRd6osa/YhAYkb+SE88HQwzounh2w4mix8EoRsrRAc2xJZ1:E44C2GuR4kgC96RReKBsjoDWuinC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782051150, "uuid": "958c4937-659b-4659-88b4-989c35e38a29", "value": 8122362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782051150, "uuid": "10f0b861-5087-4252-b5bd-2a4518cfba74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782051150, "uuid": "aeddb891-04bb-4d0f-84c0-06ded7fcae2e", "value": "RFQ-MRF-889-MHS-TLQ-520 # 2600260001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268dd0a6-6d1b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782009880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009880, "uuid": "2d073928-5cdc-4228-90c0-9897d088df47", "comment": "Malware payload (Mirai)", "value": "3c5138ddf7d920de2e5d502a18fa96ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009880, "uuid": "1a2400df-0642-400b-8a98-d23465d47e4e", "comment": "Malware payload (Mirai)", "value": "7709fc6792216e705c6ae37c3e87c906fa76ba19718b336da9ea0ad6721b9422", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009880, "uuid": "262bb8aa-f46f-4d76-9433-d87973ef401e", "comment": "Malware payload (Mirai)", "value": "d9971a78a2af5d003e9f942d6555faa1de346a96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009880, "uuid": "fa244110-a875-4a3a-bfda-8fe5d095cf15", "comment": "Malware payload (Mirai)", "value": "b4a5e2f60e41b721964bd50afbf8f610320116a2d2b79181594d3e87de50b4e6c702b8b7dbca1e28a11e34de7cab272b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009880, "uuid": "bf696940-499f-4cb3-846e-1d9323c40cdf", "value": "T169241945FC919E13C6D522BBFA5E428D372A13A8D2EE3103DD125F24378A96F0E77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009880, "uuid": "b1f11643-8e35-49a7-a696-9c625ccabd70", "value": "6144:nQ9ngWm89fxhTr3GKPPuT4y8dBD/usx7D:Cnjm89fxhTrWsuT499PD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782009880, "uuid": "82dc1772-c458-4e28-8f6b-e3448d12b599", "value": 211040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782009880, "uuid": "f6cc279e-1136-4eef-89e2-a0be30f740d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009880, "uuid": "c8c39ed5-7c9c-4a0a-93fb-0aada7a25027", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f443c96b-6d5c-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782038142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038142, "uuid": "8f9b7445-3642-46b5-8dde-0e494c969f53", "comment": "Malware payload (Mirai)", "value": "1c5cf3155dc9518bb9a1e97d2ecbecdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038142, "uuid": "c1e65440-1ce1-45fa-abff-308546db1c05", "comment": "Malware payload (Mirai)", "value": "7aa2ae501f1572e5957be77dc5d35a580a2697512b80fc39f6c1795463910626", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038142, "uuid": "828e0270-623a-4243-94c7-f0cf7e3faf38", "comment": "Malware payload (Mirai)", "value": "395c56a7e3bc657747bd9ccbe4fccf496ed23203", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038142, "uuid": "192c7ae7-ea82-40b4-ad0e-2345c724c505", "comment": "Malware payload (Mirai)", "value": "e2bc4597516a2ee65749e83225156706e2f6c4b45779781941bd9bfb2dadad9a8203078f84a163b4b5bfa51d6a30405e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038142, "uuid": "86515f03-c19b-4e18-87ce-29cda4b74a3f", "value": "T1CFB43955F8809F61C6D539B6F74D82A873074B79D3EBB2069A154B303BE786B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038142, "uuid": "6d7d99f5-e356-49c1-92f3-68258709f749", "value": "12288:xyX3a5JbN6t1N41qqHLC4VuTl2UAtvTECBnN58prPxT1:Ana5Jbjq8LzcTIUAx0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782038142, "uuid": "f98638f3-3022-4d34-9887-6877f616f882", "value": 522564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782038142, "uuid": "b22a6132-7b20-4792-8858-fd624dfcb734", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038142, "uuid": "d25ba458-db44-4dfb-b499-a3892d9544bf", "value": "bot.armv4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c24c77e-6db2-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782074797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074797, "uuid": "887a8ebf-7428-43c2-9ac8-d62e317a7214", "comment": "Malware payload (Mirai)", "value": "cc23dd189e3bd02a01ae4b7f40c671b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074797, "uuid": "5a69cc21-efed-4389-a57d-7157c02ed463", "comment": "Malware payload (Mirai)", "value": "7ec7b47e370811f8b4188b220bb68d4d4e659d200013b654d0c2b36a37422d89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074797, "uuid": "367550bd-7179-40d6-a13a-6b721e1e8792", "comment": "Malware payload (Mirai)", "value": "1356e1d7a01a5e2da8d357e30f455c3a65c9aecd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782074797, "uuid": "5ee7112d-d8e7-44dc-a74c-514911519c05", "comment": "Malware payload (Mirai)", "value": "b5c1758907d7ce5e43a84539615471c3682918bc849f68f17b5347971c5ae2fa646af70e17e630deff18309776bf37a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782074797, "uuid": "e47d533b-2921-44c5-bcbf-4a97106d63d2", "value": "T149B32941FC82565AC6D5637BBA6E568C336A13F8C3EB3116DD118B24378A92F0E77B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782074797, "uuid": "22c27d3e-8377-4686-a264-7575c2b2d35b", "value": "3072:eZxWgf6gZXksuuGqZnpx3hUzybpLrp/6LYWoh5:eZxLvDuxqlIybpR/pWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782074797, "uuid": "b8d9856d-4078-49ba-8f3a-0ca6f0b0629a", "value": 110060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782074797, "uuid": "5b8930b6-7567-49b8-b5cd-c912644b2772", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782074797, "uuid": "911f4961-40fb-4646-b3c3-0ac096197fbd", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967f2293-6d4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782031543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782031543, "uuid": "c0f4a5b4-3347-4ec0-977d-f714955e593e", "comment": "Malware payload (Mirai)", "value": "f20fb68806b32a13d999c5052b93f0e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782031543, "uuid": "a89e350b-438b-478c-9ef5-fa7f3d74bb4f", "comment": "Malware payload (Mirai)", "value": "8235816f709e06a15b65b0843704080c3066fa5645f686540905280cfa9d3ce1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782031543, "uuid": "7e65c700-aa8f-419a-be2a-2ff5c701f574", "comment": "Malware payload (Mirai)", "value": "dd92f75eb183dc0eb3a70050f8e0536039c39467", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782031543, "uuid": "1bbbe984-2b32-40f8-88e4-7388d73af4cb", "comment": "Malware payload (Mirai)", "value": "e289b6d8d7c3563e8c6fcc8643e0626a98e4782040e721a090ed17ee337203cdd272b7f94293fb486200d31619be2cda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782031543, "uuid": "0114c853-2e5b-45aa-becf-dbef75de456d", "value": "T152074A47F9A214E8C0AEC434866B9653BE707C49072177F72B94A6342F77FE06A79B10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782031543, "uuid": "33cbee79-14e4-40c2-9062-42d769b9a62d", "value": "196608:3SPRkMlPM2Yl4lcmDi1WIPFCBNcJ7oEkLsQXX:3+e2AOqUqFCIkLsQXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782031543, "uuid": "67eb3808-1011-4b4a-a8ac-1dea317a996d", "value": 16859298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782031543, "uuid": "d29cebe1-0df0-46e5-93e7-bbe6599189ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782031543, "uuid": "f0a516fb-a7e6-477f-8972-7d46ab5acc37", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7f1c1a-6d1c-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782010479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010479, "uuid": "cea15c2e-8cf6-4660-ad2e-66000d40f158", "comment": "Malware payload (Mirai)", "value": "058cd3d56f9ee4862c9e1ebc116ad5a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010479, "uuid": "24231382-2ec1-4956-8e67-621d08cb9a2c", "comment": "Malware payload (Mirai)", "value": "84426a1579fec3c6fd93b984a3437f9c5be3906e1702175a11092e6882590f02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010479, "uuid": "6ee15152-7ce0-4cf3-8a74-004773ee3f7c", "comment": "Malware payload (Mirai)", "value": "5ffb3a8982655bffdfccb7895cecc6c99c4b621e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010479, "uuid": "16523f0b-3494-4769-9930-177cc9c3eff7", "comment": "Malware payload (Mirai)", "value": "24c74db6b08dd52ca2b41eefbe90c4dc3f4ad0561e0aeee176aab1fda75aa40d93e8e514575d8d6d5f327cdfdb54a836", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010479, "uuid": "daa25c78-3f77-41fd-8908-28a09e0f56e4", "value": "T151F38D81F747D5F1E81B45B020A7E7368B72E53A103BEE42DB689D36EC92601D61B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010479, "uuid": "33b26023-5250-4a71-80a3-08ff2085ecd4", "value": "3072:sSoChb8YQhXpQTOlkUljnh+Khhhx+laqlhR400XrdsULalxPNjkEW1GxEQh:sSoChb8YQhXpQYRljkKhXx+laqlhexmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782010479, "uuid": "1d00f044-58ca-48d5-b31a-5e40830c0167", "value": 160968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782010479, "uuid": "ef4465ef-280b-4eef-99f8-68161b0614e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010479, "uuid": "028672da-0037-47b7-986a-696871842062", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a20b30e-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021939, "uuid": "90b9c572-3a7f-43f2-b08c-a06ba1c90290", "comment": "Malware payload", "value": "3e97ad183c44be321d84407fa4b8f62c", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021939, "uuid": "90b85fc4-936a-4006-b587-677960e8f3ca", "comment": "Malware payload", "value": "845ade32207c427b414b345b06d31944cd02457b632c78c43e31a031f30cc20a", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021939, "uuid": "b9128c57-61f9-47f1-961f-e626757fb8c2", "comment": "Malware payload", "value": "fae5d08121e60fe0359e84596775bf62d02f2533", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021939, "uuid": "41520144-509a-4f3f-89b5-8be02bb1e7f6", "comment": "Malware payload", "value": "04f312d82e24f89a32822217dc1f7f9ddc01c6abf116d693e665e643afc12bd97673cb4e294f6ed68beb3912fe9bfabd", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021939, "uuid": "3601cd73-e1ee-4c19-8d64-23463b2b739c", "value": "T119753339F11E57D2ED46B3FC929DA3983FFA8C0661EBD187851596304602233B387A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021939, "uuid": "0b05d8a9-448d-4437-af93-eceecc7a586e", "value": "49152:RW1Gm3TUw3AqOOtXAg7T9W6STda6dhfebg/WPr8Qm2:Rn/ZQN7TY6EdZdVFSrNm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021939, "uuid": "a5ee356b-f65e-4a4a-85fd-a3ca7e480c02", "value": 1689072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021939, "uuid": "05e6b5d6-38f9-41d9-8bc0-f828a471bfd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021939, "uuid": "c76b5d79-f9ce-4929-89eb-db8a51c085aa", "value": "kswapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2c6783-6dae-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782073379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073379, "uuid": "9caa107b-9039-4ec6-9d93-2e1df7314bcd", "comment": "Malware payload", "value": "3a792e36b5515f947eff274617b134a2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073379, "uuid": "511d6baa-d60c-48cf-a3fc-ec9284944143", "comment": "Malware payload", "value": "858e95756f32a2833275064e8a18ae1a8de873bbf7ed661570cfdfc37953544d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073379, "uuid": "a5309463-a303-466c-91b6-69ff00dc355b", "comment": "Malware payload", "value": "fd0180eca4672edd88045bbd27a17e2f9b6fb8d2", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073379, "uuid": "b8063db2-8789-4dda-bed1-7a500473b8fb", "comment": "Malware payload", "value": "a0b0883540da78dc38cf0197e1363da1435a94641133c88af65e3b190909410b302130a66e9872b09c06206f85cba215", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073379, "uuid": "811a1799-0af6-4199-b0b2-dede30fe5032", "value": "T1575108106AF99E04B5B3EA099ABFE462543BBADDDE31CB4C8159C10C07F5A508927F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073379, "uuid": "090978c7-476a-48c9-b2ef-1896bab0c8da", "value": "48:rsw1sAkD1aaPEYHDK37c6YyOvaHr7zXtT4oNQM7ktAGG5FF3F5Ua0xXm7VA/Z:rsgsZ5ahQG46CGdMoO2zxbd70RmsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782073379, "uuid": "54e3d793-59e4-415d-bd7e-07a7c04a9e5d", "value": 3154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782073379, "uuid": "f243307a-2ffc-4d12-ba76-7b756371ece0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073379, "uuid": "d56020e3-791b-4c3f-a969-20f78bd953da", "value": "NgOVP(3).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066b6305-6d52-11f1-ae13-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782033448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782033448, "uuid": "a3f6c0e9-aa17-4cc5-b209-7a5528c6becb", "comment": "Malware payload (ConnectWise)", "value": "98c0feab8fe62fa78e99c346e7a72587", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782033448, "uuid": "0bbea506-318e-4316-a5c2-49ef5e6ea052", "comment": "Malware payload (ConnectWise)", "value": "87c8df8bca39bbb86f4b2bccadb106aa7c3837db4b314694325cb25222c871e5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782033448, "uuid": "f6434779-26f6-487c-b279-978d884a174b", "comment": "Malware payload (ConnectWise)", "value": "233027c11c6ab4e98aeafac93882493c5d9ba21e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782033448, "uuid": "a28c528b-8589-4718-b7b8-0e62bb388ff0", "comment": "Malware payload (ConnectWise)", "value": "17536f95af0a387fb4bb7cc23bb8907640f02f395a4b6076edac09c9bbc77e6c38ad86fab1f28f4e709b8c92022c3088", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782033448, "uuid": "308e07c0-cc7f-43df-aed2-26818d7d3064", "value": "T1539622212BF94918F1F72B79ED3541F25878BC24AA23C15F1769B95E38B0D40A9B2373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782033448, "uuid": "57fb6fc1-a7dc-423a-a322-9af09129af58", "value": "196608:JiFoRlKlo1iFoRlkiFoRlfiFoRl7iFoRl:JCoRFCoR6CoRJCoR1CoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782033448, "uuid": "2ef2838d-dd2e-4031-ab66-b6cfd7b6a47d", "value": 9113600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782033448, "uuid": "f75b4b9a-fd5b-4d05-a3d3-37bf85591278", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782033448, "uuid": "33fb634a-fbb3-4f40-b3dc-dba51490ab13", "value": "File_Summary.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cffcddc-6d48-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782029379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029379, "uuid": "78052983-635a-49ec-aa59-f678061f7b53", "comment": "Malware payload (Mirai)", "value": "1c03f336eba00e851a9508a842160125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029379, "uuid": "2d59728b-a45d-45ba-b817-83a471381dc9", "comment": "Malware payload (Mirai)", "value": "88038b3adfe86cd3aebd9a79688fff41b9857685e0224c8e63c217af1f921854", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029379, "uuid": "3ffc9d84-ae9d-41b5-9e55-625a7386a6ea", "comment": "Malware payload (Mirai)", "value": "0bb1a7a691e74c7ad2f4bad23ff06f70ece5e052", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029379, "uuid": "a94ef4c8-0a05-4332-b80c-d7b5de8a87ce", "comment": "Malware payload (Mirai)", "value": "aadce3ad9e0bd02a25fee004736aaf19bd0dba9b71f141e661ae9ac87815ecedbbd5a981b78ad154110d8d578b51df3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029379, "uuid": "1cac43ce-9162-4d46-9910-177106c95af1", "value": "T115243B437B324FA0D725D1714BB38F5A59EB11C11EE288E5936CCA103A20BA9685FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029379, "uuid": "646681f7-8cfb-4f99-8850-ecbfc44ce1cc", "value": "3072:Llzk0ofoMHPX+GJX/Cz8r+azDVzaklCzcoJ5Ji2fDJMVitpC/9:l398PX+GAI+az5OklCIoD/fGViS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782029379, "uuid": "bcdf180c-cdad-4145-ad67-f4cd35d3f338", "value": 213312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782029379, "uuid": "dd969060-3f2d-4f99-81cc-3359fd6addc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029379, "uuid": "7ca9dfa0-db28-4388-b8df-67e669daad7e", "value": "data_mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c3f39d-6d5c-11f1-ae13-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782037797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782037797, "uuid": "ae3ea8f7-514b-4ee1-ad1e-f62c0c1bfeb8", "comment": "Malware payload (ConnectWise)", "value": "79a2c458c2f540fb85e4fd98f9183564", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782037797, "uuid": "da9274ef-77ec-4138-9663-73866acaa1ce", "comment": "Malware payload (ConnectWise)", "value": "894d32df224ee6fad68f8fa19e50042819e7834edfc985be3369783d63ce95b2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782037797, "uuid": "35fb6e73-05d7-46b2-8155-c791d1f8377d", "comment": "Malware payload (ConnectWise)", "value": "c9bc0dfa7686958f7c1bb01438b7240984766f6b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782037797, "uuid": "731d4492-4ded-496f-9394-a8899747c2e6", "comment": "Malware payload (ConnectWise)", "value": "c99c4939f755195928fe5626164081868f25a164d3975b23a2ac623020451c75ed87cc3ac24d18f7b0ff3d684a18db58", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782037797, "uuid": "29d3cf13-0c2a-4da3-8716-c0089c2261a6", "value": "T11446E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782037797, "uuid": "d1c80daf-6b7a-4e59-aa89-b98a65f7f2cf", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782037797, "uuid": "e03b990b-1f3a-4c0c-802b-e6d196b4e7b0", "value": "98304:SzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ShfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782037797, "uuid": "0dcc2af1-816f-41a1-9859-cde966e89264", "value": 5641520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782037797, "uuid": "aead807f-8e26-4c09-8600-a9ac5bb042fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782037797, "uuid": "4afbb94b-7301-4e07-9888-a64ec1c17fe1", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbce3bdb-6d7f-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782053134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053134, "uuid": "bfb3bb60-6cd6-4ffa-8566-9ef0293e202e", "comment": "Malware payload (Mirai)", "value": "41b45aefd3f0a8e04abe7fd3a632ed94", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053134, "uuid": "1b5f17cb-518c-4ad7-9de2-b9f2f4116827", "comment": "Malware payload (Mirai)", "value": "8985fe09d5b08240ba19c5bb2d1db585be19690dd63ab4b5b777484d73875bc9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053134, "uuid": "50921b96-6686-46bb-99e9-047f4ea81e09", "comment": "Malware payload (Mirai)", "value": "d0eddc89079aeac09b7894ddfbf41275d7189848", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053134, "uuid": "17aa555d-8393-4da0-a6ab-3ee9a18d8f73", "comment": "Malware payload (Mirai)", "value": "7e248850f5a460bc68bb9685c2d275ce0c12abd437fd94b4392ae8132cfc38adc2c8c74ed6bb6d6dd181197507331a22", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053134, "uuid": "0f2d53a9-aed1-410c-a020-831a1e788d59", "value": "T103E065A9B82538A24514FE34F4328615E15BFB81222DA318B2CD363A8CDC600753CEC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053134, "uuid": "733101d8-b95b-4887-95e8-d94aa1e55fed", "value": "12:lRphviR9hviRAYNkhviR60LKDhviR1OhviRWH:rptQtbYWtoKDt8OtjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782053134, "uuid": "2dc28510-756d-4dc4-b19e-c9ea2f10c7ed", "value": 391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782053134, "uuid": "c6dae773-cb63-4562-87a2-329b13166c2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053134, "uuid": "fde11cd9-d532-4a79-b80f-488856a808f7", "value": "giga.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26de03b6-6da2-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782067862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782067862, "uuid": "ed867c47-cdff-4a85-bd51-2774dfbb8cd1", "comment": "Malware payload (Mirai)", "value": "f33ee4d5146e13687053014e42efc44e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782067862, "uuid": "11a07c92-5d67-406d-820c-d65586ea0d42", "comment": "Malware payload (Mirai)", "value": "8a3f9b24c385d2532d5039e95ad913b96b8bff389211f9bfa1718af35d95dab9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782067862, "uuid": "a427e24a-5e0a-4d12-a3c5-2ab6e49f8c42", "comment": "Malware payload (Mirai)", "value": "cdcfeaa20d74d146fcfc1f29b218b838e576c29c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782067862, "uuid": "2b0cbed1-723e-4624-aeaf-729971b274d5", "comment": "Malware payload (Mirai)", "value": "569e711dc47fe365269838e0d3e883dd8bd5cf51fcc24f529175bfc3229523b641c7c5b8df10790e0758e51bf45dae09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782067862, "uuid": "7bcd6f00-903c-4996-a637-a4b48981f4c0", "value": "T1CB44FAB6FD429941C5D42AFAFB1ED2C833035378E3D97112AD068B25A5CF54E4E3EA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782067862, "uuid": "da3d9b58-9ea6-47a4-8f03-40293d1a63d5", "value": "6144:8XS43ddoIppa1qW/vHaiKs7nIaUA0qW3/:YoagAir7Iat0qWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782067862, "uuid": "f666213f-60d3-4d2e-aa3e-aa6b2ac0fa5c", "value": 253964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782067862, "uuid": "7154c16a-f922-441e-8d21-039951774aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782067862, "uuid": "1106023f-fd3e-449f-8269-1e67f07a7151", "value": "heilongbotnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f8a315-6d54-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782034662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034662, "uuid": "897c3f30-92da-4d5e-96ad-dafa91990dc5", "comment": "Malware payload (Mirai)", "value": "9c8c17a03eb76230a91b1880d40344e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034662, "uuid": "76a7a90d-de9d-4da4-a055-12efaf0e3268", "comment": "Malware payload (Mirai)", "value": "8abae386ec6aaa1d1bf03e39f339922053e4b66d7ebbbeba15701d3ecc183fb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034662, "uuid": "2f245038-adc3-445f-9998-333220284dd1", "comment": "Malware payload (Mirai)", "value": "c24109b3f3c2be27f3bb84eb747a4ede7a353030", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034662, "uuid": "051c18d6-a29a-44ad-938c-747a213b31fd", "comment": "Malware payload (Mirai)", "value": "0a23f11a5118b2e14ca770012443aa3a5fe50fedb1d909aaa53a160cf4e7f4c9e7834bf28c8a7d36659beb070f0980d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034662, "uuid": "45bd18d6-ffc4-441b-9144-a78e4d9dfd0f", "value": "T1F3A42966EC409B95DAD12ABEFF1E824973131B78F3EE72119D155B3063CB84A0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034662, "uuid": "ecd6b34e-4ba1-45d2-9617-8e52fa713aee", "value": "12288:K7B7uNXw+hhybR2Fv8lZNAH2jj4GRLIpxg89Da9a/GBkenz+0KhB:8B7uRSlV/kO9Yl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782034662, "uuid": "d8bdae49-a10b-498f-bb56-be88f708e348", "value": 480932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782034662, "uuid": "cc2f3a6e-bb38-45dc-ac5c-a78c11942b82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034662, "uuid": "e30ba0a5-7374-408e-877c-09d908b038c4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b1de9c-6da6-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782069815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069815, "uuid": "5d6ff484-d681-4368-8cb7-d8339e1adee9", "comment": "Malware payload (Mirai)", "value": "c51690a7c52a8192045ff35fd2e999cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069815, "uuid": "73d780d5-9e99-4c10-93dc-0ec7c632a055", "comment": "Malware payload (Mirai)", "value": "8d09251c40eaeddfcaf637ff7ab2781bbd37734eeee6a45ceea6ecb0490bdcc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069815, "uuid": "632767f2-375c-4480-b582-2d7bba3e087b", "comment": "Malware payload (Mirai)", "value": "b537192ad1ad1aa90abbfd7ec135f194534bfcda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069815, "uuid": "8773b67b-4185-4ddc-af01-4ebd29a1c9c4", "comment": "Malware payload (Mirai)", "value": "c823aac0e9377f73f1d1c2904e0c946f1a43fc67afb7faabf5256b03840476854f14efd78c3f48fad824e982e174ae15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069815, "uuid": "1a194485-b586-4a31-b9d4-4e39eab5f7e5", "value": "T121F22985FE859A02C5C56277FB4E03997B26575CF2FE7303AE295F61338792A0E3A101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069815, "uuid": "0b449ea6-2189-4ae4-8184-4979884ca12d", "value": "768:0q1w6CKC0e0Od7CCw0iueqHMYSwXzJelmekm3WQ61TmNI:GKdOd7CJ0pcYfsLd3z60N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782069815, "uuid": "f0aca73d-d9bc-45f1-b3a8-5bf04dc3d1dd", "value": 36684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782069815, "uuid": "538f6ff8-1db3-46fa-ae77-afd7e52cecba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069815, "uuid": "af557007-8a7c-4f4e-8527-54ff642417b1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11ae308-6da6-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782069812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069812, "uuid": "b8dd2ab4-0894-459c-a07e-c25d0d9d3ece", "comment": "Malware payload", "value": "b15c236bced9b5afa73fde8bff3e9324", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069812, "uuid": "f2bc80e0-2c41-4ecd-a52e-93048b493022", "comment": "Malware payload", "value": "8d551114e2f65011d1f7ffc3f0195924deb416811a32d90bca91419ec07fe82d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069812, "uuid": "e637098f-3437-4d02-925f-27a4181b31a9", "comment": "Malware payload", "value": "c756a0941270ece273e0d381bcd8fa8a8a13f8df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069812, "uuid": "5f069e65-b57a-4179-bb43-bea10b3d2e6b", "comment": "Malware payload", "value": "4dd7aae2017dec931299f8cc391d06e79e8567a44be98e1d7cd44f2081b56851470a9e5d970bb876a9af63889ecc7400", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069812, "uuid": "686b139c-072b-4c93-851c-49d02e9154bc", "value": "T1FDD4A60B7E228F6DF674873147F74A24E7AD23D623E1D981D19DC1146F2028E592FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069812, "uuid": "bb27d9d5-f713-4b91-9122-ef9d2e1c02db", "value": "12288:J5nE9ye6sK6RFvXPqf4yw+6kpQjk8l/qnlQHq:4pXoBQQ6+lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782069812, "uuid": "0e2d7d26-fe25-418d-88ab-8a690947f9f9", "value": 644160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782069812, "uuid": "d96a174d-a898-4a1f-8328-618e87654928", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069812, "uuid": "e56c5ae3-909e-4efa-aa65-3ff6bfec68a0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f4e9a1-6dc3-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782082120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782082120, "uuid": "da60e53b-97e3-49e9-b254-b81fd2504694", "comment": "Malware payload", "value": "1f4b9d3c78457ec9a1d0249696e6d131", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782082120, "uuid": "4ebcad04-ef68-4890-bd3d-4229d04a0df6", "comment": "Malware payload", "value": "8f24897afca9c8fd5a48a78d6ab1476eafb18e7721e7772df114da4f58e1eac1", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782082120, "uuid": "f75d2e0f-b121-4afa-b83b-bcd5eb8f0df3", "comment": "Malware payload", "value": "24e797df4c7f078341d7011e0f97f3ead6aff674", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782082120, "uuid": "41d57ca7-b44e-45d5-8327-bb0e9cd49e21", "comment": "Malware payload", "value": "86dee012a11c9d1aa9657452f8eb213da840f6b582186b1491a212881e26529e17f95f12ac7d6d4464dbcdd8d92f49df", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782082120, "uuid": "473186c0-45c0-46ec-a7ea-462e0eb8a469", "value": "T1DD3633B9859B61F6CAA3E63753B7627186443F6F2B0047FDCE20E36C1430A664964B9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782082120, "uuid": "b8e377ae-f58c-4ee6-a4e7-3815fdd910ae", "value": "5b3ebef3da244b3ac4de5a75d6d1e4c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782082120, "uuid": "fbe5dc99-bdad-4356-8bba-9362b2042530", "value": "98304:6u/zsywgrFAvQpJUlV/ROrKNunnjX8a51sujGhHzAXytwv9eaW:hzsdgrFA47UyKajM0uHorv9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782082120, "uuid": "1a15cf0c-8716-406e-b672-594387d8b9d8", "value": 4966912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782082120, "uuid": "bc5e0d72-8acd-4d9c-865d-8d6e1aa004c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782082120, "uuid": "92cd2c28-a8a1-4dc7-b2dc-6113e0d7c849", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ed7d68-6db5-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782076372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782076372, "uuid": "d7eeea58-2dfc-40ed-8148-3cb443c07381", "comment": "Malware payload (RemusStealer)", "value": "f102d18fdbc9a87882a2a15a488fac4b", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782076372, "uuid": "2b91ed00-0d9f-456b-9b17-6f32a7df2aa1", "comment": "Malware payload (RemusStealer)", "value": "8f4ac0403edc15f1eddc1da8239319c9df2e86720fc2508746ed0660a0cc2918", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782076372, "uuid": "fb6d06e5-f0a6-4080-ae86-8fc7b186b3f9", "comment": "Malware payload (RemusStealer)", "value": "45aa0b3e94603ec15c2d38140a7d12fd2114fb60", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782076372, "uuid": "8d5b728f-b6b9-40af-ad5e-469ba4a301fc", "comment": "Malware payload (RemusStealer)", "value": "9d8bd7b5083d9c69483fc8def432b2bc899695286ee013311fc5f23083b49a96dcdf36ad17769b03ce51e563932fdfd9", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782076372, "uuid": "cd1e543b-7570-4371-81eb-f23312253a6a", "value": "T10A172377B24A653DE06E1B765976A210583B6E21AD120D1ACEF034ACCF3D2B03D3F656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782076372, "uuid": "43a83d56-d194-450b-9d22-5e8e4fa2e136", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782076372, "uuid": "c0ad3998-4a92-46f9-a9fe-ff5271907e79", "value": "196608:HoYXWptc00iapAURwsbvZ/HADzx5jFLTBiFEMig5NoJr/Dwzc2xJrxOaMkA2sMWd:HobU1iapAU9Z4XsOgU5cv0aI2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782076372, "uuid": "c9ec107d-3d33-41cd-82ac-2fda44aad2a7", "value": 19885701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782076372, "uuid": "76565313-31df-49ee-8a44-1ca1f115dd44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782076372, "uuid": "3cb35b85-c99b-4965-b14c-2a395351ca91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6924da9d-6d41-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782026312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026312, "uuid": "75b9026c-d2f7-44bb-95f9-79fc61f9a7ed", "comment": "Malware payload (Mirai)", "value": "e943701e7d42e89f9f5ef09769c2f097", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026312, "uuid": "70824149-f193-433a-bc8f-7f10098a0f0b", "comment": "Malware payload (Mirai)", "value": "8f77f6ddc131d2f1fee02db52685543275739c05a179f533e25c57de8fd61fc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026312, "uuid": "4b1e2798-aa19-463e-a044-f593c9a66b82", "comment": "Malware payload (Mirai)", "value": "96e98c9eb9e915f53509057b27deae4cac15fab7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026312, "uuid": "41eca843-f432-4b13-a0b4-558e60a4b3f3", "comment": "Malware payload (Mirai)", "value": "f55c01800c89cfdee9cc3c91bca001ffcf8a4237c51afe387bd3da3fc1fc4e85ff3fbbdc77a39f357d5f05406de9572f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026312, "uuid": "a363839c-0c34-4786-a463-d68481f50bee", "value": "T12EE31956B9519F12D5C321FAFB9F914933136FB8E3F93102AD206F60638A99F0E76502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026312, "uuid": "9894becc-915c-4d36-8a70-fd0dd744082f", "value": "3072:MGyexx/+9fguzgvfCelJ6W/LAqjxNW/Fa1m6i0H2uibjCJY2Ol5Dpc3XSL:M8bsfpzgvfVJrjxAFa1m6i0H2u2jCPO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782026312, "uuid": "55adfbd1-f9c6-4e08-a777-ecb04cd655ac", "value": 153876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782026312, "uuid": "4317fba2-2bec-4a22-a27b-4cae30dc2546", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026312, "uuid": "bb9bd6fa-d983-40c6-aeaf-7b2573337c36", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e84d408-6d84-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782054937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054937, "uuid": "5ef1f31b-eb7a-427e-9e6a-68df67901ce9", "comment": "Malware payload (CoinMiner)", "value": "a2d9e91763d93514284c5b72fcf5e85c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054937, "uuid": "7ae73a95-415a-4563-b299-cc0a42f54c34", "comment": "Malware payload (CoinMiner)", "value": "9349110551754e719b9eaeabc2b692cac6316e032ccb4dce4931ebfb6e291fbb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054937, "uuid": "843e1f4f-828a-4fe8-9476-c311ca53eff1", "comment": "Malware payload (CoinMiner)", "value": "bbd0e2ca195b72d50e982e9534b5e82241c6730e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054937, "uuid": "10939b5c-f4b0-4bcf-bb1f-2ae4ac07aed5", "comment": "Malware payload (CoinMiner)", "value": "5470df67cb2394920c25c14e18a404cf7b19d5aa1b3d1dbfb8f502922be1d1a4fbe8840fe90469ba64ea0f0550c3bc52", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782054937, "uuid": "e656d069-5a0c-46bf-b6c7-a2838d7a4123", "value": "T16ED3129F290686FED926683A823177E8DF10093FD191BF54120BDBF6D4D508AFE47852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782054937, "uuid": "99749562-b80d-40c1-971e-8b79f6faf1d3", "value": "3072:enfpWLk2Unh2ywuN0aVXe7x6EsFl/on9ihyddCI7Vq:enfpx2QtwuN0AX0b0W9Rdtpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782054937, "uuid": "b209e46e-32ac-49b5-bd03-0e71f79f55c6", "value": 138468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782054937, "uuid": "88378cf0-85ff-4e90-a9d0-57f5a0a0d3ce", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782054937, "uuid": "1953ed8d-cc59-4ec8-a316-26e154e63492", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196c55ed-6d1c-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782010287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010287, "uuid": "5fe985ab-4232-4813-a1a9-a0705a23cfb4", "comment": "Malware payload (Mirai)", "value": "2d9d23cb4ab65fdc615b1ccc20f8980a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010287, "uuid": "696ac0b5-0e9c-4d95-946e-a0d97d86369d", "comment": "Malware payload (Mirai)", "value": "94562aeec310a434e4f3babaa71dd0e8bdfd67eea460a4b7edf3b7d229875463", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010287, "uuid": "7da6cbaa-5d9f-4f00-b0f6-4703ccd31677", "comment": "Malware payload (Mirai)", "value": "09b204fba427be48debef8d360661d1cde2d3553", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010287, "uuid": "c4f48706-1731-405a-ba3d-4fa081b483f9", "comment": "Malware payload (Mirai)", "value": "6c5e02770e75a1e94ceb7db4f41a05e674e9b3bead4e90167e6393e4b11908d10b61aa50b6e45fd5a4a6ef164d966e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010287, "uuid": "06af5416-7e4a-411e-b33e-22e4fa1daeba", "value": "T1AED37C73C869AE98C624D5B8F1618E392F63A42891475FFA58A7C3B49047ECCF5053F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010287, "uuid": "591bd7f7-e498-4788-a86a-6c6702048640", "value": "3072:AKDKTnuN6XbTO2wx/K95sdbRGfHlXLabYWrTTWhAI:AKDguN6rTO20u5sdbROX2bBrTahAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782010287, "uuid": "68d83f56-1f42-40ff-83a8-066c0819e655", "value": 132268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782010287, "uuid": "863af833-5daf-4cf8-a31b-0a48f1344da8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010287, "uuid": "50b899f3-58f9-44f4-b9bc-05ccdbcedd15", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c267b1-6d8b-11f1-ae13-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1782058217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782058217, "uuid": "69b8785f-2bb1-4087-84ed-e6408cf2782c", "comment": "Malware payload (XWorm)", "value": "92167980027e13584ce5118e1e83ab0a", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782058217, "uuid": "938757db-12f6-4ca0-8c93-fe915a869d4e", "comment": "Malware payload (XWorm)", "value": "95a6eeb9407cfae94a99df9ca32c3b1858a5d6ff944eff33ad2228a1915c808b", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782058217, "uuid": "68514df5-b52b-412f-8b9a-b8c91d4e8587", "comment": "Malware payload (XWorm)", "value": "2aab42f242abe16cc83703c742e0029403922d0e", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782058217, "uuid": "98060939-d735-4bb6-a277-d90d8dfaf621", "comment": "Malware payload (XWorm)", "value": "536e58a361f03af89f6376b9e9ff7c53439bc916c3d6f69f9f8a438398a3ce8162e64b835a173b46c26ab8ff78bf6302", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782058217, "uuid": "a6985a77-d277-4203-8eb3-15fd94d89b8d", "value": "T11DC63387A4BBA1D4CEA0D6E27E7652C4142698B4040E6E3EFF43EB504196FF51926C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782058217, "uuid": "92865add-071f-4dc0-a351-9b2415c6cc13", "value": "196608:ejBQPD7RO9CBTJj+nm1gSLuDUtxI3yqFRhTEzpcP9CzUqMRPOp2iUwhYvF/MCA/l:+BQ4wRJynfkuDwxVkEzpcFh2sJBF/fGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782058217, "uuid": "93c2d4a8-ae94-454a-851f-a0d70d593c30", "value": 12552606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782058217, "uuid": "449881ed-d823-490c-8f1e-52ff2ffe03a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782058217, "uuid": "437240f7-4267-4636-9425-7452bda426a7", "value": "HMCL-3.13.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d80c76-6d2b-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782017016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782017016, "uuid": "ca9112e9-0818-48b6-9a44-746c6a6c9754", "comment": "Malware payload", "value": "7feae56b81362685bdaa8d62c590368b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782017016, "uuid": "80bd3e55-8c23-4a78-b3d4-f3918fa7c6b9", "comment": "Malware payload", "value": "963bab24d0fee05d712e5ca3dfe61865a85858ef0d43cee61785a1c422fb7761", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782017016, "uuid": "0b4d472a-350a-4521-b288-e1b690333680", "comment": "Malware payload", "value": "8836115556982e0fcd907be6e30ab833af4a3435", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782017016, "uuid": "87f973b4-9850-4b58-a39b-0a1e7d965221", "comment": "Malware payload", "value": "be9c669e956923a76de9531eb5b015fe7da02aa379f38fc55cbc400addd913bdeb8a37e3b46babbe578413fc1bfcdafa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782017016, "uuid": "66452d19-560f-4220-8b71-90a035a405ba", "value": "T12C533A85BCC19612C6D0237AFF5E518D372663A8D2DB3303ED265F61378A92B0E77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782017016, "uuid": "6d838b99-9209-49ac-80ac-9e109b9b64f5", "value": "1536:RCKJ83nhgZ3/exgLWjmQSsW+xfw/Jhj8L:RCKJ8XhgZ3WqSyQSs7oBhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782017016, "uuid": "975b089b-7013-4a03-93f6-84eeb44d3ea8", "value": 66684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782017016, "uuid": "46171513-2291-4bd1-b892-4708007c0317", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782017016, "uuid": "5c841dec-7035-4c94-a7f5-ebb6644e5b20", "value": "karm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f4fb2d-6d92-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782061264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061264, "uuid": "110219e1-3356-456e-b0be-f11d822f7276", "comment": "Malware payload", "value": "1d83542c18fba82b90152d1927dff16e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061264, "uuid": "b518342e-38df-4cb0-a43a-df1e3852e406", "comment": "Malware payload", "value": "966f81d638b8ef5b9dcd621dcb75744b01457670ee86fc982b8995a22339cf04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061264, "uuid": "b8d2fbd6-801c-4b48-8948-e1a1af6da5c6", "comment": "Malware payload", "value": "f8e811a658db30a9d44c027e4d5aa2eb639c5d91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061264, "uuid": "12063b5f-8376-4a88-91f0-7831a29dc020", "comment": "Malware payload", "value": "42deaaebe3fcfd29a41a89fd2ce7a5b26e833243f4591762d48b2461f40660eff34590fb2ba1811c7a6350e98dcd3183", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061264, "uuid": "5a4c65f5-1fd1-4dc5-be83-400eb41ed3a3", "value": "T1A3D3E65B6CA550E4D4EEE078CA27F2137EB27418073837E72EA06A610F57EE161BCB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061264, "uuid": "519ef7e7-3d9c-4040-a2a5-009471ac0d9f", "value": "1536:FpssjJVez45Sv5uFzOP8OYOeJe/4Tlm8FNZEqPVzOJlsdLNxPP:FxeuFzOPWO/E48DZpy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782061264, "uuid": "926f5e49-826b-4b93-ac99-98f97e802113", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782061264, "uuid": "47b770ef-1c1f-45de-9c86-b60e9b7b3363", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061264, "uuid": "1cbfb30e-5402-4b79-a9c8-f55169c9466c", "value": "966f81d638b8ef5b9dcd621dcb75744b01457670ee86fc982b8995a22339cf04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e471730e-6d20-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782012346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012346, "uuid": "aad8e50f-9135-423a-978d-a2ffd38dcad6", "comment": "Malware payload (Mirai)", "value": "c1bd6fe87092aa9ff3a6e0c0cf908b61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012346, "uuid": "df643b93-1284-4c6e-ac85-22775dfee747", "comment": "Malware payload (Mirai)", "value": "968be59bf773af0c34f9e815575f8901a885614275b7e23646dda19d13dee638", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012346, "uuid": "5b776211-0c13-4af5-82c3-7f9804a99073", "comment": "Malware payload (Mirai)", "value": "f4de56cbdb04147a7b5d6a9b82a53c5522e3461d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012346, "uuid": "f84244d4-b0c2-497d-b7e4-63693cdf7787", "comment": "Malware payload (Mirai)", "value": "3389e341053702115cc6feef6dfc8e24aa6278b51585cd6ea085fdd3118eea00a34f5889023af42b3ba9545472939407", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012346, "uuid": "e59b2ee1-4f3e-49b8-be55-97ef97395e2f", "value": "T189E32945FC805A17CAD612BBFB9E42CD372617A9D3EE72038D115F21378A95B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012346, "uuid": "6cf5a067-270f-4506-b691-d5a844d63ee4", "value": "3072:os6iykikge00J3pa5WTnA47JOwocR6iyI:os6NI003I4nA4lOwngiyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782012346, "uuid": "e00df8b7-d5f4-4329-9a34-e9ae9694899f", "value": 149868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782012346, "uuid": "018a205b-12c2-4871-a31a-985866a4a38d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012346, "uuid": "ae85858c-2f0a-4631-b35f-7d260894f4d5", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f6452a-6d40-11f1-ae13-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1782025824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025824, "uuid": "783e824b-b3b6-43d7-9463-103744774bd8", "comment": "Malware payload (Phorpiex)", "value": "5c1469dfe6aed70e8bc529c68216b9ad", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025824, "uuid": "c024bc18-1953-45b1-8ad0-ed9ec66c9218", "comment": "Malware payload (Phorpiex)", "value": "96ada74774413c01c0e7d4707d9837bb30dba9132cc3519178e890596f2b5dbd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025824, "uuid": "e7c5a1b3-40a5-480b-b526-0c2fe67a76ae", "comment": "Malware payload (Phorpiex)", "value": "796bb8aa995056739a6201720f3266da815e92bf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025824, "uuid": "6ff61617-0360-42e9-b2d3-7bc66ce40c66", "comment": "Malware payload (Phorpiex)", "value": "47ca09a4c00a6c2419558896a4e932730e8f1800a2325750643924eee7d57a4b5f803b2d30cf11830201437fa8c13779", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025824, "uuid": "51d0fab8-6d98-44a2-9769-cc35339961ee", "value": "T12F825B0FB8424726D1E210749276977BDABDA872338414DBFBD489E90A686D6FC3311F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025824, "uuid": "a5ee8daf-0380-4124-879c-b860fb4caf14", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025824, "uuid": "c11bdf5b-d998-4181-b8c6-0844303d4a82", "value": "384:hIqQ1VaFPte/SZCvBu9JgwHcev4av8U9cNF:FYUIE9r4a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782025824, "uuid": "6574d3e7-da0e-4ea3-bbe9-6b6a9d2a22f4", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782025824, "uuid": "b24cef34-c94f-4453-a143-6d2f9df7db2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025824, "uuid": "2d58b4c6-b18e-4f88-aa54-9d1ae5536188", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd2a24d-6dae-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782073349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073349, "uuid": "b21c1351-170c-430f-9a2e-21f6dfa3ff75", "comment": "Malware payload", "value": "1c1562f348ee5f02bf27cd4de7c9ad52", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073349, "uuid": "f56c571a-8fe6-4fb7-b7bd-3450c6a889f3", "comment": "Malware payload", "value": "984ca97d34361cafaac92a5f2617931f3dd38ef71774eb29cf8a795a31ab3b6b", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073349, "uuid": "a6c85fab-bc12-4fc6-86b8-e34bee12833e", "comment": "Malware payload", "value": "cd5db6c6bd3df6251b2d3ccea8c09a186391f4dd", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073349, "uuid": "1117a764-78d6-468e-af40-3f63c305b2fd", "comment": "Malware payload", "value": "1b2807d97e04eaebda41957904d7a164dc4fe5926941b9f08e92a60cec2389d8d6ee4a45def889ff5a239aaa1d31a2e4", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073349, "uuid": "1cd4286e-69a2-4430-94a9-c18b0af10e66", "value": "T18A21F310AAFC8E11BA73DB1987BAE08019767AEDED31CB0CC354C10C06AEA449C56F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073349, "uuid": "6a5f5d16-ebe1-4847-ba07-0b8ade5e07cc", "value": "24:Qlv4o4Kzyu52U/tMlBygklBRlB0P8wPMuZJBlBMwA6PFv+F5ThBmJ:A4oPtM7ktApDPwF5TH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782073349, "uuid": "4bfc5d50-71de-4e6b-bce2-0e8db3c851e1", "value": 1306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782073349, "uuid": "0008b23b-2821-4e34-ba9d-4765dd1069f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073349, "uuid": "a8dd572f-ab8d-4ad1-9b04-26dc18a78599", "value": "Lwoqo(2).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724a1f1e-6d19-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782009148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009148, "uuid": "d20ef857-c02d-479d-bf51-5eb89e07106f", "comment": "Malware payload (Mirai)", "value": "6dc7c725ecaddb802719e55f6ad501ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009148, "uuid": "c9133920-115c-4efe-8217-f4bfa6ec2592", "comment": "Malware payload (Mirai)", "value": "99f79a2e804f5387eaf38175dc683020a973cb005258b43ec8ead59b5b9b8eba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009148, "uuid": "5189a9b5-8cfc-41dc-a981-16c312a553fd", "comment": "Malware payload (Mirai)", "value": "a65b332e9dcd1d6ffd9410aa33029f41e512f64c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009148, "uuid": "5c39236d-6069-4b09-8ba3-69cf61aaf39b", "comment": "Malware payload (Mirai)", "value": "388716de51fb5cb5d223c8899118b872f10893d71ca381d3647b80c5783b59162e77cae27bcc99a8966fc27baf127961", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009148, "uuid": "8ffdd8ca-a91a-45af-aeb3-4e80537d7053", "value": "T13ED30749ED819B11D4DA22FAFA5E028D335357BCE3EAB102DE145B2133CAA1B0F77552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009148, "uuid": "a3f35e70-8bee-487b-b857-cdaf084f2221", "value": "3072:M9XxZB3oLmpMguHcUlVUHalw7WEuH00sfC6jxFadq/1EEsaf3+TLyWXFaY4verxo:M9XxroLmpMguHcUlVUHalw7WEuH00sft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782009148, "uuid": "325ef69d-7008-4f94-9b41-b0e9635d5b11", "value": 132572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782009148, "uuid": "1bb9a26b-1de8-4d4a-b005-4691676d1eac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009148, "uuid": "56c0ae75-9e1f-4610-b2b9-3a514e6063c8", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f769cdfa-6dae-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782073366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073366, "uuid": "5d25e827-2150-4540-9db8-f92e4024299a", "comment": "Malware payload", "value": "8ae08c993faa121c8e623893270457c8", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073366, "uuid": "40e551a8-917d-4878-997d-d5e6bdbce914", "comment": "Malware payload", "value": "9bf3e590250b86e1e9dee20e6200b67983e6f48d1ccc07559a5835d7d85d72e6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073366, "uuid": "e6dc234c-05f3-4b1d-a09e-784f48fa1e51", "comment": "Malware payload", "value": "673e51d59ebb58aef24c1b93d0be4a589ad4777f", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073366, "uuid": "3c28ce15-90bd-48ec-a96c-da5bd272c031", "comment": "Malware payload", "value": "45cf4675f27096d4360c441e176935e432dbca9f9d842f79e7e5704a51c3ad895956b531499589637700b64aafab2211", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073366, "uuid": "0ddf94f1-bcc5-4836-8210-a6c2699d3a9a", "value": "T1555117106AF99A04B5B3EA099ABFE462543BBADDDE31CB4C8159C10C07B5A508927F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073366, "uuid": "3f71d858-b8b7-48ae-94c7-d3ed39d42224", "value": "48:rsw1sAkD1aaPEYHDK37c6YyOvaHr7zXtT4oNQM7ktAGG5FF3F5Ud0xXm7VA/Z:rsgsZ5ahQG46CGdMoO2zxbdg0RmsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782073366, "uuid": "99385d75-30d0-45db-a0cb-9df65b5d3c1b", "value": 3152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782073366, "uuid": "d6d22b3b-d02a-4a33-9c48-f380e17baa2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073366, "uuid": "fba35db8-7147-4abd-aeba-2174801f2ab8", "value": "NgOVP(1).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd68dc57-6d68-11f1-ae13-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1782043231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043231, "uuid": "e1b3608d-009a-4fad-a573-b2926a65633f", "comment": "Malware payload (OverlordRAT)", "value": "350711ab2cb46a81b20e31eb756c073f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043231, "uuid": "f4dd6a54-0369-4880-99c9-5d726adb27be", "comment": "Malware payload (OverlordRAT)", "value": "9c5f121e984d76e479ca119499d35efe9402925a2c29b195bff88542c47b0c05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043231, "uuid": "5bc86144-8a20-4882-b318-4d0660bc5912", "comment": "Malware payload (OverlordRAT)", "value": "f90d1887e54eb7c1af6f7abd3b17eee0d2e9eff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043231, "uuid": "15ad2033-6a65-40bb-a843-0196887debfb", "comment": "Malware payload (OverlordRAT)", "value": "4da04387d0206e26cb22d510c55f1d30d8c9f6a3b189dd6d8c8b1ed769dfd91c0d14d43dcc7bc90ebed6b41eef21f32e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043231, "uuid": "a17f5da2-aac2-425d-a6ae-507f6d28d59a", "value": "T157D6490BEC6945E8C5EED534897292527B707C494B2433D72B60F6287F36BE4AEB9340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043231, "uuid": "b80db41c-83c6-4cbb-9a1a-9bf12bb9c59b", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043231, "uuid": "ceb1cec4-ee5f-4e1a-a92c-210bb8b5c1a6", "value": "98304:C3gvJyaoH3v3dG+yZOk1n1eDpjsca6RQ/G8UseJE1Nxh:CSgaemn1eDp+Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782043231, "uuid": "2b0881ce-4f4e-42d2-8edc-5aba6561c8d7", "value": 12894720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782043231, "uuid": "6a39d6a9-9d1c-42f6-8045-d33ea3172af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043231, "uuid": "c131c6a7-462e-4254-9d8a-19e82709f3be", "value": "Exodus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce084af-6d5d-11f1-ae13-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782038371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038371, "uuid": "bf5459a2-e820-46b0-b4ba-501c4e58d597", "comment": "Malware payload (ConnectWise)", "value": "f3d3fa71555ade263f753a6d543b81ab", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038371, "uuid": "11f2b09d-a0a8-4309-a25b-86f4afa95e2d", "comment": "Malware payload (ConnectWise)", "value": "9d7ecd3a4aeefa449a7313e98a6afab0ea28eb1f693380f2ef5a4c9fe612c5dd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038371, "uuid": "ee8506da-22c4-48be-ae2a-52b512f20405", "comment": "Malware payload (ConnectWise)", "value": "2a467b379b48b0d1a1a4616ae50763b20bd730be", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038371, "uuid": "1d157177-ab14-4ce0-a4db-8670ecc305fd", "comment": "Malware payload (ConnectWise)", "value": "b23b194ffd6a08c564c0bf73c108c3cf88b76ca94e112f4b2d32c3da82f7231ba0c6514c393d4be193cc414c50354272", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038371, "uuid": "1de1633b-517e-4028-a6ed-793daedebd31", "value": "T1D7646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038371, "uuid": "454c09d4-e1e6-41b9-8da9-ec8b00bdc604", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038371, "uuid": "18cad75b-3f09-4810-9f87-0f15104a7a9f", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9r0:p1iw7gryNkSV1hy1Z1u2JLu9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782038371, "uuid": "1430c043-f306-47ef-a2fd-879443aaf2e4", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782038371, "uuid": "daeb8fed-90b7-4fac-9deb-12c782f79cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038371, "uuid": "d9b7dcbb-dc4f-4941-a9e5-217baee9121b", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09eacc1-6dae-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782073328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073328, "uuid": "505e27d9-c4b1-44cc-b558-c6ce0c4cd17d", "comment": "Malware payload", "value": "986254c4e7965203bf831482c95c5a43", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073328, "uuid": "3c470408-351a-4d5a-a665-cb0254047a95", "comment": "Malware payload", "value": "9e64eab0015911243a17b43f5a4bdbbf41516b1063fc70722acb3d8492434dd2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073328, "uuid": "62150958-17fd-483e-b639-5d6e3fa7eb26", "comment": "Malware payload", "value": "44dde94caf0f2755ce4864302efdf529bcb95f4b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073328, "uuid": "93675fea-5aaf-460f-bfa1-07dbde8f9b4b", "comment": "Malware payload", "value": "e393a6dbb59dd6836b555efa050bb10a75da91c8d99e5e8e6a16504319d32962018863faffdb3c3afe3a7c310e27e150", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073328, "uuid": "9ad70297-fa37-4df9-81c4-fb7299d6e4c0", "value": "T1C711C410AAEC810971736F09C3BEA1641477FA2DAD72CB0D0414D04D06B3A48DDB7F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073328, "uuid": "a8e329de-5d2f-4454-8417-7cc2a07ff7b0", "value": "24:Q0D1O/4+yu5b7nxByg5BI8lPMPMuZJYMwA64Ivt55XhXQ:PA4UnxZ5dM0sg55hA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782073328, "uuid": "7e9af649-1707-43aa-8bea-988aa2cc4e70", "value": 1066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782073328, "uuid": "80fe377a-bec0-47ea-ba52-2fdd1679b032", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073328, "uuid": "796614d2-62cb-450c-b2cf-c3d9937143c6", "value": "DvVbs.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bcafec3-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782022022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022022, "uuid": "100baae2-e483-4c05-97e1-bec1d2eacdb5", "comment": "Malware payload", "value": "86a261321a90e936a69ba6345ca5ce5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022022, "uuid": "60129989-5e4d-4b13-850a-832775a09b6c", "comment": "Malware payload", "value": "9f12b49dcefeb107d47ec0261595a72254f0346026263c204b8621f61f1cd4b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022022, "uuid": "f8e25db5-5def-4fda-9d03-793c46f8aa8e", "comment": "Malware payload", "value": "e20434cb7c1dc3063f72e76999863670be56c557", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022022, "uuid": "a845b23b-97db-4399-bafe-6e7f4fdab036", "comment": "Malware payload", "value": "7f9ffbb9a04cbda31a8e16b399d4bfe2b212e85abdc4d151df2dd13e320b9fa4ba92bd3c99387af86f34ab27d2d55f7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022022, "uuid": "2329ee6d-50a9-41a6-af27-55f17975dca3", "value": "T15A560857B9D24983C4E83677B8BE81C432635EBA9B8652566D04FE3C3EBE1D90E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022022, "uuid": "a5fb1ccd-5b8f-4886-b437-1fea617d1290", "value": "49152:jgBVEgaDLCo3uJXUHZMH7ha67RPNAGjE53D+zd1nLUg6y+0Cg5EDG:jgwxCiYm3D+z3FEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782022022, "uuid": "d03a116f-551f-449d-8c62-c74946cd1c23", "value": 6160532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782022022, "uuid": "d873113b-ef0b-4ee4-bd30-ebfa8146a3c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022022, "uuid": "6e2aafcb-1847-464d-9c4d-626a435dd2e0", "value": "jbd2_sda1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c39576-6dae-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782073317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073317, "uuid": "93984576-4d8a-428e-97db-9057f54ea29b", "comment": "Malware payload", "value": "932e5cf98df7bd11405994dc3b374cd4", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073317, "uuid": "3d74b7f7-25fc-4b09-bfa6-402d604cb457", "comment": "Malware payload", "value": "9fb31df0ffc15fb518c03b6ed3e61700c4a2c938c793361d84072a3842117fca", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073317, "uuid": "b514e474-b45a-4514-9f2e-35dd5d762056", "comment": "Malware payload", "value": "22d8c75d765e21bad5e3e29eacdb6a2287ac9231", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073317, "uuid": "175767be-0930-42eb-8f22-6619fe382b7d", "comment": "Malware payload", "value": "85048f6b2d414b66658e2c9e5d3d5c91c1c5d2ddeb170ca847611823bb35490f0272a286aa5b15eea18b689ec8936ccb", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073317, "uuid": "b525d7fc-f812-4bdb-9ffc-fba69c3768b1", "value": "T1F806F0DF06F150B5387CB8306B9D0BC5AE415E315A66F9AD2DF231B0B01427E9AC7C6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073317, "uuid": "587e7476-e99d-46b0-8246-07258a2c00b6", "value": "49152:J2Oei7oWllm/WVtI75FYUKmXxqW2/3pcDOo+jPaD/Qr:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782073317, "uuid": "8fa79be9-aec2-40c7-b4c7-b8be1a07986b", "value": 3716734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782073317, "uuid": "9c85140e-6e79-422e-9bf2-931f92e5adde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073317, "uuid": "ae120601-1e5a-4895-983a-e3ce72764cf4", "value": "34BD2A7F.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546f5545-6d52-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782033579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782033579, "uuid": "c0f0d73a-966b-42a5-8e93-4fc7f8882e08", "comment": "Malware payload", "value": "9222bdff9810874530022442e242baf8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782033579, "uuid": "54ee04ee-26b6-4285-99e1-05eb8cd92c7a", "comment": "Malware payload", "value": "a093015413d6d543e3d5d863be6e44b853a2055849df37f8070175aae44d42e0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782033579, "uuid": "3086e991-aaca-4b8d-9ef7-339a0e27d1bd", "comment": "Malware payload", "value": "257bf22146cc9c22d1ae6eb3431bea96a28ca1e0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782033579, "uuid": "fe466036-f896-44d2-af6f-3f23f3b39064", "comment": "Malware payload", "value": "6943b20f151559e914d91b197ff93d140ebd3d493c3509eb9c9a93da0474c5247fe509f56e3d0645812d52412ff0a3c4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782033579, "uuid": "baa90761-9f21-44f5-8cf2-cd6e3f927126", "value": "T1A3316CDB44190E390603DADE73633548B10C9AEB286BDB94CC584EEDC68C2CCB266FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782033579, "uuid": "ad21af5e-3e04-474a-a7e7-483ac8aad067", "value": "24:gcxiHz3H5MLhmGrkEaxhCXECJhGXKn7oqs:gcxir5+hm2kEajCXECJhGa7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782033579, "uuid": "120614eb-7671-4c8d-94e5-1113eb6a10cc", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782033579, "uuid": "4e265977-72c5-46b5-9cd7-4b8b12167b57", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782033579, "uuid": "425cba74-1999-4f90-ba8d-ad19e502059f", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4b31dc-6d7d-11f1-ae13-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1782052093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782052093, "uuid": "1a785465-4445-4673-8942-aaae2ae7a6ef", "comment": "Malware payload (Stealc)", "value": "37a929114a66aca686d48570c8210ee4", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782052093, "uuid": "2cbf2e56-d6ad-4583-a183-f634bc85a3ab", "comment": "Malware payload (Stealc)", "value": "a28022c27f376c469740569538d1ae3c0837fe952383d0bd2cf5b8f304153f72", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782052093, "uuid": "f62ac5a1-f942-40f5-8a35-27c0b7ffc1a9", "comment": "Malware payload (Stealc)", "value": "fe42f6b4c71001ede052bcca8d8df0f0981cb825", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782052093, "uuid": "6ee117b0-0e13-48c1-aac3-c8b6610dab10", "comment": "Malware payload (Stealc)", "value": "1f66172420e681d69ad70a0d5a5df968dcefa21d160a06fc4b335af867d1b73ed85e6add8efa1fd5a789e877b2343f09", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782052093, "uuid": "d574ed94-8605-4275-9228-b5ed3aab4774", "value": "T15385234363E90061E9312FF018BA49836635BD926DB1872B27E4398E6D725C2FD7136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782052093, "uuid": "f344e6d5-b597-4100-8265-491271a26726", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782052093, "uuid": "b49c6da5-1bba-4bf6-a31c-6464e7389ef1", "value": "24576:iarluhWyYWhCG/I5Yu3rHWnY7xtMVofSBKI7tbb79ByzmoJsyDRG1qpZf/32Wxxj:xuhWypGR7HWnVoKcI7PBdP6H3DP8iEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782052093, "uuid": "4b22e2ca-c741-49b5-8496-3855d330037b", "value": 1730560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782052093, "uuid": "e0ad3253-196d-49a8-bee5-572f11ecec78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782052093, "uuid": "cb51fd53-bbbd-4e2f-a929-81ce9df13ef9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38627220-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021936, "uuid": "c1ca516e-eb6c-47da-9557-dca7923c7f68", "comment": "Malware payload", "value": "a7093d821bec24036efd1d512905d9bf", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021936, "uuid": "21edfd1b-e247-4358-9433-28a90719692a", "comment": "Malware payload", "value": "a297582e407e394a831e9c381d94fa3bec95822e18c261798b370537adebe81f", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021936, "uuid": "050f4f9e-f62d-438e-b537-01cd6965ae09", "comment": "Malware payload", "value": "29b8dc3f6ca7ae88bd3d42f6f02955c5c9920226", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021936, "uuid": "f638fe6f-f5b8-4a87-8cb1-e2689d637222", "comment": "Malware payload", "value": "6c16b26075d5b9e50415350c0a3add602fd7c3841f8385d17f33de8bc2c13a0ed5f68a72a695951b98cf6afdbc560a92", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021936, "uuid": "0c8397fe-2548-4d0e-935d-7f0417502d2c", "value": "T1C6753309CCAF8A04DF88ACE7105F0E1F636B597AC65B67E1640B7F833638917B162E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021936, "uuid": "9ecb611d-8f83-4b67-83f9-d8154e9625a7", "value": "24576:FMBDCXkPuZAHb+OFJwpw8xzkQ4D/2WYIo8gFuJlv4XQAxO/O2VD0Pq08DOFjs:Fd94kpRxlK6JFK0xO/O2p0PqDDOFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021936, "uuid": "a94beddd-8101-405b-a5fc-ae142e9d663f", "value": 1676924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021936, "uuid": "d3c8b3e7-d28d-4a9a-b099-6431724c34e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021936, "uuid": "870d8188-8fd9-4011-926b-1be01141ae1f", "value": "devfreq_wq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a9e837-6db9-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782077704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782077704, "uuid": "55b21a9f-ed7e-440b-996e-fd1a7d66376a", "comment": "Malware payload", "value": "37ffb0bd36bd102e38ee507c1db402e0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782077704, "uuid": "276e5c69-4316-48df-a423-ba4e62d6012a", "comment": "Malware payload", "value": "a31bbac723d61178ae45f02937f67b694256220327989155044f9cd97763fca6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782077704, "uuid": "913cde84-a740-4da2-8596-ca965cdced63", "comment": "Malware payload", "value": "4f60e7b632cc10721ad63e1396a4204765cef783", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782077704, "uuid": "ffdef8ce-2061-4cc2-9897-2a0a01686e7e", "comment": "Malware payload", "value": "739ccb146931ae154316fc03f08c07b3536bad384f1a25807a4b6ac709b43de21dec8be0280f41669acf0b0945dd2849", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782077704, "uuid": "c17df650-84fe-451f-990c-396bf7e20308", "value": "T1F2934A30CE64079A4E4B1BADFC911A61C9BC8619113310F4FEEA170D640A9BCF7BE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782077704, "uuid": "f1f88157-8b35-4f5a-a7a4-6f6136832a74", "value": "1536:jYA72vU57qnFO5pDl/4/71b4SEwaOOqauE/uOdtcpgSjuJU5Yjt:jr72vU5GOz1oOSEwa/qabmOdt4gS2U5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782077704, "uuid": "32c2ba98-77ce-4711-8a76-c28ba93cc34f", "value": 97111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782077704, "uuid": "e27bb5b7-430e-4f7e-ac62-c4dbd9d97c1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782077704, "uuid": "ac991424-1aa8-4eb5-8513-611bafd77dbf", "value": "Shipping document.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1983981b-6d84-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782054955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054955, "uuid": "59b21b67-27d1-443c-a5a5-afd010d02247", "comment": "Malware payload (CoinMiner)", "value": "33e6d5006e096f18b3a368497a7cd67f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054955, "uuid": "5bb73518-e933-4d02-884a-e2d33597e2a9", "comment": "Malware payload (CoinMiner)", "value": "a7990b9026200d4d350e6e15750545cd3bb64b52965810807fd1b30bd87c6582", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054955, "uuid": "88279e5d-3e21-435b-9edc-3abc161cf7e4", "comment": "Malware payload (CoinMiner)", "value": "d33d4498eca17834eafb15d97920ad6ecec6a618", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054955, "uuid": "ef15163c-dd39-4581-9edf-32833936f464", "comment": "Malware payload (CoinMiner)", "value": "57b944209b4c27884bd2ac9f10652cc087f49289fc77bc30a6dc556175634b35e1719d8e05eabd94b5ac9a8104a95ab4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782054955, "uuid": "6f85c1ed-685d-49b2-9e0b-8d6cff5ddd44", "value": "T13374194AB7618FE4E378C13006F74BA6A6FE216616E254C6D33CED107A9434CA85FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782054955, "uuid": "003fbfd6-06ab-4826-90d7-53e5067ca701", "value": "6144:XtSku3vTxqi+5vasgeD+r5UenFcJ4CimRn2jC6IOTQPRuMcBYz:XtSniae7YRoNS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782054955, "uuid": "1387c74f-bc01-486a-a862-a643d14b2709", "value": 350376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782054955, "uuid": "6cb488ae-2c94-4d3d-b771-94d10bc3ffe0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782054955, "uuid": "d060f3f6-dfa5-4cb0-9eb8-88522d9e9670", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4a39bd-6d19-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782009111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009111, "uuid": "b53321cb-aafa-4588-b3a7-ee9c7d2e980e", "comment": "Malware payload (Mirai)", "value": "14f5790fe9b1454cef8dc1b4c15bfbd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009111, "uuid": "b1d06ced-0138-46c2-bb92-611f96359314", "comment": "Malware payload (Mirai)", "value": "a99a1521dafef99ffef64e1456378e03532dd8a61acd90de33e9ec52495e99b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009111, "uuid": "432cc318-a1d1-4ae4-87ec-f40dec7da0f1", "comment": "Malware payload (Mirai)", "value": "257ce62a617475cdf262f75c9755c1367f1f5909", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009111, "uuid": "470de2b8-60b7-49ac-86be-74a9d7bcc412", "comment": "Malware payload (Mirai)", "value": "33732af20d1bb62cf0e094ee036ffd8eef9090bdf4f7f1cfe5f144802438b7ff830e1a1924c3b654b8e3fe617f4380e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009111, "uuid": "b0a33223-d719-4d37-9d97-e4e222cca8bb", "value": "T14F3302ABA10278BAC4205DE43EFD6755E5241BBCD0DFA1520F84C2CC5E9E0479AF0E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009111, "uuid": "fad548a8-2e8c-40d4-b148-de1b1141a444", "value": "1536:JkF6Nb/j2/Xu4rNzTY1if/natW4IQIWOI7CZLa:Jkw/jaXNvzae9WILa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782009111, "uuid": "5af36290-094e-4af4-af1d-83da7c3d232b", "value": 53368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782009111, "uuid": "29ba8b39-3986-47bb-a26c-210b5c04b6e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009111, "uuid": "a2df2dbb-c1c9-41c9-a265-0df879b88d21", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81eaa1b-6d82-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782054335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054335, "uuid": "14e3c1f1-6ee2-4bad-8749-ebd36c9fef69", "comment": "Malware payload (CoinMiner)", "value": "da91011a9d9504e6ffdc625158591e4e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054335, "uuid": "8f45eeea-f32c-4a5b-acaa-39a527bfe783", "comment": "Malware payload (CoinMiner)", "value": "ab4f3bb1a973fb8ed6eacfad3e0065b3bf541054cd680031948d43fcf8c84667", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054335, "uuid": "cd08571c-3e70-494c-ae6c-5288c2f6e62d", "comment": "Malware payload (CoinMiner)", "value": "1df4f82465766103d73449123178ea829f8c1280", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054335, "uuid": "b27ca0cb-df1b-4876-8a06-b6389cf39c77", "comment": "Malware payload (CoinMiner)", "value": "8aa90050ea089164cee0458d8e544f126c132e3a09b3923d965a9611051daf925580c0f267dd02bb53666d944c646cb2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782054335, "uuid": "ebd512c0-1303-40ba-ab0a-2b49244ea4f0", "value": "T15BA31252BD4DDC14D4902D726E4FA70C02A1AEF8E22D3E196A07E7307ADCD196974ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782054335, "uuid": "51d087e7-8b27-41e8-8b36-40102b4c8dca", "value": "3072:fq7F1/ZsLvWqXlPkcKRdXw3RXGzRmoy6z0OzYJdzu:fqp1CLvWqXlccKbXw35Mmm0OzYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782054335, "uuid": "0fc2c595-8265-4b7e-8fe8-af1d1004d794", "value": 107268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782054335, "uuid": "896c5d45-8d43-4405-b253-4966a27b802e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782054335, "uuid": "8a975f79-037f-4395-b7f6-395c46012841", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367b7b92-6d4a-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782030093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030093, "uuid": "8a66f581-bfe0-492d-9763-e26e9a7c06c0", "comment": "Malware payload (Mirai)", "value": "d3c9f9a80bbf07d53bb21ec41786d4c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030093, "uuid": "6001d9e6-01a4-4124-8902-154161404e83", "comment": "Malware payload (Mirai)", "value": "abc7b3d5f6d8d04590b60aff1b49b5feeaa22f1b66dcbf8e6de5de28f499a4b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030093, "uuid": "62559ad2-8cf7-4edf-ab9a-cf4bf44ef1cf", "comment": "Malware payload (Mirai)", "value": "75c3fb71e4b403624f07bfc5868852d591da0997", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030093, "uuid": "00d3b7cc-b0e1-4c12-9b23-7522df3824c7", "comment": "Malware payload (Mirai)", "value": "75d57cb8cdc5e1d2b189941ffc362d50483b41819b5c3e4435ae892f9018a299e437bd937f264bf467f864be7fe454d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030093, "uuid": "b46a423a-f012-4382-9346-136f3a100bd7", "value": "T127634C84BCC19A12C6D1227AFB5E518D372663E8D3EF3207ED254F60378A96B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030093, "uuid": "94f393ef-5e77-4004-8a29-f466fa0bddd1", "value": "1536:bdUNVkuKZULih+m9EiUbRPRoIe1FfLxu0goXi5lv6r7aX0:bdUNVkXZULiA6f8PiIWFfLxui2Z6rW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782030093, "uuid": "92d98606-8000-45b1-a540-598394d8dbef", "value": 68708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782030093, "uuid": "f1f9d235-8ac5-4c38-9c47-a44a9268594b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030093, "uuid": "95f2d921-637c-4831-bcf3-221b2e703a7f", "value": "lul.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1cec9c-6d5d-11f1-ae13-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782038372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038372, "uuid": "f9df597e-12a8-4663-969d-cf9323c27d8f", "comment": "Malware payload (ConnectWise)", "value": "35425edb78f2b9cb8836385bd442fa56", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038372, "uuid": "8c5b2721-16cd-4b10-a0d0-068af47cb3dc", "comment": "Malware payload (ConnectWise)", "value": "abe7da6b5be41348ce74be00a5158c0fe7dc138051a84f41b1ebc5f9c49b35d6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038372, "uuid": "dbcdee20-4806-4e0f-9d11-eb60b1e6b7cc", "comment": "Malware payload (ConnectWise)", "value": "2f1d17e5ca6891af0f8a11491cfc9881ddfdcf0e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038372, "uuid": "c10c66a5-4e22-4c3c-bb5a-19e94b87525b", "comment": "Malware payload (ConnectWise)", "value": "53d9b884d59614a8485fb7619ba90608022816ba4c1f69c2e929c76a89f67694fc0019814e636b7489c2e97c0045f8b0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038372, "uuid": "916a75bc-a9b9-4b73-8cc1-cb36e9df1a58", "value": "T11C46E101B3D295B6D0BF0678D87A56696774BC058312CBBF5794B93D2E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038372, "uuid": "cb6b69dd-0def-42a3-8bf3-19badfa67215", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038372, "uuid": "40543032-f235-4dfe-96d3-becf15f95be3", "value": "98304:azIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlT:ahfefPtHxcp9ym3nltDUJV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782038372, "uuid": "fbfd9da3-a5a1-430c-925f-cfb1439b2705", "value": 5716064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782038372, "uuid": "9a7ea5b9-6711-44cd-bd57-ff2a2e370d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038372, "uuid": "c7c3dcca-6f01-48bd-9356-069641c546d8", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4502781b-6d48-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782029258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029258, "uuid": "e6290668-a08d-4c11-8c68-0cc585e4b6e9", "comment": "Malware payload (Mirai)", "value": "28bebd317a061e5baea37a794c130a50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029258, "uuid": "b07cfbca-0e55-4910-95fc-0376b92b5a9f", "comment": "Malware payload (Mirai)", "value": "ac2b95c6cdec6e5732a80799dfad73c8092f6e91c8ec9be2e02d99e6009f2464", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029258, "uuid": "9304b9dd-706c-4903-9641-2f74f96aa5fc", "comment": "Malware payload (Mirai)", "value": "00c67904a6305e8419d43afa39800bd01230b9c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029258, "uuid": "2f8e8317-73b3-4db7-90fa-bb379a787e2f", "comment": "Malware payload (Mirai)", "value": "ce5bff24677c64f3c1303968770e3d1759501672476cdfa10b46689b505d5add6fe12630ece9d8eb5782eeaaccb0f790", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029258, "uuid": "072c9dd5-c190-4fec-badc-fbaba88f5130", "value": "T1A2F34B16B6C090FDC8DAC1744FDAB136A971F85D0138B21F6B94AF622E1DF316B2D660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029258, "uuid": "a255b91e-803c-40d6-9f0d-c92be5ec4903", "value": "3072:4y7pmqp7QbNBc03X5T4qU/YnDm8Ie8enEM2H8+GFufF:p7p9MJK035WXe89J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782029258, "uuid": "142fb70f-dca6-422e-aee8-ba9d05fecc32", "value": 167688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782029258, "uuid": "90159e6c-96a3-4b79-9e07-326626ef7ea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029258, "uuid": "6a9b0a6d-800c-4a5c-bd9c-223ef8ac1ad2", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee554fec-6d92-11f1-ae13-42010a9c0009", "comment": "Malware payload (RapidStealer)", "timestamp": 1782061325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061325, "uuid": "f16dc6e5-b2d1-47c1-b60d-a49da4922154", "comment": "Malware payload (RapidStealer)", "value": "2104ddab88ca14cc2e83ce7d723c4dd1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061325, "uuid": "d12d9ea8-54eb-4d3c-bc90-4788530d8fd9", "comment": "Malware payload (RapidStealer)", "value": "ad8dccd850c2f2a59f2d0d4f72bcb777ce9a5221ab6bb7c68534ab3d8c911675", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061325, "uuid": "c9b2ba04-cbce-4647-99e2-a64dab0fa63f", "comment": "Malware payload (RapidStealer)", "value": "30ca0cb70d208fda6a5e7a5e304f664d2a39e709", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061325, "uuid": "3b9a0f7b-ec2d-4e97-ad56-1ffb21940297", "comment": "Malware payload (RapidStealer)", "value": "660aba2b07a1d8a4872b1f9ca4cb10a61124c26607d8471988520e22603bd26d42c385381e58d0a7b734b3ca95cfbbb0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061325, "uuid": "3c2b1444-57cd-4c0a-90e7-838577ec4903", "value": "T1D753F1A6DBC8862AC23B57FE5A1A0573F5A5C5CC984E406F18DE033900F3A7868477AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061325, "uuid": "ef8ee54c-7e49-48bf-b5f9-5a222218813a", "value": "1536:U6uuKW1ZMblcL9yQ4IDOKmNUIGMXA0Col0:U6NklchR4IDOTFXCol0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782061325, "uuid": "6ce299d5-ae05-49c3-bc31-26c9dfbdda4b", "value": 60817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782061325, "uuid": "35ce2672-a234-41b7-8e5c-71207a7ee06c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061325, "uuid": "1201c368-3784-41f0-aec5-7374a8a29238", "value": "modid-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f88589-6da6-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782069715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069715, "uuid": "c1a4633b-41bb-4465-8c35-86b76e43d928", "comment": "Malware payload (Mirai)", "value": "7b1909d2241034dabd1f4123bf72b04e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069715, "uuid": "3f0dacab-f5f3-4ee1-b868-9616fe3f2f05", "comment": "Malware payload (Mirai)", "value": "ad8e7f3db8766e6ed489f3650d4af7b756388ba1b7510a670667fffe688ae648", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069715, "uuid": "f5ea2d9d-ba04-440e-b7ed-527e494ac1a3", "comment": "Malware payload (Mirai)", "value": "795b6ded738edcf930b40546da5fd3317e092e1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069715, "uuid": "1cf5cf35-74d7-47a0-b521-380137d18721", "comment": "Malware payload (Mirai)", "value": "5609638f86a041535d2fddab495e08e9e9723f0ea99869be52ae3f7c7159ccec4a7905a8e0b1e61dcd360456f64d91f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069715, "uuid": "6042329b-6c71-4fce-af63-32e0ef09c943", "value": "T187B44B52FC509B96CAD12ABFFF6D828C731317B8E2DE71129D194B2063DB9560E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069715, "uuid": "e0559da8-91df-4dce-83ea-da2eca6a0397", "value": "12288:SIBY++9yKbAfXGok8KeD/qkCMNgDb4FCKfLDsT4FYrYe:vBY+Ibmfq0ita", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782069715, "uuid": "ff03590a-61e0-4ade-abb1-6372ecc0d893", "value": 494208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782069715, "uuid": "716a3fa5-df6e-4acc-a2cc-162f393989d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069715, "uuid": "7f7bbb78-3385-48e9-9661-c840e2c534a2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffbfaf8-6d21-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782012473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012473, "uuid": "2f9d9d50-f4bf-4b05-8d38-19f957ab533c", "comment": "Malware payload", "value": "127a0985b609a696fb6b51eb255a5a20", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012473, "uuid": "748fc491-26c7-4808-9636-2bcc5b23e6f8", "comment": "Malware payload", "value": "adfdf6328e31f90aa496a1d7815da10ac0eaaef186d6ee305f8e85db62cbce7b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012473, "uuid": "09812fc6-ce13-4f33-b711-2c60583625e4", "comment": "Malware payload", "value": "0e338ca6bf1bcbe4d06cd865c80a788ac798f42f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012473, "uuid": "cdf8e948-a489-41fe-a611-d184a79cc939", "comment": "Malware payload", "value": "8036c1dc903c6df13c0428f5b03cc5ef14d5dd1acec41153506848cde2ce140c1f66f6d48dfe027c1eb1bba167e41adf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012473, "uuid": "a5ea18ed-7448-4446-b4d3-7a0458c02c61", "value": "T127D56C07FDB108B6C0AAA2318976A292BB31BC442F3123D7AA90B7782F777D05D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012473, "uuid": "9ed83f41-535e-42ff-99ba-277e29ca1599", "value": "4d791c7ff8a04656c4df23bdb9ebb892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012473, "uuid": "a211a3ea-a73c-428d-b42e-f84a0182eafa", "value": "24576:xnmNxNUoT3yE9hI364xYMSj+LbJEPdeCqAj7jKaj26AF+ytZ51vmESBeleDQaFSg:xnmnVTr9hIK4xKGbG+aS6ab17hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782012473, "uuid": "266dc6c4-6ce3-4590-8354-8a48419bcce1", "value": 2820472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782012473, "uuid": "90c3bf57-73fc-411c-aba5-88f8dd6fbb35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012473, "uuid": "de776812-d4c7-4458-99b0-db7de4bf36cd", "value": "upd_helper.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2dc465-6d10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782005465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005465, "uuid": "8c4dbc7d-3609-48e3-9790-15053223fc31", "comment": "Malware payload", "value": "0b57c1ba8062109bed9b0d50f6d4ce63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005465, "uuid": "4891edc9-da4a-4e59-aafe-ee4c70a691ab", "comment": "Malware payload", "value": "afea6f34930cc5a88cc4c91969966e325e198c9b17882c58bc1b3bf5b38caba4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005465, "uuid": "68656b08-7156-4cf4-b6c9-5a830de43526", "comment": "Malware payload", "value": "3f691f867c05b21f88db03375dc2aa6cf720bf73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005465, "uuid": "8bc31975-ffde-4979-ad4e-4e9105901f25", "comment": "Malware payload", "value": "debb787033851359e57b5958a354e549e478bf3890b0a8e7b82a5aa696575becf2b871a7587adf5fbdf8712cc6548050", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005465, "uuid": "dcdd4a7c-f854-41bc-a1a0-cf6dfa84da05", "value": "T19AA3E69B6CA550E4D4BFE078DA27B6077EB27014073827E72DA09A610F67FE165BCB10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005465, "uuid": "8cdb6536-68df-4763-9bdf-cd84ff13dd2d", "value": "1536:FpssjJVez45Sv5uFzOP8OYOeJe/4Tlm8FNZEq8:FxeuFzOPWO/E48DZp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782005465, "uuid": "0ce0c667-76c8-4078-9e4d-cb2b911f8940", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782005465, "uuid": "e962e01a-2bc1-4ada-a2e3-910d9edbe8f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005465, "uuid": "c3eeb384-81ed-40ba-be29-3e5575197fe7", "value": "5fa19c6a9f1b1924ee4cfde38e3500150c3c7c92c5537bfedb22f16955f5e333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed087af2-6d20-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782012360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012360, "uuid": "fc7abe79-005f-423d-8341-03eb7908831c", "comment": "Malware payload (Mirai)", "value": "714b5425db8e7a0256fd0aef30c1bbcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012360, "uuid": "a2c3758a-0cb3-49fd-9163-7824416a505d", "comment": "Malware payload (Mirai)", "value": "b11af840cb0228fbb62786d30397564cd4a45b1d67b9ff1fb9e47bb7012de1ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012360, "uuid": "990ae73e-7424-4f5f-a5bb-e5ea77c1d379", "comment": "Malware payload (Mirai)", "value": "f1e09013ac754545123374ed4a10686e30117723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012360, "uuid": "ea943074-5c9c-4703-b771-c492ecb44dee", "comment": "Malware payload (Mirai)", "value": "db0c5b2d186deadd2be1b912f256111e96cc124be781fc89d245cb0ac5159606b9de49b7a09cfff698709b6e25d2bc39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012360, "uuid": "66e83a7b-c167-472b-bfbf-2836632520cd", "value": "T1C123F17BA350F566CAB1DC3D8D6AD082B23A093977E2607B024695645506FBFA3F700E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012360, "uuid": "afdaf251-b695-4e62-b6c8-7bb8f993e7d3", "value": "768:OZ6dRzk17ZH6Okjz3gNOkiXBqnGV4A1N6u93N49jxKL6zfWgTyxE6ReODygzs3U/:O4dRzkrH+LgMkYD0jkLfgTyxWOrezw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782012360, "uuid": "b27a09bb-a25a-4bdb-8891-e8dfc59b2c1e", "value": 45684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782012360, "uuid": "55117948-f06d-44a8-b82d-9f61da99ef66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012360, "uuid": "74b3d2fa-0f82-46af-b51b-75fb7a514c74", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e16cde-6d20-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782012348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012348, "uuid": "9d9a1c07-9642-4bcd-b69b-70efe65b16d9", "comment": "Malware payload", "value": "30dca6e8b68470ce6950312842bffcad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012348, "uuid": "21d55e1f-6214-492a-90ec-982490f94d75", "comment": "Malware payload", "value": "b14247dde8fa176b39d21b1bc2f8941a690ad7a328596a80e246156d2da48101", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012348, "uuid": "49276701-b853-47cf-a282-180e66159f79", "comment": "Malware payload", "value": "2bdc89ed8c114b97775a28057e79b95c6719658a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782012348, "uuid": "8f66bd61-94ed-440e-9cf8-0c2f3966bacf", "comment": "Malware payload", "value": "e6264f1d5dd313b57e0135f559eb039708578790d910162b6df0858c79865904e3e3075aaf6f7ac4e0aab634a8dca777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012348, "uuid": "8f92f128-85b7-4dc0-b3e5-2427a729528d", "value": "T1CB467E02BB5CCD55FB1BC379F81D7AB6C735A9AA5B82023711B09BD7E4A3584484CE2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012348, "uuid": "6ae0dca4-706a-4740-86ec-a584676b7815", "value": "d9cdd14f1e51bf231e8fd705275c2c8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012348, "uuid": "c9aab384-3b17-4ec5-aa42-f30c60889a33", "value": "24576:l0g2i6MSYtjab51SkVh+sfs/RO9uj0pU4snT7VH5ciHy6vZsw2d9J5OuLlkE:fKqlE5cIhfORJ5FShB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782012348, "uuid": "257964bd-dddd-4c64-be24-050a5ae92ce0", "value": 5722624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782012348, "uuid": "5e8d7ab8-f760-4ed1-9206-20e351f4237d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782012348, "uuid": "10655efa-6560-47c2-b60a-420b80106b42", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8c26b5-6d92-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782061268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061268, "uuid": "fc8a93e9-5879-472e-9f8c-12c369fcb94c", "comment": "Malware payload", "value": "e0fa6f4d40a11a4c2acd94ac14b1bbf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061268, "uuid": "fe86a623-515a-4c23-8c89-2f5e7c3c8fa4", "comment": "Malware payload", "value": "b4d64da31ab48caf020c281af70b4a475e4526fec9da5e17272153017a20f2ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061268, "uuid": "efe3639f-c4c7-4fc3-931c-3f93887b78b5", "comment": "Malware payload", "value": "971e93f7ef549744901589b55f21b05c0ba5d8f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061268, "uuid": "f4248c88-6c06-4a41-99b2-9c0b097c9d0a", "comment": "Malware payload", "value": "dc575e6666fdb978808edab3eee67e9f73b3880e16adf1865bdda6f3657121e240a28b7ff0649d6d2d9f207e56b0c27c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061268, "uuid": "e574525f-3e15-4d64-825a-58c2431e1d2e", "value": "T127F3F65B6CA550E4D4EED078C627F2137EB27418073833E72EA06A610F67FE1A5B8B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061268, "uuid": "09653141-6b4a-4f05-ac88-687e488be4ea", "value": "1536:FpssjJVez45Sv5uFzOP8OYOeJe/4Tlm8FNZEqPVzOJlsdLNxPgzVHL2LsCLBgw1e:FxeuFzOPWO/E48DZpyxZIsCLl1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782061268, "uuid": "1092b8c6-822c-49f8-a3d4-9317f8d86827", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782061268, "uuid": "332158a7-30e0-4ea5-85ed-885bb8c8e2d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061268, "uuid": "54ebdd4e-8e99-4186-9fb2-663bf968448c", "value": "b4d64da31ab48caf020c281af70b4a475e4526fec9da5e17272153017a20f2ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfa8e59-6da5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782069351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069351, "uuid": "05fa37f9-3e5d-4a51-ae98-1c0d78861c92", "comment": "Malware payload (Mirai)", "value": "6402083b73c6f20862eaa905baf7b3cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069351, "uuid": "968db6de-5040-48b3-8f52-b9b9b74ca362", "comment": "Malware payload (Mirai)", "value": "b516ca12c85c186a1aecbeb15b354cf701b8d126241fefa719df7fd13cdff1a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069351, "uuid": "e6378899-07c5-4341-a5f7-0d8407a9aa0a", "comment": "Malware payload (Mirai)", "value": "3cddbf83d7efbf4906580bcafe72ac3e42e28890", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069351, "uuid": "902bd4a6-3a1c-4f65-bd3f-e6ca4e2730ca", "comment": "Malware payload (Mirai)", "value": "79839439281f130d3ba1fa36b72a36f192467d0aafef48f0fc992df64423d81704e5762a49e08191d6a5e57d7afca1a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069351, "uuid": "f627a943-9b70-4751-b1cd-54459eae8bb2", "value": "T1DE63F273D0BFD885F74A86764ECEB80C966464297A0C8985ACE33A1E4943BD52C187F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069351, "uuid": "3a308fdf-6886-414a-b44e-b279435a8d36", "value": "1536:+1XF1fgJtpoikokfQUQReHemWVF/hzC85cljxUx8FFBw6nouy8tyx:OXF1fAn7kfdooemWVthzF5YFFtoutA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782069351, "uuid": "2ab95e84-791e-4c69-876a-6eb6fab299dd", "value": 67780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782069351, "uuid": "634df20d-78df-49b8-8bb4-99125028d368", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069351, "uuid": "ad5bf268-97e5-4754-acfa-83c06fe16aa6", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61c4669-6d5c-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782038145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038145, "uuid": "49c94d05-a9b3-4a6d-b807-49b2ab72d9dd", "comment": "Malware payload", "value": "95eb6cfea10adb65bc28c30565b91ac5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038145, "uuid": "6a8dd08e-5b70-41f2-8fa8-ab820bb7c31b", "comment": "Malware payload", "value": "b5d97c5e352ab436643e8bfe1428de72b0dd7616392bd6b0c3bf13a47b7f794c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038145, "uuid": "51ba31ca-2627-4864-a7b9-6b2fce0624ef", "comment": "Malware payload", "value": "0f7e9f0321bd12e5cfc6291873b2b8c94df38f41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038145, "uuid": "0ad753e8-579d-4e7c-b7e8-f5e0f7cfd785", "comment": "Malware payload", "value": "80a5fe0d666f523e9b9b03fb75a1a0feb0e6842f13585c8ae0e8ba2b20c5a4f354533d4d9a47608c4516026a35509cbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038145, "uuid": "e2678871-b0fc-4ccc-96a7-141c743f5da4", "value": "T19AD46CA37B11CFA4E314C27009F3C6655AD521A20AE250C5B2BCD3187E61A6D6D6FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038145, "uuid": "7c03a76b-be0c-446e-9d0d-fcdb9cb6f919", "value": "12288:uI147lcaDO2lFlf6Whg6FPSmFu2rlJAP1FBPi8pkrRaKhyE:u+47lcaDO2Lf/hg6XFuwlKB+0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782038145, "uuid": "f8c08ce0-4f83-46a7-92dc-2c43939e4519", "value": 649556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782038145, "uuid": "bb19118e-8acb-4c46-bf32-d95881531368", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038145, "uuid": "3942cf1a-233d-4b60-85d5-ef8877bf44c6", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03a0680-6dae-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782073354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073354, "uuid": "afa96fed-1288-4023-97f5-d31ef6a63684", "comment": "Malware payload", "value": "5310a4e454129a4a396555497e7de51e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073354, "uuid": "e576c8b2-c8ff-492e-97c3-fc7d079fa807", "comment": "Malware payload", "value": "b680dc5815223eff566b30fa251267b91b1f10d2eec2522311def684b4baf59a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073354, "uuid": "491f0fb6-ef5f-4a5a-8b69-521bfd4adf20", "comment": "Malware payload", "value": "18a35c1e773d8ee850382c7d5007b5c9f1135479", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073354, "uuid": "937d45ab-db02-49c6-839d-95ccab763f6d", "comment": "Malware payload", "value": "bf268e715b0d2c0375b2860c03a0d3bbbdb30738cdbfe5f15b2b1726850117dc87e9ae6c95a150bf6210bba3c321dcf1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073354, "uuid": "9f018f52-cadf-409a-a46f-e62fb9e4b443", "value": "T10F218E10AAFC8E05B673DA0997BBE49015767AECDD35CB0CC354C10C16AE944D866F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073354, "uuid": "3f1b6765-14d5-42ac-82e0-ed383a72fd88", "value": "24:Qlv4o4Kzyu52U/tMlBygklBRlB0P8wPMuZJBlBMwA6PFv+F5TK:A4oPtM7ktApDPwF5TK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782073354, "uuid": "8cf8265d-f59f-46f1-a0b0-88f2a34b3bb2", "value": 1192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782073354, "uuid": "c1ec2a0c-fd1d-4b13-86cd-0983ffe75d2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073354, "uuid": "f641a6f8-7c07-4d4e-9e43-2d30b8b82490", "value": "Lwoqo(3).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e93eedc-6daa-11f1-ae13-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1782071392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782071392, "uuid": "59c2c9f1-8971-4d9e-bc01-cc3b8509d28d", "comment": "Malware payload (Gh0stRAT)", "value": "50b678b8ac5df9d46832c26c409f46d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782071392, "uuid": "3917781d-e72d-4a7e-82be-3f8010917cdb", "comment": "Malware payload (Gh0stRAT)", "value": "b6a854625fc19895e2520b9e055b9afd74d15e30879d48b6d35e419215a18ba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782071392, "uuid": "96f442e0-1624-4fd4-84ee-0f50c5522f2f", "comment": "Malware payload (Gh0stRAT)", "value": "5da2fed14b341f5b88ee038c807c5d90dfcab74c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782071392, "uuid": "f2773380-4627-4040-bea5-79adb54fb043", "comment": "Malware payload (Gh0stRAT)", "value": "a35929278af20df72101514218678b4de2e1f720a4668bb61fd5985700cb53c00df311ba8e2fa042bf9137b7141a3fbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782071392, "uuid": "5ddfa609-80a9-4ad5-afd9-269b52b98c50", "value": "T16C4602166587E56AF3D97A350A62E1F1073B6E212922CCEE86F03458CF360D35E3F616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782071392, "uuid": "c6f16b41-79dc-43e3-b6b0-2b5d1b7b0b06", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782071392, "uuid": "dabc2fe1-8bed-4c48-bba7-dc6382a1657c", "value": "98304:W5fgQ+yJKTKK4KKDyK5kZ1EEEEmEEE1EEEEEEEEEEEQKK1KKK1KKKH/Eoji7/8Ca:ab+y2Xi7k5euxDbARoJQCvMivpvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782071392, "uuid": "c452bf08-6cda-45af-bff3-ecacd59704ff", "value": 5837338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782071392, "uuid": "a9cd9646-2d6d-4338-9904-58c2d119ab24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782071392, "uuid": "050d1e45-37d2-45b1-b1b0-036081001d4e", "value": "dingTtalkx64_down.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d7fe65-6d23-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782013261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013261, "uuid": "21ade494-77ad-47d1-b507-01fe2005bc74", "comment": "Malware payload (Mirai)", "value": "3ae72f88d7d5f1d523dfb05b27392caa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013261, "uuid": "719d1f48-4705-48ca-9ab1-e09326387260", "comment": "Malware payload (Mirai)", "value": "b935220e421a05d20875dfa331047120a61e8fc13f790955e23a94dd6238835b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013261, "uuid": "34e29ebd-bb14-49bc-b0c1-03b9b618a3fe", "comment": "Malware payload (Mirai)", "value": "4121092c517fe5059595649d0182137419cf9b8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013261, "uuid": "6751120d-bc0a-4b1b-8321-321a8e3e83d5", "comment": "Malware payload (Mirai)", "value": "ee6378bb4e05ff35647d524b0355d5981cc779444c91cc63a36be54c66a58d02acc77ebd24c358f73cdfa554a991235d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013261, "uuid": "7605d076-9008-4162-bc99-cf4e8350c59f", "value": "T12C242A46B8819F11D6D016BEFA1D128E332717B8E2DE7212DD205F75778A86F0E3BA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013261, "uuid": "b9e1255e-18c6-4855-9eb1-7842f894c0b8", "value": "3072:HSrCgCxKeVmBQqx3R71Vbc6Ma8Wcl7gzUeTRYxXNorqsa5/4/ITE+Flju6QRqAdx:ggvmlxh7r2k5yxXOr7aGIE+fu6QRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782013261, "uuid": "36a0d651-7371-4dd5-84fc-72a9c7d3ac9c", "value": 223516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782013261, "uuid": "1adab4af-3d31-4e7a-9375-c5da24578541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013261, "uuid": "b6418f6a-461e-4ff4-bc55-3d48d4e612fa", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6495b5fa-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782022010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022010, "uuid": "b9da41ec-bbfb-4539-a79f-6e5f8c5815d5", "comment": "Malware payload", "value": "a899b63de90a87a5aa8773966b6af914", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022010, "uuid": "be627835-d3ae-4466-9f2c-6daf17f23cd1", "comment": "Malware payload", "value": "b96300a2a458ff15ccd1184cd27d75d98015310161540032a29049b02b1de595", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022010, "uuid": "ee0d817a-78ce-47f2-8964-e8ac490e97b6", "comment": "Malware payload", "value": "ade6020a7a0e73385c7544fe9d4be2eb31927dc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022010, "uuid": "09e60b4d-8f55-43fa-8b5d-f38c701322fd", "comment": "Malware payload", "value": "6fd1f0230b971481e79ee57963762b3d857974ca6c9c09371215868471b7091ecd15d0c5b334a132e4c2b47ad8605329", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022010, "uuid": "f7603ff7-1575-4323-b725-f23330d38e30", "value": "T164565A81FB48A126D94A0A324CB30B70B3916D85C1F48D6F5709F72F45B26F6AA4FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022010, "uuid": "440d6abe-69e3-41a8-8c81-8aef274cb6ed", "value": "98304:wGFx7PeX4PHS2bqQVSsVeaXq8L9pG2vgnEjE5:5PGOfSbavUnf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782022010, "uuid": "a65b0a3e-4b17-4438-9e4a-b34c5c319cd3", "value": 6094996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782022010, "uuid": "c5c8012f-2f9f-435f-82a4-d41507edf252", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022010, "uuid": "24239fa8-c9de-4f4c-a26e-998139284bfd", "value": "devfreq_wq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8c1ef3-6d84-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782055173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055173, "uuid": "6a69821c-e276-448d-8883-015dff0cf6ba", "comment": "Malware payload (CoinMiner)", "value": "5602173a4b3571d1723a2fb3e066c1dd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055173, "uuid": "bd3c10b8-7974-46b2-ba62-424359faa8b9", "comment": "Malware payload (CoinMiner)", "value": "b98d8b8f4e73e553bd42bd8afd12d6afc1e5ff38a651f1e6fc3d1186d142a8ef", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055173, "uuid": "14966482-0568-4073-9a22-93f26ff795c4", "comment": "Malware payload (CoinMiner)", "value": "69520de691eb1dff454c8139edb69a87807a612b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055173, "uuid": "883bba7b-3ef8-43d5-9762-1fe02ec2198a", "comment": "Malware payload (CoinMiner)", "value": "c28fbf3900019db1d8fecc82c3a79ec8881f64f4257c1c44399209ce020252900f4ccf97dc25f80b0f9fba164c07d7de", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055173, "uuid": "7f0bcc45-b923-45b3-80c0-330c88819add", "value": "T1F9B31223C3685651F4D77D72E12D87A116E19A1EB442FDD9E268AE311D2FC81C0B38EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055173, "uuid": "685c7225-daf0-4769-a877-2688ce99ed7b", "value": "3072:nykkdgciUVeeuk6i82/NYVH0TDkd2BtxcKP+O7W4u+qgwV4u:ny/VeeRbFXMdWJ+Oy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782055173, "uuid": "c75007a9-7e02-4305-a0cc-6364b08421fd", "value": 116084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782055173, "uuid": "73f8e247-bf23-47c7-9109-0a733c27075b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055173, "uuid": "1dd9bf89-7211-412c-9b91-0003c2ccc271", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fe0cdf-6d4a-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782030092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030092, "uuid": "61637dec-ab31-4137-9d5a-4d9a0540e78c", "comment": "Malware payload (Mirai)", "value": "7bfdd4b9e0d3e01cf688c0b25d86dff6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030092, "uuid": "6c790e03-b742-4841-a751-3638f89bcde1", "comment": "Malware payload (Mirai)", "value": "bc0b6448957fc6fde56f0c568c36fd0b9ed796cea2bd2a1d2d0c3051bd65f46a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030092, "uuid": "46e41697-72c7-4517-a336-1afb13966b18", "comment": "Malware payload (Mirai)", "value": "c68fca609826cf86ee73ec13b6331b9159a46663", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030092, "uuid": "ad7ab610-2bf5-4160-a716-fc162e3f5a94", "comment": "Malware payload (Mirai)", "value": "c60ddda2339e511385b72e7b8000cedcf92ebb4f06a13e648da9cddff982653de8c06e54e699a4da58a3aeabb8840d86", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030092, "uuid": "4bf46696-1371-4611-a94f-14fb31dc7c6d", "value": "T143632984BC819A13C6D1227AFB6E51CD332627E8D3EB3207DD255F61378A92B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030092, "uuid": "91f5da1d-9760-4208-b302-294404ae50e8", "value": "1536:eZ+TsS7SPXk4KtbCbZkt2Y9YAIledZmqH0TK/i6:eZ+TsS7SPXk4FbZov9Y/eyqU36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782030092, "uuid": "22575117-533c-407e-ac7f-eb7dbe6ea6ad", "value": 71876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782030092, "uuid": "3fa2fd8a-49d7-4c1f-aa55-0140ed7fdcc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030092, "uuid": "04b9a43d-2873-4633-8a12-6087a902a9ba", "value": "lul.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26788682-6d3d-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782024483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024483, "uuid": "65b7c418-ab4f-4fae-b3c3-1cc36be6d113", "comment": "Malware payload (CoinMiner)", "value": "00e5726f74cc22fd78200c06088ad31a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024483, "uuid": "233dfe8c-dce2-47ef-82a9-67483aa9d1a1", "comment": "Malware payload (CoinMiner)", "value": "bf65f9121b6769dd479a5201dd70da266fa96316a82289c3fb4f6d92c4694c1b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024483, "uuid": "833b1358-be09-44a0-a63d-c5a30198397c", "comment": "Malware payload (CoinMiner)", "value": "1cb16285334cc0a3f5cf162ced315f0f282e597b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024483, "uuid": "8650b279-be4d-43e4-a345-06a1f2a650d7", "comment": "Malware payload (CoinMiner)", "value": "851ec1f4fffa0100e3def213422db34928b81a3ef78bc4458a73190728a8b304c7ae7086e6b375c096d4c79fd1bf1479", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024483, "uuid": "153f78ef-7548-49b5-b5b5-35255fa4500d", "value": "T14AF0A3F92500833217C1DE12F35FE29CC92A56A7F98C3E9875EC06819B230D992E37C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024483, "uuid": "3627ecf0-b767-4ba1-9a2f-37c4a58376e7", "value": "12:mJE8GsYuSqFK5aaFlm9tdI8jMRAaINkakuBtwDspE:+E8Yz+1Olm5IEMRTIKuUDspE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782024483, "uuid": "6363c8ab-3de8-4f78-b906-a24b34284270", "value": 489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782024483, "uuid": "ace5d5e8-30a6-47bd-b5b8-3a9c24c08559", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024483, "uuid": "69af7e99-2445-4fef-8f9c-4d5e078a702b", "value": "m.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd0849c-6d69-11f1-ae13-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782043445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043445, "uuid": "dd544b59-9a3f-4b70-a7c9-590d5369311a", "comment": "Malware payload (SilentNet)", "value": "fe49dd86aaafa36d28a52527581327e8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043445, "uuid": "2ae73369-75e8-42c1-87c6-c39b2e4f5823", "comment": "Malware payload (SilentNet)", "value": "bfaa02a0548850aff68591dfaf8934ceb855aaac67c18eb9d12e553f91de60a9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043445, "uuid": "ec213891-00e2-4d14-8c84-69f2500d4f5f", "comment": "Malware payload (SilentNet)", "value": "c2ae660416ca8221abad82cd30bcc5e1d5ddc147", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043445, "uuid": "bfbe2ab3-883b-4ba3-8027-a786f80ee243", "comment": "Malware payload (SilentNet)", "value": "aed40ca22c349427a450c1cd918fe92dc7211e26fc6253ba01cd259ac96a3010c4b30db08e9c8881ba0face4ec1982d7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043445, "uuid": "09bc503b-5dcd-47e9-a941-b4a189604f2c", "value": "T13826339CC489258ECD2644BEBBE91ED663DF87514BB0A8C3BE93C24ED0D104E71AED54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043445, "uuid": "647a8e54-fe43-4839-adb8-ffed8468ef70", "value": "98304:K1gjK8jL1D/eWz69ocggQHKTD51qISEmM5jVTuCPJb44ZsVBVm51IJ:KGjX/eAqTFwISYBzhb44gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782043445, "uuid": "110407f1-8664-4528-b1f3-4ac1d63c364a", "value": 4678382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782043445, "uuid": "018620b8-4084-4ec3-8736-27e33ac878ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043445, "uuid": "383afafb-43d4-400b-9aa0-890e3139325f", "value": "mod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba60d3b-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021941, "uuid": "704feca6-b178-483c-8cd8-1c7d36573270", "comment": "Malware payload", "value": "05a06b8b4d55d1383cd7471e6134376c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021941, "uuid": "5742faa9-6afe-47d4-9b78-5670cb7203bb", "comment": "Malware payload", "value": "c117a3dc1230b5d7c5ddf453335bc0efde4f0a1be66f7c1d1dacc00c7230e248", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021941, "uuid": "96d63fa7-5e82-4084-b121-19515d88659a", "comment": "Malware payload", "value": "57fea84ef9694cd331244980dd7cfe671f7f7c34", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021941, "uuid": "823851c5-0166-4d8f-b6c2-7c8e82a25af9", "comment": "Malware payload", "value": "ab31069180a8fa1c82ed52a253133e118b733d73e3cea2e7f9c26700d9dcbc7a53af23194cee874a5df630f20181eed3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021941, "uuid": "8a1a8d7d-deb3-47a1-8c01-b8118b3caf2c", "value": "T10866F855BDC22B66C1DC03B844FE626662643E454A95072323F4F7E83E7773CAF5A888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021941, "uuid": "85dd86a7-a210-47b6-9d19-4c4e300a51d8", "value": "49152:ld3XrPZRKiFMfoijL63/qxqrZZiucOYS4+LbHg5Eu:lxbBRqft63Xe0OEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021941, "uuid": "6523f33b-dd1c-4a26-94ff-4b67542c8947", "value": 6815892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021941, "uuid": "e30de12b-ed82-47b3-8dc4-8dbf10c15c55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021941, "uuid": "28dcdda4-9b6b-439e-888e-b2448eb2909b", "value": "scsi_tmf_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadc6c44-6d3e-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782025188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025188, "uuid": "a8a50ff1-c52f-456d-8391-a4a928624901", "comment": "Malware payload (Mirai)", "value": "05fcedd6c8b1eb877c4a8c3771547ea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025188, "uuid": "d83c47e1-3730-4875-833b-bdf9da9065c6", "comment": "Malware payload (Mirai)", "value": "c32194920e005c8a84ca8b265b77a00374ad7aa3e866b9f36bf71df6de5aa01e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025188, "uuid": "c0d468a3-f08a-4b74-8285-28f50529f3bd", "comment": "Malware payload (Mirai)", "value": "7778b3ef43baee5a29f31ecc151dc6a643570f9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025188, "uuid": "025acf41-1e74-4cf3-a702-7bb3549d8f19", "comment": "Malware payload (Mirai)", "value": "08707f562f365f00b000a2ddbcb22c1df40cbe6538b30cf69a3d0173f116720688edbbbd639308c54ff890fb75eaf649", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025188, "uuid": "c7626e3f-c6d5-4607-b598-6913a1430543", "value": "T1E004F70ABF610FFBD8ABDD7702E90B0524CCB95B15A93B797534E818B50B18B49D3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025188, "uuid": "d24dba5d-866c-4f7e-be05-5d4bf8bdb6ad", "value": "3072:ClQmZKSeldcMNC+Cz3G9UrLnPPs3xnT/pMf:CPZYno+Cz3G9UfHs3pKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782025188, "uuid": "8c820bfd-354e-4efe-8c43-d4ee1493d99c", "value": 174444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782025188, "uuid": "817ec22f-fb7d-446e-b59d-eaa48f0f0e44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025188, "uuid": "5b09a5b7-78e5-41ac-b4c2-e042f42eae22", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cccc8a1-6d96-11f1-ae13-42010a9c0009", "comment": "Malware payload (SilentStealer)", "timestamp": 1782062692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062692, "uuid": "7b88eccd-9ab4-41d1-81b0-66d0af9e4124", "comment": "Malware payload (SilentStealer)", "value": "3478e7eb963d1449428b194f8ea2756d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062692, "uuid": "2a388acd-e2b4-4f1a-b2c8-5b009a52833c", "comment": "Malware payload (SilentStealer)", "value": "c57400321150342ce0f880e47cc3c6b54a82b6b82ce844ee31392d5170ce7ec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062692, "uuid": "3eaa477a-83f8-4d1f-b50f-2af605f39690", "comment": "Malware payload (SilentStealer)", "value": "f8f3e351f863bf76500435a280416e71be087cb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062692, "uuid": "b71d31e1-8b88-4425-8933-1ad7b8aa185b", "comment": "Malware payload (SilentStealer)", "value": "f3d59e8e54c15c7316a1aaebb77c894e47be0d8e38567d61b60347ba225ed2dcbb51519d2272e3b2cfcb2ea4d8440623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062692, "uuid": "94c1e0b0-8541-405a-9318-9ed5d8a7ab79", "value": "T1ECD7338136A9CC1EEFCB637C215840BDE89EAF3930D0DC56770B9978E61B8869C6C195", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062692, "uuid": "542bbc24-19d3-4ecb-b22c-f95142b0301c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062692, "uuid": "a0b9cef2-36ae-4426-95f8-48321b66310e", "value": "1572864:qIHVEV7HONGdzywSR9oL7fxnsBFX29g9stfXJu5:qMVENHy4zytR+fxdb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782062692, "uuid": "aa146c7e-388b-44a3-8f7f-164c67beb166", "value": 60802968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782062692, "uuid": "3f3d5394-c811-4230-9958-f1636e4936b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062692, "uuid": "c8018bf9-8c9f-4e24-8947-d28f20f271d3", "value": "executor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3757b32-6dae-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782073333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073333, "uuid": "64aa60dd-849e-401c-9af2-4e8a5c9d3f9d", "comment": "Malware payload", "value": "a652fcb1e5206dd1378ffe1964719677", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073333, "uuid": "ebbcdd16-ebdd-4573-a04e-1342b673d55d", "comment": "Malware payload", "value": "c722b6557d74a0a6eab889a5e7d81032ff18759bb42928be3a8e4393b1e26f39", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073333, "uuid": "0c692008-27be-460a-8a72-a10125cf495e", "comment": "Malware payload", "value": "6d19c80aaf6d047f9e5cdaf8cef292a2fa49911e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073333, "uuid": "46a8b2ec-7760-4b81-9cc7-7e1ba42aeee4", "comment": "Malware payload", "value": "f4e5a30d90bfa19ff898bc453526cf169c806cdc7e5cac4ae450bb6ff281436254293854726d746245545916891f99d5", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073333, "uuid": "40f7928d-bf4b-4592-a7cc-4592db407959", "value": "T1CC119410AAEC810975736B09C2BE91541577FA2DAD76CB1D0414D14D06B2A48DDB7F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073333, "uuid": "c37bcacb-b5da-4e69-9f4f-73d265f251cb", "value": "24:Qsx6O/4+yu5b7nxByg5BI8lPMPMuZJYMwA64Ivt55Xhp:7x6A4UnxZ5dM0sg55hp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782073333, "uuid": "29b32d23-451b-4664-9aa8-0038c46867d3", "value": 1064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782073333, "uuid": "47f75e46-5276-49c7-9d8f-055c08070390", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073333, "uuid": "1efe6d16-6d9a-439f-ab4f-5f78c58dd2bb", "value": "DvVbs(1).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c08303-6d80-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782053315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053315, "uuid": "e1579be2-a6a5-4c56-9eec-a65a57c83f1d", "comment": "Malware payload (CoinMiner)", "value": "c55b34c253384691890c935ef3f56482", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053315, "uuid": "7d811c7d-05d4-46fe-a8a2-b36191648e0a", "comment": "Malware payload (CoinMiner)", "value": "c7709ac88c8be581a74510700227c2783acd350780b2e626946ea88d10bf3e73", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053315, "uuid": "45f0cc61-3782-44cd-b80a-9643a43dc11a", "comment": "Malware payload (CoinMiner)", "value": "5f64ad116d16c0d914ac470fcae830ac38e0a38f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053315, "uuid": "94548817-c39c-4f17-af23-b428d396776c", "comment": "Malware payload (CoinMiner)", "value": "dd0edd790b40d29e455b12e763b153c17c0689a8ac4b08490b7ed6f080c2d07126ed5d3361d7176b4efaa75be96a8342", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053315, "uuid": "9add357a-cde3-423a-a6ca-44348c2bab2c", "value": "T15C342AA9BC40DB66C6E427BAFB4D429933134F74C3DD3106CD245F2976EB55B0A3A282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053315, "uuid": "590d4227-bd25-43a3-86db-a1c65bcc443e", "value": "6144:/zURh8D86Uj6nhCOArXJ6GfoJ8449U8kz24zp7UOM:YX8Izj6nhCOArXJn4+k7tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782053315, "uuid": "aa51745b-6aa3-4023-9715-7e63cb4bfe43", "value": 247644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782053315, "uuid": "4367ec0d-81c2-480d-81a1-c7326f0bb73b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053315, "uuid": "440cea81-55cf-4d66-b2be-56ccef500b4c", "value": "kworkerd-irq-bal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75733965-6da6-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782069712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069712, "uuid": "29365c5e-8d34-49ce-8a66-c5340969bf3c", "comment": "Malware payload (Mirai)", "value": "0e35bed6ed411471eb0a847367b3c805", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069712, "uuid": "a5a022db-4f14-4cf7-8837-6f5842c701fd", "comment": "Malware payload (Mirai)", "value": "c81f71c9987070d131647f840c5c449a7167573f1fb3a02743e304b682a887f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069712, "uuid": "1d395540-9d83-4d8b-92a0-7116b4d7ddce", "comment": "Malware payload (Mirai)", "value": "c1e94eb9ff72e715d91206c2cc10bdb2a318fd40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782069712, "uuid": "3f1cfa28-8e75-4ce2-a9ff-daba266a61e6", "comment": "Malware payload (Mirai)", "value": "b7027e5a81fd3301e0e6da2f38aeed1a90cb18bc7c46cc387174232b455c0877c0e215c1c50247e1559be2d3c04c676c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069712, "uuid": "ec1ccdbd-d0fc-4965-9391-f9d36ade812d", "value": "T161E24A0AEBC3E8F5EC5315B662776363C736E5392052EA12C3293936DC12A51E717B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069712, "uuid": "4884c591-bef7-435d-8826-82f94795e3f9", "value": "768:rJJV2gs+qrkr3hHLHoVtNlWBChS8SSVCYSlMI3JW:rZqTrQxcVzoohgdYSlMEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782069712, "uuid": "482daecc-b06a-4a35-a6d7-264c7fb0656d", "value": 31440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782069712, "uuid": "d480b099-8e32-4dad-bf7a-966eff2b292d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782069712, "uuid": "cae0e7ca-7e52-498f-b0fb-7bd15857f0f2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beeb693e-6d1f-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782011853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782011853, "uuid": "7457b4d6-8d74-4dfc-bc6a-bc41dce6bfe8", "comment": "Malware payload (Mirai)", "value": "6b0607ec05c7589132d1dc7c041e379e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782011853, "uuid": "b58aa19c-8e22-46d2-8b56-f73408ad312f", "comment": "Malware payload (Mirai)", "value": "c95a77a580f717632121f5e0444cdf0bc1b8883f32fe594bf824e5fafd99b2d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782011853, "uuid": "0ff45ec1-f56b-4ca8-87d8-84cb52c7fdad", "comment": "Malware payload (Mirai)", "value": "55f0115270c2306e7e70eea58e6463ebb3051f14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782011853, "uuid": "9f43c950-a2a9-48b5-9720-a6876b8a4ff9", "comment": "Malware payload (Mirai)", "value": "57d0db9ad2c810da905fb30461d7f799b7e55dbfc4dc3eae26802fa0fc6f03afea23f093803206b19487c5f4421e38db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782011853, "uuid": "308e62f2-ee26-49a7-8f56-8c6f5fe9629b", "value": "T1F8544C46EB404F13C5D5277ABA9F02453333A7A4D3EBB206D924AFB43B8775E4E62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782011853, "uuid": "6611dc88-b142-40a7-8767-d9508369dbf1", "value": "6144:veZtVjN22IBxbPHJSvaNmCxhCVahyW+BxEWFCIV/GnzDD6mZ2hxas:kY2IHJSvaNmCxhCVUvIxv/Mv6mZ6xas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782011853, "uuid": "1dbfc694-85b5-48e8-8bf8-95e31f854e58", "value": 288752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782011853, "uuid": "ff83f43b-cf2f-4067-926b-24a23d3264e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782011853, "uuid": "aaa76924-ffb5-422e-9786-f16330fe9484", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8ec663-6d91-11f1-ae13-42010a9c0009", "comment": "Malware payload (DeadLock)", "timestamp": 1782060789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782060789, "uuid": "b2750a60-d550-4178-8ca2-31428130fcc7", "comment": "Malware payload (DeadLock)", "value": "4374eb7807fbcb767ae3a6202b4dd8f8", "object_relation": "md5", "Tag": [ { "name": "Deadlock", "colour": "#DE941D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782060789, "uuid": "5601acb2-c56f-4120-9cb1-b9bab36ac502", "comment": "Malware payload (DeadLock)", "value": "c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c", "object_relation": "sha256", "Tag": [ { "name": "Deadlock", "colour": "#DE941D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782060789, "uuid": "919a3964-12c8-40e9-ba0c-54eddf01cfb2", "comment": "Malware payload (DeadLock)", "value": "2204d64b82765db4598714fe8bc6e71a24958a7f", "object_relation": "sha1", "Tag": [ { "name": "Deadlock", "colour": "#DE941D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782060789, "uuid": "0d4dd5ea-67b8-43e0-ad61-9417658fdc1d", "comment": "Malware payload (DeadLock)", "value": "40529961ff3e04286078e8a57d127e89726bc53e305dfdfae19053bbad534a8466e8f937219f8b447f958b40ee0b508f", "object_relation": "sha3-384", "Tag": [ { "name": "Deadlock", "colour": "#DE941D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782060789, "uuid": "ed019ad2-0c8a-4323-88a4-3fb1eb2ba14d", "value": "T13C447D41FDC65CF5D58B0CBC242E536AC638A8405736C993E7A0AE41D8FFF31A5AA50A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782060789, "uuid": "279817fa-5d17-4c4b-be48-d5d7689baea4", "value": "78bfd47d06d8448796808abae8235133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782060789, "uuid": "4c2f0980-2cfd-4820-ab0b-0b1f3453588f", "value": "6144:pLO0NQZAKgQg1fQDKGK05DZBHNZ94p9OeyEMlne:pLO0NQSKJJtK0tfNZuLyEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782060789, "uuid": "0f2d7f9a-2845-46d5-a4e4-a8b410367c30", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782060789, "uuid": "b53fcfa7-2ca7-498b-9936-4c815381e55d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782060789, "uuid": "539322b7-49f5-4bfa-9111-73b7ba9f0a99", "value": "c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d3f71f-6daa-11f1-ae13-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782071354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782071354, "uuid": "f80ca1a6-394f-4dd5-9f29-fc8e64dfb448", "comment": "Malware payload (ValleyRAT)", "value": "2732425cef9a48fe98ccccd33217be47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782071354, "uuid": "42bee476-b13c-4588-b128-167bda8a6037", "comment": "Malware payload (ValleyRAT)", "value": "ca473d07c0b673ed40ef1c5584a87606b6f67b0d37e71e3b43406acfd7a19ef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782071354, "uuid": "dd657c69-b7f5-4b9e-b0b2-9c88677bae15", "comment": "Malware payload (ValleyRAT)", "value": "0002c8e85d2266d5039c6a1fc0ab8f25eaf649e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782071354, "uuid": "27d8b903-e4a9-4031-9271-c98b528c6756", "comment": "Malware payload (ValleyRAT)", "value": "c01217eda781ef6ccec9a9ce8740af9c439e5571372457041cfd17071788cffcca445c0534e7db13e6ae4b768b8f6ce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782071354, "uuid": "c20e52d1-254f-457d-94f2-435c08da60c4", "value": "T1C8862315AA50D5E4F7C2FB705A56A1F0D77A3C6A2A32E6DF01B032560F732D3CA36621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782071354, "uuid": "9ec2a8c6-ee09-4a0c-9d63-7b4f62de7351", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782071354, "uuid": "7f32c72e-8efb-4421-abec-e7f56e5b3095", "value": "196608:I3GWpSwmJ3Z2BTGL8oqT+u5SQV00clWsafL2:QwZZnJq7VKlWsUL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782071354, "uuid": "2b0d5c54-4706-45d1-99d4-828173760a00", "value": 7868843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782071354, "uuid": "22cb4156-7ae3-4770-ba7f-359a836187ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782071354, "uuid": "4be918fb-6b0e-46e9-ab0a-1267e29688f9", "value": "dingtalk_downloader_1448.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe18de92-6d27-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782015395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015395, "uuid": "8452a0b6-4cfb-45e4-9192-a1644f4670fe", "comment": "Malware payload (Vidar)", "value": "25b176b099b70e96e0a5ff93e456f7e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015395, "uuid": "b5378578-8c48-4695-86ca-33472235a846", "comment": "Malware payload (Vidar)", "value": "cb28fdfae1fd9f5e60bb24d077a3fc414f3b44415508d92fca77555ae00b0703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015395, "uuid": "10befcdd-e234-416e-b748-2385fc921aba", "comment": "Malware payload (Vidar)", "value": "e790a7d570b8fe30bfe73cfe047b991782d4eee5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015395, "uuid": "9c3e9f87-41ea-4bcb-829b-91c94aa24dc6", "comment": "Malware payload (Vidar)", "value": "f8f08b0d32e2d261c4e8def394ff59fe098ebcac8279c87c326cb9f9446c102e5619db0c7ba67d1ec5f3d64901a340c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015395, "uuid": "44a9f117-0aab-4679-81f6-9f775ab52ee2", "value": "T17BF55A47FCE109EAD05AA23689A74292BB35BC291F3223D72E6173382F727D05D35758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015395, "uuid": "fa4ef1a1-0c2d-40b9-adc0-2ab4425816d5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015395, "uuid": "a931b101-f06e-4b27-8dbc-8f08ea58302f", "value": "24576:KQGWmousItryFDIl3H1DimTXo6xDJrPR2JMljMtNZeoBMdNIH/DYS7xVFenEuHiC:KQGZlHrEI5V9kq9R2JjxVJvtvp8gwAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782015395, "uuid": "c57952be-18ee-4233-90fa-9d69455e4c4c", "value": 3354968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782015395, "uuid": "d977dc5a-8d28-4895-a6f6-681110775340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015395, "uuid": "361cc6ca-4777-4245-9505-3dd4543432d0", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcafcde-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782022052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022052, "uuid": "a6de03c1-d41a-4e63-9f14-f099d505637e", "comment": "Malware payload", "value": "8d9735698d33f9f807fcb2d9e934106b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022052, "uuid": "f56d8c89-b293-4be5-9f5a-5bd46bf07873", "comment": "Malware payload", "value": "cef5d8528b5f37d224c259e41875edc3ab0eb784fc0d46c84c7e6beec0f31815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022052, "uuid": "1d7f7e8e-9be3-41a6-a8c2-f0a17c42349e", "comment": "Malware payload", "value": "50b74718a84467b8c40e6ee015db65eb96d60bee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022052, "uuid": "7a7093ec-2f43-45c1-95f3-6c784d59277c", "comment": "Malware payload", "value": "13c513adfe6775962544c489a46beec589783a951d970982fc6479b2ab67b9898882a5e0f8d4981d35bd0f2826c516c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022052, "uuid": "af2746e5-6d99-42d3-9538-f599771d2650", "value": "T111567B55BC1D7462DAC976752F7652843239BC484F82C7232A18BB7CAAF235CCF63261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022052, "uuid": "a18ff6e8-ad51-478f-8dc1-23523327f74b", "value": "49152:vynU3m2mKUSHomoqy77yNMLzteF1vyejWPcMN35Ey:vmU3m2k8voqq7yN6zti93MzEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782022052, "uuid": "762349a5-3bc6-40cc-a5b8-77e40efa50eb", "value": 5898388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782022052, "uuid": "95838211-79a9-472a-a2c7-45b61b506776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022052, "uuid": "2900934d-6571-498a-b4c9-7fd845b77ccb", "value": "rcuop_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a154b1b-6d3f-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782025294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025294, "uuid": "1ec952b2-673a-4a63-9c01-9f448cb0de43", "comment": "Malware payload (Mirai)", "value": "26e2afea417339a7a698844edf4aa7d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025294, "uuid": "99ee383a-9bdb-4643-9f22-dd1ed91cb78c", "comment": "Malware payload (Mirai)", "value": "ceff5c70c2fbcc14df7c2ae0769e912b7b45fed21b7a4aec664327c9ebffa2f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025294, "uuid": "1be9682a-ed75-491c-a6cd-1cfa56905a9b", "comment": "Malware payload (Mirai)", "value": "e52523b027be01051d9eccbbb8dd718c5156490b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025294, "uuid": "e7cdde00-d9a4-4baa-9fc8-4d57b9253670", "comment": "Malware payload (Mirai)", "value": "e9b8e29787a6bb9efe3430fa93607c1190f127f7a6c9762b9f901fce302ad3fd2a72b1e4a8b3cb1a412729b559433fcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025294, "uuid": "bde71dc0-080c-4e41-b29f-1427c5982942", "value": "T1B6845B52F1A228FCD952C934825D6223E63874594322ADFB27C8DF753916ED0AF3EB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025294, "uuid": "8c9247a4-79f5-48c9-a2c6-a0afa9452214", "value": "6144:rJVxUTJNk03VXCyAMq1o1gfQB5nWARit85FxHw/LmjT3fNo8LOvZ+HLEqIPdhS1:rDCnkJyxifQBhWA8gvQsjPLOvIrSPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782025294, "uuid": "9ed89811-fd49-4d5a-a969-72401c860cea", "value": 403360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782025294, "uuid": "08e890cf-87a1-4898-94b1-0ceb224f9f33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025294, "uuid": "8fbb5969-57ff-4600-8d9b-5d39f47c05a5", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03e4f2c-6d11-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782005789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005789, "uuid": "6df9ccb8-b8e1-4409-99e4-8b9b3eb2f7ba", "comment": "Malware payload (Mirai)", "value": "4f9e4607a459a2415b541fa9a1133223", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005789, "uuid": "033e290c-fa04-4a07-ae4c-d3b6ce3b3f8a", "comment": "Malware payload (Mirai)", "value": "d00db479f4a56e23fee3253d529fcf755d15b8f6768d5e1e0b892f783aba4e09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005789, "uuid": "c9e37ef3-1a75-46a9-9d21-cf52d0023d09", "comment": "Malware payload (Mirai)", "value": "159869abddac1f82551ef1124ef8ec6954250511", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005789, "uuid": "b2854de3-f51c-41d2-b85a-c0c0346a8de9", "comment": "Malware payload (Mirai)", "value": "8ee6941be1be4a837194299c05d4b33a90921b7c09ea81789caea588f3484ea925ac5e2db28a952348a133b50f3cf002", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005789, "uuid": "a4047fdd-b2a8-4cb0-8096-c228c45c08f9", "value": "T10843F12611104AD6CB1BC0FD46B8CF2FBC7503F34886E8B56CD8D4E2996A6E47D538C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005789, "uuid": "91749c00-8512-47e9-b58b-e1d42fb80fef", "value": "768:Z9NbqdDw03affenrqQj+euScypOVs1nD8ZC59d4FQP8WkutwbuW+JgGlzDpbuR1t:ZXqwoMwqeuScypTN2C7PdkMwKzVJuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782005789, "uuid": "a24521bf-0360-4b6b-b7e9-e0667caa24ed", "value": 56520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782005789, "uuid": "36113407-56e3-4b12-8c73-ded22e257f9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005789, "uuid": "9907991f-d660-4ffd-abe3-e79969af75c0", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054fea2d-6d7f-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782052774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782052774, "uuid": "bc06dc62-a18f-40a5-8db4-17ea8978302e", "comment": "Malware payload (Mirai)", "value": "e75c7490f9d9b2cfd9653d6876bb4806", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782052774, "uuid": "0f185793-882d-43d6-9401-f21d28269844", "comment": "Malware payload (Mirai)", "value": "d12cb562e6401d1d27ed0f880c659ecbfad84bc79d14e8866ca8d98ff601b36d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782052774, "uuid": "dbf025c9-1034-41bc-afda-8e9563129ec5", "comment": "Malware payload (Mirai)", "value": "91eead808bdd29b83ebb2cce4213ec304a722e77", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782052774, "uuid": "f5d89a3d-6829-4f5c-8480-3852620d60ce", "comment": "Malware payload (Mirai)", "value": "eb0231ca8ba479a936aa107f43c36b4706e79581b1eceb159c2ccced8cafbede325327d72b7b99f0cdb36fee65347f4f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782052774, "uuid": "637cc0d0-8042-4da6-977e-0048bb496f65", "value": "T12931929F90151A391203CADD73B3355CB20C85EB284BD798EC485EAE93892DCB1A9FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782052774, "uuid": "14bf47ef-91dc-4691-8e16-4c4bf428e902", "value": "24:sLPGr0o0ogZmC3GgG5wJ5+kI3niFEEyjx5mhPP:sLPGrppmGgG5wJ5+h3ni6x4hPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782052774, "uuid": "fbe31fd1-f455-4799-a6aa-bd7a40dd3748", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782052774, "uuid": "9ad0b2e1-478a-4340-98dd-95e8c29c25cc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782052774, "uuid": "284059aa-aa56-4f9e-915a-ec8677e7cd9f", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5390522e-6d55-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782034866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034866, "uuid": "a5dc60bc-605c-4986-afc8-d7417468516c", "comment": "Malware payload", "value": "e0ee7051cc66baa69fda565e1bb3b7f8", "object_relation": "md5", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034866, "uuid": "0d47fc0a-9f2d-4eee-a383-9aaa44b58952", "comment": "Malware payload", "value": "d1acc92471213eb14c54cd89c7de440811cd2293f36279dbedfb8583dc55344c", "object_relation": "sha256", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034866, "uuid": "ddb0d20c-97f3-471b-a5c2-e7df1a4d7879", "comment": "Malware payload", "value": "3a9283b8969a40c226d387eba784f0bb2b38d3ca", "object_relation": "sha1", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034866, "uuid": "e08a4372-b3bc-49f7-9488-04ac9bb7ed84", "comment": "Malware payload", "value": "e792cd01d40a2cfbd06b7ede6d622dac3e69963e1c6c932a0f88e4100641833cbe1996fe5efefab4f0f6857dbbf4cf0c", "object_relation": "sha3-384", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034866, "uuid": "4247082c-1c60-4186-a20b-5776d83a8c2e", "value": "T18D263343C93AA8D6ECBE269392476CC81916539A6B25F95F0CD8F78178216F47B3D330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034866, "uuid": "5e7dade3-72e2-4ef8-b3c7-3f41c7a5ae77", "value": "98304:oUh4I/PQVZv/WLOmsjOjh5hM2hTZ8IYr02NN845HAXAVj:H4I3s6AOjhI2h+YSDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782034866, "uuid": "98f9c358-1bbd-4645-898b-16585fe6d8ca", "value": 4647988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782034866, "uuid": "987f6eaa-618f-4320-ab67-8927fc3b1fff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034866, "uuid": "aa599eb5-0912-49ac-bbe4-26734ea2b5f4", "value": "050d4043af02c7cfaf00f257f28e8c8313f6f444c843def486fc2141d379da49.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0107345-6d23-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782013600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013600, "uuid": "4436d6ae-039e-41da-a08e-747955442e67", "comment": "Malware payload (Mirai)", "value": "3cad02ab37e9a8131b5f3ae5f1c86727", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013600, "uuid": "9f6309c1-6f84-49c8-9c74-c942d2621b2e", "comment": "Malware payload (Mirai)", "value": "d252e423676ac8cc0470384d7b56ac63fe4642494f13242b74e2d4f5a3fce3a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013600, "uuid": "fd8b84d4-4c91-4457-b109-4a34070c05c6", "comment": "Malware payload (Mirai)", "value": "ce78601f41b99159bedde567e327c5708a03cbdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013600, "uuid": "8ebf48c4-ac56-494c-a750-435bef5a0b47", "comment": "Malware payload (Mirai)", "value": "d3a003a801a4e0e603533f0400049c930e180b968f5169ee724db7284956176faedfd006cd270250ee7e290aa277808e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013600, "uuid": "9ee99350-dfee-4401-8cb2-2eace7005803", "value": "T18044C61F6F228F7DF369877547B38E24976923D626E1D6C0E2ACD1101E6038E541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013600, "uuid": "b8e4b3d7-9ede-487d-8b83-90c41714ecfd", "value": "6144:tmp72ahjItdaUAu14Is7+B6ahXSJUBWTWrlpqWFiR:tmp4aWLbqWFiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782013600, "uuid": "9d42699a-59fc-4fd6-8698-a6bc71aad5bc", "value": 277072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782013600, "uuid": "464833ca-c52c-4ad2-8341-d7238c2dc094", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013600, "uuid": "1e523040-a93e-4ef2-9197-df447d8ed54a", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6070d1c2-6d2b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782016849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782016849, "uuid": "79414c02-791c-41c1-bbed-7d391e321c86", "comment": "Malware payload (Vidar)", "value": "9c8e686647ebc9296299ff7debaea57f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782016849, "uuid": "c2a46f4a-a39a-4351-a722-2201bcbb6ed0", "comment": "Malware payload (Vidar)", "value": "d3746f04ba8114641b6faeb20106bbbf61633652f14d8871cb1f1ed10f5c0765", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782016849, "uuid": "4574bbb2-d408-4660-8ea3-92c547deb51e", "comment": "Malware payload (Vidar)", "value": "2819c4d821ee9a49acf12428842d986b072af44e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782016849, "uuid": "32fbef21-d046-420d-80ba-e4f9e94d50a7", "comment": "Malware payload (Vidar)", "value": "0996e70a6a867b6212965cc8860cb7a50af94bec9d6cd9644bcea31d2f3338b5f2bb51a43db2fb03ba7c5316ecdd2b19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782016849, "uuid": "5fb19524-4336-46f6-9855-f42ef91ccf1b", "value": "T188F58D07FD9549FAC05DA33188A292A27775BC092B3267D72E90BB782F727D02D35B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782016849, "uuid": "b4cec398-69cf-4707-b77f-99bd9b02800c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782016849, "uuid": "8f831523-77a1-41d6-9de2-a5c182e0b265", "value": "49152:D9G+Sw2cUUHy4ES+HyT2d/Cn52B5POVmzV9Qx+QKh+TwAeBrH4+Zz+y:DYHSqs2B5POkzAsQAiwbp0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782016849, "uuid": "bac3f577-5866-4499-8d43-6b9880951ff6", "value": 3401064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782016849, "uuid": "9e4f8226-8bd2-458e-85ef-da2fe51d6c2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782016849, "uuid": "59a2e5e5-13b5-4945-89e6-c10cac07e0c4", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60363dce-6d82-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782054215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054215, "uuid": "621594ba-fb9e-4b89-a44b-2a45c459280a", "comment": "Malware payload (CoinMiner)", "value": "343b787242cb0665446b7cb799f95eb2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054215, "uuid": "42e16fcb-e010-4355-a3a0-7f9fed8ff7cf", "comment": "Malware payload (CoinMiner)", "value": "d3bb5688c6e76be8d010f8ed02ad374b5a03ea7d130f035d32abd4fb6a9bad72", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054215, "uuid": "a2cb124a-6c34-4721-92e9-b4c6bf3c11e8", "comment": "Malware payload (CoinMiner)", "value": "d3f5b54eff1bd919ff8a0f9302654f60b3e93397", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782054215, "uuid": "55108da2-88d8-4017-b70a-b79c8380b0ab", "comment": "Malware payload (CoinMiner)", "value": "ac0c2fc6ccb3373901a25e04bea483f37f7c25f72de3351f5652996d4d290d515d713346ae805e368de6742d949ba297", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782054215, "uuid": "44c173db-f97c-49fe-8746-44c6bb6d9e71", "value": "T171345B06F652E4F0F5A61931028EC37A5A70ED344162D997FF4B3EB0EC75606AE1A72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782054215, "uuid": "8423243c-4fbc-4ac7-bc5c-89f3bfeebcb0", "value": "6144:pBUz1Bz+/uL1uJfjXQ6WB/QNSOF6ZQFN2H0sUOzROw/MjR:+1Z4uL1afjXcBqBF60gH/BzROnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782054215, "uuid": "375a518e-2147-453d-84be-9584d5b5f9f4", "value": 251324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782054215, "uuid": "4340a8ac-4ab8-4afd-ac6c-3bb0fbe9f6a9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782054215, "uuid": "6667227c-fe93-4b40-89c1-aa52062ce932", "value": "kworkerd-events", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dadabb4-6d43-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782027152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027152, "uuid": "cd46fbcb-6d54-41e6-a13b-41c41750a84c", "comment": "Malware payload (Mirai)", "value": "b3f56488443ca189f695b5a75e321afd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027152, "uuid": "5e1573e8-29cc-4fa2-956c-d29667723956", "comment": "Malware payload (Mirai)", "value": "d43ae49d93c621bdc22273954dac78d673b08241ff419057dba269a964ee1938", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027152, "uuid": "34c79cf5-f935-4368-bb64-6af27cc6059d", "comment": "Malware payload (Mirai)", "value": "6b3ed17fc5f871ac890ec3a4407698261a753a8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027152, "uuid": "7a672da2-e2ee-48ad-ae87-a9b002ebf2b4", "comment": "Malware payload (Mirai)", "value": "6b66cf8afe44ae6a3fa231897ed8caab8aaad5f1848e87958a08518f6abad69bc997b7aa16891a4cc4f9e61a3dd30404", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027152, "uuid": "1bfbb7ce-3dbe-4987-848b-4c34b52686d0", "value": "T10B73198AB8819B21D2D1227AFE1E118E33231BBCD3DE73169D145F2577CB96B0A37905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027152, "uuid": "a68c9746-81c5-4168-88be-21d37ec1cb8d", "value": "1536:nLJnETTLNMFM26hpShJqPES2iPdES0xfQJK1al1XHo35MPiXSvMyQmm75EYP:nK6FMHShJqtdEhfQJAarOSvMyQmm7mQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782027152, "uuid": "6d69f477-8e6e-4020-8e45-f1a4d90f52e0", "value": 79240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782027152, "uuid": "c616165a-d9db-4e7f-8717-1e903f7898bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027152, "uuid": "2fd103d5-0619-4169-b6df-9cee1b146b55", "value": "karm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcebfcb5-6d4f-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782032466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782032466, "uuid": "8fb3093b-ed64-4f6d-a9da-b7bc6ca609b0", "comment": "Malware payload", "value": "2e5b05a7f10f7d05d907ec71548dc08c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782032466, "uuid": "5b841c3f-83bd-4934-94ce-9cc36362d08d", "comment": "Malware payload", "value": "d592ee8eddace6c5e01c80cc9369425559a9e6715104da7db979a5a6aa246a35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782032466, "uuid": "00f3e545-445e-4610-b660-a37e3d74a373", "comment": "Malware payload", "value": "d55cd19ba9c0601e3deee506ad7edc1f2f1275c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782032466, "uuid": "88c1d770-9f2d-4bf1-ac5f-dada5c64e463", "comment": "Malware payload", "value": "8197597c927064dcd527eaf742c9b9541c8f45d73e52546d6b5c8161e029b5c63ae505e4b060c1cd9629f04ff979814e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782032466, "uuid": "8758a752-b31e-484e-8cce-cb86c45794f4", "value": "T1FD44F55B6CA550E4D0FEE078C66BF212BDB27055073837E72EA05A610F26FE1A4F8B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782032466, "uuid": "5daabf8f-d41d-4b2c-8bd9-66b228e0505a", "value": "3072:FxeuFzOPWO/E48DZpyxZIsCLl1Z9xhqmFKYZFNezBAVIaoF9WSjMhrp:FqW48KxWLlrnUBgIa4URp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782032466, "uuid": "1a1b6837-20bc-415c-bd57-9802098470dd", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782032466, "uuid": "1dae01cd-b907-4a0f-84d5-029ef3d26251", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782032466, "uuid": "e68e0edf-bd66-4fe6-af7f-9226e4bb8b1d", "value": "d592ee8eddace6c5e01c80cc9369425559a9e6715104da7db979a5a6aa246a35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f159d3-6d44-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782027817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027817, "uuid": "32015028-4538-4cc3-a90a-a6946ef7ad50", "comment": "Malware payload (Mirai)", "value": "0d05ec3a356c7f98f8d981b433020d4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027817, "uuid": "b78f5b00-f030-4d68-845f-a8d761a24a5b", "comment": "Malware payload (Mirai)", "value": "d593956ab422b724811177acfdffbeb232ca75a72b9a67acd689f0ce0a3e8799", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027817, "uuid": "3d3a09ca-d247-4132-8edd-72a8e24bd2ea", "comment": "Malware payload (Mirai)", "value": "94679ecfaabb140657b3ad6b2efa619d614787d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027817, "uuid": "97935a89-9228-40f0-b4b2-ffc7c5f723cf", "comment": "Malware payload (Mirai)", "value": "3c80360baa57e61527a61c18b33cfcb874e831176e7733144163144bee34861aed29b3eb1599bab7aa0467f4c53fec7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027817, "uuid": "23f1b638-bef0-4f31-9d6e-75cf1bb28055", "value": "T1BF244A43EE890ADFC85BCDF086BE43AB19E7959B49C1F1F4447C8C4C745E28956E3688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027817, "uuid": "5bcebfd8-bce8-490a-b532-a54b335863df", "value": "3072:p2Kx9xI1SO+yrCRFEva4u2AsePFK763NibcuERGPycSSa4d5Vpvf/sjOmOVqD:p2GnIxtVuJsw3GKRGPycV75vcjOmOVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782027817, "uuid": "d116c0e3-75bc-43d4-ad38-47aa61c3431d", "value": 217412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782027817, "uuid": "4967df21-a456-402b-9ae5-478c42aaa4b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027817, "uuid": "4cbec63b-1472-4b88-a50d-00e22b013724", "value": "data_mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca246d34-6d3e-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782025187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025187, "uuid": "a8161842-c016-4fa6-9059-efeda4cf6c38", "comment": "Malware payload (Mirai)", "value": "a3302fb77c00741b4103d5ec284164f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025187, "uuid": "ccb03fd6-a269-4daf-8ae9-4fe8baa8e8d4", "comment": "Malware payload (Mirai)", "value": "d678bded88d6df6c45866a922fba9c5434f51235a9004d9743f171890a85eb08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025187, "uuid": "b9f862e2-312e-4b6f-b4b5-f666821a6168", "comment": "Malware payload (Mirai)", "value": "1b27d23b04fd10133f5b5a91f2e1ebf34c2e58d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025187, "uuid": "86c1f5a0-cda1-4c2c-83bc-0a2ff81ce168", "comment": "Malware payload (Mirai)", "value": "99aae74bc3be37aa39f294eb8a5d8fa0cceb0951c8d65160d4e071b1886dc984799d7d270a26df4f81344fd3e39d45f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025187, "uuid": "514d57c1-0332-40c5-9ca1-639ad5d6576a", "value": "T115D33A02770D0F43D1232CF02B7B1BE1C79EAEE129F5A584A51DBEC65275EB22181ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025187, "uuid": "e9cdcfbb-3bf8-4472-8c5d-77693c422cd0", "value": "3072:KljrI+t/E245hhZqjFYWLJQj5nAbg1uTO:KVzFELRZ0YQmj5nAEQTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782025187, "uuid": "5a0a9ce4-7030-4baf-9ee5-5059e88a10c3", "value": 133284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782025187, "uuid": "c1cdfcf2-cd5d-491d-aae5-226d8c7b5edc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025187, "uuid": "84e52b2f-145e-45d7-9488-fc635fe12c03", "value": "data_powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8a0245-6d39-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782022941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022941, "uuid": "c01f54d5-3dfc-4e75-a879-e4d8b91baf8f", "comment": "Malware payload (Mirai)", "value": "dc4128eafc5608acc92436e25da810d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022941, "uuid": "0c792901-be90-4ee8-8320-803cd0c1b26d", "comment": "Malware payload (Mirai)", "value": "d6a860633e869de93f1299d8b3cd7b2ce2e848ee4782093ce4265d5fe8838fc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022941, "uuid": "acf0fe5e-5643-44a3-8680-36a0eeab58cd", "comment": "Malware payload (Mirai)", "value": "861feab9f9ba5c65870d75dbb3acfb4ee9ce6bf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022941, "uuid": "7f22e2ef-8939-4dfa-b549-c312821bcbac", "comment": "Malware payload (Mirai)", "value": "378aadfd6e0d371a33d107324a34e67ebb68445c72a6fe7b67ef619fc70604c5a7e1b3a8a74ab7d89f6f6915c5212a64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022941, "uuid": "219af410-d7f2-4021-8d2b-8f9f1528da17", "value": "T1EE93184AF881AB11D5D522BAFE1E018E33635BBCE3EE72129D105F2577CAA1B0E77501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022941, "uuid": "454fbdd9-4f5b-4fce-96b3-911267fb4170", "value": "1536:JFnOjwts0+8bnxb4HCq3XwTiPLw/+DJ4U2aU5ABTc4qSlllQibAFmr60YkqE:Sj98b54HCqHLs+DJ4U2aU5ABTcA1AcrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782022941, "uuid": "9ddc666e-29a4-4fd0-aed0-da57ea8e646d", "value": 92396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782022941, "uuid": "c1251816-753e-44b8-9592-96662a9cc1d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022941, "uuid": "443e5a6e-a134-40c2-9827-7a7298d2c568", "value": "karm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eba0028-6d9f-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782066668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782066668, "uuid": "67bf996a-8da8-473f-8f93-9cd4bf09cdb7", "comment": "Malware payload (CoinMiner)", "value": "ed2747ef5abbb31a0d93cfb1abf42a05", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782066668, "uuid": "ac8c261d-7bd2-4ae5-8fd8-217bf1486928", "comment": "Malware payload (CoinMiner)", "value": "d8545d6d4f85bbc568dffbdf69f61e4a27a401f27068ecb0850b8f8bed9857bd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782066668, "uuid": "de2be1f6-001d-4866-b176-8c145afa4f49", "comment": "Malware payload (CoinMiner)", "value": "ff47220b387bdb8f7fb4b34ced6fb040a4a5bc1f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782066668, "uuid": "19855ab3-7da2-460a-bb95-795b9f9887f6", "comment": "Malware payload (CoinMiner)", "value": "130058004b1d00210c2cd26a2f723bcc22b2e2cacab78cdcbd80d440827b6b5761aa3bd301f30d8864685a7e95728695", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782066668, "uuid": "d7592efc-3f60-4574-a7d4-43560c7005b2", "value": "T1BC52A772BA65D57638ACC22C998E9110392B3AEB3618346474ED76043FFC32D51F277A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782066668, "uuid": "c2d163af-00b2-46d9-951a-3a9160473992", "value": "192:2875r4D74COKyAVF1mBt6e4egQq1GZ0HRit4Nmn5PH03/BNGBggGQd:T5FT4LyMiXn5PUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782066668, "uuid": "f855471e-b84a-4746-8e04-5e569c96b5a9", "value": 13778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782066668, "uuid": "e5b1a476-50fc-45d2-a62f-cd622e5bedbb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782066668, "uuid": "6009fc9f-32d6-4f40-97ab-dcc3809c128f", "value": "deploy_softwaretech.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfd5579-6d42-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782026613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026613, "uuid": "0482739a-12d9-400b-a533-03daf291337a", "comment": "Malware payload", "value": "858e9c1389f67d7c40f4b6bf9c251eb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026613, "uuid": "ab00e2f1-3fac-41d7-86e9-1d2a0f200a8e", "comment": "Malware payload", "value": "d90a5315668119da380e12a66a7155b0a67a3f9cce49d84e9c8ffeb59199f6b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026613, "uuid": "0fae68b0-7c90-4d06-940a-8b6227122b70", "comment": "Malware payload", "value": "5de855cb97d10793c13a0093be72d379462e1c46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026613, "uuid": "c97a48f6-08fa-44af-a00f-9638edb8469b", "comment": "Malware payload", "value": "5669b2fd13c705099dac83ee3719c503cde19973ca3df9ee9ec004922245f51339af4039864000b84e1157f28b9e626e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026613, "uuid": "f5b0f19c-28a2-402f-9da9-0f3f371b7e85", "value": "T11F041946F9819B15D5D122BAFE1D528E33231B78E2DF72029D246B307B8B96F0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026613, "uuid": "a4a7b46c-ce0b-49b6-aec4-07904b4a3621", "value": "3072:5WWp8X12EzaUUc5VHXCBytpfj9l+frpaDqz4aU9tS90MC:4Wp8kEzUc3XfTfjj+j8Dqz4au60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782026613, "uuid": "939fd0a1-3888-437e-bcef-a989f3460854", "value": 178704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782026613, "uuid": "dfa2de49-989f-4408-911c-b9059edf3858", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026613, "uuid": "130acb0b-5d01-4850-889e-f562a0e3d73e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909430bd-6d94-11f1-ae13-42010a9c0009", "comment": "Malware payload (Tsunami)", "timestamp": 1782062027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062027, "uuid": "129a5f05-3811-4694-b8c6-f13a2bfcee7e", "comment": "Malware payload (Tsunami)", "value": "10a8f5d510e982a58debba56b4cee038", "object_relation": "md5", "Tag": [ { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062027, "uuid": "faa03c3f-1327-4fe0-af07-e6a05124b548", "comment": "Malware payload (Tsunami)", "value": "d91701e62fc85c7bf75a29c5878a874f68af16207eae3dff8f3e771a6b7ac297", "object_relation": "sha256", "Tag": [ { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062027, "uuid": "b0578afe-3d68-49b2-8c44-d50a4432c8a5", "comment": "Malware payload (Tsunami)", "value": "4cdcfea4403ce09f8cb960b66a8f8ef38786eb96", "object_relation": "sha1", "Tag": [ { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062027, "uuid": "d730d423-b63d-4f41-b75c-45c6c84c535d", "comment": "Malware payload (Tsunami)", "value": "f83523d0672332560069507e5954ffaeab47960ffadc44ef5be8e8f409b6ace703e98f00694af1048b3a24daf57a48d8", "object_relation": "sha3-384", "Tag": [ { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062027, "uuid": "cffc99d1-02e6-41b4-aefd-5a59a1feb733", "value": "T1BBF2E1C8852CD6F69F90F05C0DE545BE61F305335EDB38A3C988A5057DA8E93B12652F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062027, "uuid": "294113a3-95f2-4c23-8055-533dbc0569b0", "value": "768:ZWbIn2PJ58DlvC5qk7kPKmWtEDWTEu8SArFdz5VFuV:Zc1PJ5+ltOkPKmWt8WFfArbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782062027, "uuid": "c3628ab7-7f6a-49cd-a7cc-3d4b55eab54f", "value": 35688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782062027, "uuid": "40a449d7-84b1-4d66-9c7c-5d6eb39506be", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062027, "uuid": "1a1ee756-d37d-4cf4-a426-a447b99f5622", "value": "install.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bb876f-6db9-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782078093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782078093, "uuid": "24830ae2-2370-4494-bc6c-02f706033f42", "comment": "Malware payload (Mirai)", "value": "8ad0f2116153ce17daf1867bfcbd063d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782078093, "uuid": "7b57be27-dc62-4fb5-8c0a-8aac825e7129", "comment": "Malware payload (Mirai)", "value": "d9513db87bf97bde479458f36a19ece64b1c2dd49e4efc012a7dacca71f43105", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782078093, "uuid": "aa739770-bdd7-4554-9ddf-c42cdb4ec3d2", "comment": "Malware payload (Mirai)", "value": "869da55fea1f5876c22b876d992b938c2f6ead92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782078093, "uuid": "3436055e-64da-4929-a261-b1688922aefe", "comment": "Malware payload (Mirai)", "value": "a99475893c38a04ea9cdda5f5db3a2dd44dfe4a1bc798f6a5ea25a9ab542422566d2ff5ce8b6eb52e04d1cc02c9910ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782078093, "uuid": "9680d3d4-e707-4da2-945b-eaf603fa7477", "value": "T166032B42B30D0847D2773EF43A7B27D1E3EFA99021E4F685251E9E4A91B2E724285DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782078093, "uuid": "ba4180a3-24ad-4cfe-ae52-a494849c23f2", "value": "768:RrnfoA9HZrEHCTgalj8LHcFJotUX2C01Iy:RrnfL5IisMjWoo0c1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782078093, "uuid": "db86d4ab-4b64-45ba-86b0-b2f96a7344ab", "value": 38292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782078093, "uuid": "0d48404f-d338-4c53-972c-c1d03a69babe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782078093, "uuid": "def29772-95f9-4b16-a73a-a198426eac80", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16dedbc-6d94-11f1-ae13-42010a9c0009", "comment": "Malware payload (RapidStealer)", "timestamp": 1782062109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062109, "uuid": "b395076d-9ab7-4ecd-a5a1-d16e82ac2937", "comment": "Malware payload (RapidStealer)", "value": "b5c7418f409f51bb43f1d81da5bcbd5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062109, "uuid": "a3db5889-bedf-47b3-b7c7-db0ef7373897", "comment": "Malware payload (RapidStealer)", "value": "d994a393c6ccbd7650ea9d6f08a22000350a2de18d418be5a2cb6a62e5e23699", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062109, "uuid": "7736e925-54d1-4c3a-9f67-542be8b78bf9", "comment": "Malware payload (RapidStealer)", "value": "377a695c4f121879b69a737f30756f5a19fc3625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062109, "uuid": "0fb5f73e-8632-45ed-9e0f-044e6c8fef0f", "comment": "Malware payload (RapidStealer)", "value": "5badd8c764ed54189b90514a5f2223cbfa49fb706bec3aa1d7ac0251832a07f7415baf20f7461cd3116d5dfb17cc0bcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062109, "uuid": "059b0567-6b24-4b55-95ae-65f07d62c31b", "value": "T1D92833AC976DB058D30B7B7ED1F2B5F4BA29770063F4849AD43477E89B40D98FA08219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062109, "uuid": "214207db-f2af-4c51-9c98-cad8923910f6", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062109, "uuid": "c590f582-4c6e-4e68-9e60-7ce818bd6262", "value": "1572864:OXY0cVtCqwohNRUSSfwsYvJ3lolczO8NMczQMFIge8cAY89Tsgt+9+flyZOXN:oYnVt8olUSWfSzDNv7e2YEp+9uyZGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782062109, "uuid": "84fdf536-29da-47f8-8f37-7b40d70e21fb", "value": 100943712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782062109, "uuid": "8b4cf469-ba90-46a2-9d5e-1b92c727d17b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062109, "uuid": "4a031827-81e0-413f-bd12-a21f7907cd0b", "value": "FeridoGame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2e583c-6d55-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782034939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034939, "uuid": "1d4d5c13-4180-48af-bf65-06087e1c546f", "comment": "Malware payload (RemcosRAT)", "value": "f749306e539eab248f698468a5ffc7f0", "object_relation": "md5", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034939, "uuid": "64907e57-8e1f-4b0e-82b0-317985804ae9", "comment": "Malware payload (RemcosRAT)", "value": "daf2410a4e6da576f80df9cfd4b69eb8b2ee74c49948a501d6618063c7950437", "object_relation": "sha256", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034939, "uuid": "31b05dc0-e8fd-4a06-9f5c-4bd6b44ec40b", "comment": "Malware payload (RemcosRAT)", "value": "d7bbb24c3a449bbdf9031fb92753b2d96a68a587", "object_relation": "sha1", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034939, "uuid": "17f1b9a6-9465-41cc-ad1d-c42484dc1b77", "comment": "Malware payload (RemcosRAT)", "value": "4cdc441c1f4b25299a0387adc4b072877cc303479e9d3fbda5ca3ad4d2ad356071f60274a5f646ec3bbd347d24f721f8", "object_relation": "sha3-384", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034939, "uuid": "6bd97c46-7d40-4e80-a876-c5db80eb0dd5", "value": "T159034C5F9F2B0D298EDCAE838C0E537368DD69B823636930B57A549F9E15203E1F54B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034939, "uuid": "62ae9ab3-e5e6-4753-8831-a750db92f430", "value": "768:rrX0uNzecLsfDirMWqrGURG39Lp92CvsO0xLErmTe6RvhQenPAZWlfccKK4OmeUd:rrkuNzecLsfDirMWqqURG39LpgCvsO0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782034939, "uuid": "75344630-3f40-4d77-9ae5-77acc099ce6d", "value": 40906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782034939, "uuid": "de933e80-7904-4dda-849a-d236d1e63f99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034939, "uuid": "825af5cd-93cd-4fe2-9e02-e88163c8dc8b", "value": "givewegivingbestsolutionsforbetterplaces.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62a160f-6d23-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782013557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013557, "uuid": "fe8d2e8c-af8a-4e84-91a8-9fdb40650caf", "comment": "Malware payload (Mirai)", "value": "8d56a027c349a5523c668806289489c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013557, "uuid": "c7127776-1e07-4c7e-98a8-6a12b0aff399", "comment": "Malware payload (Mirai)", "value": "dbfefdc316e1af97ca6ed467e05de2ddbfd4565c0f0d3c6a41b2120a034aaf62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013557, "uuid": "17650f0a-1373-437a-9bd8-176988e4fce9", "comment": "Malware payload (Mirai)", "value": "cd0264bc5189fcc1c5bcd8ff06f68f3f387227d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013557, "uuid": "fd4cf22c-ac91-4187-8be0-8b2a75df613c", "comment": "Malware payload (Mirai)", "value": "7768e125ab1aa188366d02fff7e0764365ecde5e1d6a7ec70e426e750dd53ba0c73c9a98acf7811c808ec288af645917", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013557, "uuid": "c58235bb-e63d-425c-b7b5-48811c5eeef1", "value": "T1093302604084B0BAB5F61E34BB6FEB5B52432EFD47A39EA125152054BAD83CBF4424DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013557, "uuid": "cad99524-8e3a-40db-812b-b36e9e641e1a", "value": "768:rtXJhRJjZNpAPDHkQG3zLJCYFJF2JTXonev8GEaoDm8zmoMDqnPnJTs3UozY:9Th8Q/zL8gr8TXoTP3dmaR+zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782013557, "uuid": "343b2c5d-7f24-48b9-ad75-90483d58f8ab", "value": 50960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782013557, "uuid": "d34fbd5f-dbd7-4f71-b6f6-30c23404d752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013557, "uuid": "8d584fb6-b59d-48eb-b2e5-31a4d7f12eb1", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cbab04-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021935, "uuid": "c45aad20-260e-4134-83aa-31bcca17f088", "comment": "Malware payload", "value": "d1ae7e2f7d141a4216dd3a036316b8ea", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021935, "uuid": "c33499b2-bcf3-4911-8e9a-89b5f3777ac3", "comment": "Malware payload", "value": "dc9a04396396be8781626b1f2e6c7eccbdb699ab8463e0fda3eb68ed04dee307", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021935, "uuid": "42e4175d-0048-428a-b1a5-99f0f4562a98", "comment": "Malware payload", "value": "057d852d79cab2dd3b540abf3cd7e178f2b454f0", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021935, "uuid": "7a2aed4f-54b0-4e60-a872-26607261bcf3", "comment": "Malware payload", "value": "fb122fa69cd8719550cf98034aa47db70e09f9dd1d07824b57238f3f076a6e234870531e260abb98431bba4904518495", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021935, "uuid": "3de56e03-af08-4b99-97a1-c40900fcc619", "value": "T1D1853363E57858D0562D58D9BD9691FFC2DC37787391EAA4D250333CAAE2D8C8B1080F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021935, "uuid": "0ee63984-94fb-4012-9443-4ea335db9550", "value": "24576:0Z24+viHujprcas17HtTt/WEbZvOC8vbwLG1Y90qhlJGQoVCBR9839QdW0DA4WBv:0M49WpI15JQcvhPGLIn989QSBvATFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021935, "uuid": "24e8515e-56f5-4c31-8ecd-775f822bbdfa", "value": 1741028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021935, "uuid": "fbc1a463-4d3e-4099-ba2c-5d1d3fa15974", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021935, "uuid": "00c3e59a-53f0-42a5-a083-cf1a215602fa", "value": "bioset0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e27f02f-6d88-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782056735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782056735, "uuid": "fb6a206e-cba2-4f81-a76d-0203ef4e9f68", "comment": "Malware payload", "value": "451aa4d4fdcd847b5232513beff91855", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782056735, "uuid": "2b4a698d-e596-4ec1-bf27-7b2139b9f132", "comment": "Malware payload", "value": "dd09d1fc879642e9b72ac07680a36a9f0b18cf31f8283295e7bc9c2456ff54bb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782056735, "uuid": "ab32d92c-6412-4f42-9f82-4ee375217c6c", "comment": "Malware payload", "value": "c383a1ea51da82570e2ec6490fccdadafc0f7d05", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782056735, "uuid": "f1de267e-f57e-4900-b17c-f9c96ae466e8", "comment": "Malware payload", "value": "9d1fce586daafa1d70431ef1eaced9ad0a6adb6d7e40635fbc28fa2333d2321aae27a103fed07dec00fd23a0ff7aa254", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782056735, "uuid": "c3c35e8a-0f63-4ddf-97b0-1977154b0dae", "value": "T1090182D685106D105019965E2AD75294F420C3CF0A5B0FB8BF9C5D3EFF98915F067F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782056735, "uuid": "9ffa81f6-f819-4bf8-a075-33ab652b9994", "value": "24:kXCKysE2hi0ziQvZoha0ka8wNDD2Xw0Ft7:e9Qp+Ms0SwNGbFt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782056735, "uuid": "0b097d59-ffab-43ee-a918-9c3ef585b31e", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782056735, "uuid": "3b7dc5fb-9b88-4184-88a4-0d3d5ec943c5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782056735, "uuid": "e36a16c0-4e38-4437-aee5-d1b581690d95", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f6aaac-6d5c-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782038148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038148, "uuid": "a153c787-d5b5-440c-877b-274ae9d66601", "comment": "Malware payload", "value": "85e2c18dbb454c7651b76dd52259ddbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038148, "uuid": "654c138f-8b2d-422b-9440-67b0e68c24f0", "comment": "Malware payload", "value": "e00d92ca28a2cfd75e96f71fc0408747f04942657fcab0f2a25ce79bc3ad23a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038148, "uuid": "0d8dce45-b9d1-45fb-b739-6c880e429d17", "comment": "Malware payload", "value": "fbd618a6932d4b586b8f07f3819229e52c20ed1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038148, "uuid": "8b24efb2-540e-4e75-b8e2-777d67bccbba", "comment": "Malware payload", "value": "42776b683d807865a01af81f06222dea35953e00c14216d7a3eebfff4beb5020ecffac20088a74df5a71d6c3f55cf99e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038148, "uuid": "0213ea07-7c15-4a71-b3cc-a77b4910f06b", "value": "T1DA057D5AF2B330FCC067C030835BDB62A835F46511226E7B25C4DA352DA6E711B29FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038148, "uuid": "c944fc49-8223-4578-b1d1-8589125916e9", "value": "12288:/d80rE7bvYQFAi5FfQEPKpuVBQmy+kQ7mYYm5k:/y0robjAi5FfQ6Kp+VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782038148, "uuid": "c2ebf90e-c4f2-4cce-9c72-6f64ab780e18", "value": 844240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782038148, "uuid": "5c6342e5-27af-46b3-b673-d9e221b9b985", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038148, "uuid": "32621272-a1f7-41a7-bec7-dc5c4aa13163", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d746c2d-6d96-11f1-ae13-42010a9c0009", "comment": "Malware payload (SilentStealer)", "timestamp": 1782062773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062773, "uuid": "1515dd83-6c4d-4c99-ae2f-a8660d409d23", "comment": "Malware payload (SilentStealer)", "value": "aedf344ee861de73bcbe7c204dcc2944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062773, "uuid": "48168398-6b5b-4da4-bd21-488d4a3ddfad", "comment": "Malware payload (SilentStealer)", "value": "e22d7710e36dce587c71a661cb57843ef711f0320ac570ed0b9dea85c891761b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062773, "uuid": "9255855d-f148-486d-afad-17c7cc7556fb", "comment": "Malware payload (SilentStealer)", "value": "7e2bc97fb418b4c7b744b16696dbcd12e6c21698", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062773, "uuid": "c710f968-ca79-4450-8a00-cc45004e0a75", "comment": "Malware payload (SilentStealer)", "value": "291977d26390c24698b271c0df6c23c7d9c8e6569511411c8f5857bb0a7279a596eb110f47d2c2b3fc4d261ff6f90992", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062773, "uuid": "87041c11-25a6-4677-a1d8-87eb9af467de", "value": "T1E6D733303645F497D8C44A7F11C2E9B47A9C7E1C316159A233BFA2BC4F294285DEC7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062773, "uuid": "1a647398-08a7-455b-90d9-f6de0f82221d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062773, "uuid": "286f21e7-6098-4ad6-acca-f7525f16a8c1", "value": "1572864:VOHV+PBA0VYN3b/qu4FkylvbKcSHtXNiBRii:VOVx0VYd/qu4llvbKcSHtX4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782062773, "uuid": "cd87725d-e82d-4fb9-89eb-2fa0a825ffea", "value": 60882045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782062773, "uuid": "b2919be8-78cb-475b-86cb-72e87c90f5ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062773, "uuid": "1c2ab753-9fce-47c9-bdef-6d118ce7479a", "value": "skyloade.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ff06cf-6d1b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782009830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009830, "uuid": "90bbd290-aac1-4019-9c44-06098c42f0b0", "comment": "Malware payload (Mirai)", "value": "771ff2a4a8832e26a5b74ab0b60d86c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009830, "uuid": "9311dc58-f436-4272-9620-0b160a5cedcc", "comment": "Malware payload (Mirai)", "value": "e25ba606b003ced861bf8a57321eb9e35dac66368b703084b0ac9554de4197a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009830, "uuid": "7962847a-ac5d-4d7a-8bef-056cbc706d57", "comment": "Malware payload (Mirai)", "value": "eae3197df5d89343aa3aea3cd2cc38613ce2c288", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782009830, "uuid": "5b3eeafe-e15c-4501-9365-eba209cc6308", "comment": "Malware payload (Mirai)", "value": "53f49d1392df6b7eb9ab2108a6f08cf91841c9982b93d333ea365f4e1deb09e07363bd4caa60031046f3887bea40628e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009830, "uuid": "5a8a037c-0560-4047-8d7d-5e020b661205", "value": "T122430200E4584D2355292D33BCB1CAB36E0967BCD57EB420119A6C18A7E38B57DF7787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009830, "uuid": "85252a40-fda2-45e2-9bef-aa2e058840cc", "value": "768:TWQ6tkM8IH6Wq9bEsZ+e/cUHpl0oRW4Ejz7CLezPVjZQXOAqbLEaKaNG/guQqQaO:TWaM8UcZ+hUH7Yv+yMXcXhGIuQv/eNLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782009830, "uuid": "dd1ed52f-9655-493d-809a-2460d8af8596", "value": 57268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782009830, "uuid": "f9e98a4d-3089-4109-adb5-6668d2afe5c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782009830, "uuid": "c3112bb5-935b-4065-a3e1-0c48c2929af2", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a5b52d-6d29-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782016057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782016057, "uuid": "5ceaed3b-bf9c-462b-9406-69830745c330", "comment": "Malware payload", "value": "8a59335890c57e4044b32810b8d48c81", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782016057, "uuid": "73d57666-8575-42eb-b86e-14d7b6f84b05", "comment": "Malware payload", "value": "e2701c0554ab61535e4f81ca177b83117d3e320ea4309148d1e1e49540b80cb8", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782016057, "uuid": "9316d4f9-c1c8-4d11-8762-d813a056e151", "comment": "Malware payload", "value": "5dd58e5e940647f3210ef7814f4d7231397cb798", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782016057, "uuid": "19509f68-0950-4838-9178-3e698e328718", "comment": "Malware payload", "value": "c5446c0507e601647ce2f7d7118e0aea993d96ad2acdc9ebcce4fbb9d8dd8b69b41654ceaf302e2eac512af8fcaf250f", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782016057, "uuid": "61d21315-35b7-4f82-8e40-d2a2f10a19bc", "value": "T1F485CF58E95C8C68FA3AC075896E24D7EA232987FF3019D3035B22960F67FDE5974E10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782016057, "uuid": "f6a94681-5bd1-430b-ae4a-0d1f8799513e", "value": "073a61f53e87ac32f765f8ef5cdad6f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782016057, "uuid": "63770f6b-10ec-42fa-841a-130372f49cf1", "value": "24576:Kt5OaCy5sGQihRIDde2KYBPJuD8hn0WROhGthLdhsX9MRmIE+76jFN4z1f9iufa0:KnOSP92NBxuU0BhWIMRae6jFNe1Vda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782016057, "uuid": "f079dd3b-366f-437c-af29-84dfe5150cfd", "value": 1725952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782016057, "uuid": "85c0eedc-1772-4266-96cf-ebea023b4459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782016057, "uuid": "2ccfeac1-d6d2-4026-b5c9-2011c93f7eb6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af1dedc-6d80-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782053454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053454, "uuid": "7bc87c33-4ab2-4dd8-9f47-91be66dee00a", "comment": "Malware payload (CoinMiner)", "value": "6e7a86a011111da09296728cacf35f52", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053454, "uuid": "00382394-cbcb-46fb-91e6-33c76ba5b25c", "comment": "Malware payload (CoinMiner)", "value": "e2aa280211036f684810d543f375c0d936316411ae4f6c4347baf7527ac3dd31", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053454, "uuid": "66a04f07-5253-4007-a48d-6e8308c92f9e", "comment": "Malware payload (CoinMiner)", "value": "4a3d0593aa3ab543c0824d8c894331640ba09733", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782053454, "uuid": "43842b91-6c3e-4fdb-9d96-6c80c2d67037", "comment": "Malware payload (CoinMiner)", "value": "40f215a631ab1905a2c26de56298a036374938e03bee22e3267eadc73a044e0f8d8297a29c7e1ac1adb6592a1efb3e6e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053454, "uuid": "6230e6ce-a21e-4ff0-bafa-9af184edda8f", "value": "T1F9745B4ADF750FBFC5AECE3052AE022715DE885E92F6673761BCCD08B19A60446E3C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053454, "uuid": "5ca836fe-2093-41de-9e05-fcfd70a9cd36", "value": "6144:4SNOZd9ZlBAEHbHGkSogA1iMvDEOBssxZS9H09GZhuLHuGyM4KJ:4SefBTG3agMvqj09G/mHZ75J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782053454, "uuid": "388895a5-4a91-4d65-badb-bb20a8866f42", "value": 351880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782053454, "uuid": "6d51487b-e258-4bc8-8c92-415b78811abc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782053454, "uuid": "2fc5a666-dfdf-436c-8dde-5bc4d98ed13e", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06093674-6d7f-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782052775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782052775, "uuid": "39e34109-0581-44ae-b41d-187b6320596f", "comment": "Malware payload", "value": "c5c45f0582fdf1f46a500ff9a2fe6093", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782052775, "uuid": "3ac1473e-d88b-4ade-935e-2eea638ac3ed", "comment": "Malware payload", "value": "e3c75454d745d76a0e155891e294a02284a0fc2835acf44c68428ad5d6c2e0d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782052775, "uuid": "910ff1be-6e69-4885-873f-b2a0f564694d", "comment": "Malware payload", "value": "a4776025946768c85223c551312eb073f23c9a76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782052775, "uuid": "b9981ef8-c278-4a38-8ff4-9bf73b102449", "comment": "Malware payload", "value": "7f68d83915597ab8739e2ba3aa30abb37782421d2c1d984924aae5f9a7be01417de6e3ba86ca6b2be52ea9b8d6aa1988", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782052775, "uuid": "18b06458-8222-484a-b429-a57fffe25439", "value": "T1DD344A81318C7EAEE2A72D3EC141A51B6C0CCF14B886DD2241F9FA471ABB5D71F3A145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782052775, "uuid": "04d9d240-17fa-4f93-a1c2-8b3a021d4fda", "value": "6144:sLSDfUAw2VJHbmJcOKeAQM93/gvkiPrVOoEh:5DfUxEJJ6kiPAXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782052775, "uuid": "5ed1535d-bf57-4993-becc-270f9a49f07b", "value": 234648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782052775, "uuid": "ba8b68ea-a55b-450a-8c67-c52f61248eff", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782052775, "uuid": "841377d1-2c0d-4f50-ab9d-b80c7a6a6e7c", "value": "kworkerd-scsi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0da8f0-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021940, "uuid": "3d49f4d6-9896-4189-af5c-df36264985bb", "comment": "Malware payload", "value": "b7cfe9ee93fadc2d7825eade6c1badc0", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021940, "uuid": "cdf86508-edd8-4575-9a69-66958e6db51b", "comment": "Malware payload", "value": "e3fcaaaeb43db8c988923d49758d85d8c2a06aa5da548c1251a793ee6db34d43", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021940, "uuid": "0a648c23-2967-4a3b-81f6-31c29485fcb9", "comment": "Malware payload", "value": "112314ddb8225553359e2a7085bb54995fe7056b", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021940, "uuid": "ab4daefb-66e2-4c8c-afae-dd5bbfdaedf3", "comment": "Malware payload", "value": "c6562c599dbc4c56d080e873397f3facbc2070218b25c0e6dab3f55d20a10ee5f7a9552dbd2bd685712ee9a5647f6e6d", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021940, "uuid": "b74fc0ef-078d-482d-9604-4550c53ca49c", "value": "T1858533E6A0FD1B46DBCE02F1289CE541E2E76760BE013AD80F0F4A3D89C65C257EC599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021940, "uuid": "6f16d38f-d687-4eb0-931e-1e07160a75d4", "value": "49152:RtzQEtrGGCtcLKAMiPJ4iWBePK4yed1PbuBTAtDC:RhQqGGC8RPJ4icePb1Pbu1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021940, "uuid": "d3dc0e9d-14aa-4417-a99a-e3530e59fec9", "value": 1727128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021940, "uuid": "22879c8a-eda9-40d1-8584-d2ef8a2fa7ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021940, "uuid": "41c4b9b5-5cb1-4e0c-8ebe-24043e55cea5", "value": "rcuop_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50381839-6d69-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782043451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043451, "uuid": "0ae5af60-b63d-4be4-a0b8-1196754c7da9", "comment": "Malware payload (Vidar)", "value": "5e2398c39af420f21172d898548c7570", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043451, "uuid": "f20ffe2a-71d8-4780-92c1-c9e1243b6892", "comment": "Malware payload (Vidar)", "value": "e5ca4586785728938cb9de0e964a35bd36dfa534bd7bf47f2438af4a4c2103c2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043451, "uuid": "023979c3-d602-43c3-812e-048bcae7559f", "comment": "Malware payload (Vidar)", "value": "11f5c65ef619abba958fe56d33006250f5e6c0e0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782043451, "uuid": "0be070ed-3a7a-43ff-90a9-fc7d447db3d4", "comment": "Malware payload (Vidar)", "value": "207699ef9ae43088ea65e14088dbb407e3f860621e2e606d9668b7faad42d5da7fff9a965c652639f3abfccc2ed10499", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043451, "uuid": "780158fd-dd35-4463-9a8c-7687c1361a31", "value": "T1EFF57C03AD950DE9C099A33188B39691B779BC446B3127D33E907B782F72BD05D3A768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043451, "uuid": "3388478f-0bc6-4081-a30d-0a8f2225ef4b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043451, "uuid": "5ad93b4b-8162-4317-aa90-922ccc99e9c0", "value": "49152:pgSACnsRSJVA/IpMNT1tMyWvinZZIJBGucWLbXZV0b:pbYKUTXMyWvinGB+W3Xob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782043451, "uuid": "5c85a431-7f9e-493c-84e7-3e4ef829c621", "value": 3395432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782043451, "uuid": "248894f8-4cd2-413a-b381-c554711afa4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782043451, "uuid": "db21c1d7-dc0d-4825-b3f4-1c35ebe4b6fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5370128-6d3d-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782024829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024829, "uuid": "9ca99643-c386-464a-b232-6eae4be2c9b9", "comment": "Malware payload (CoinMiner)", "value": "ed8a9e2744a2ed3801541e4a260553a4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024829, "uuid": "c32c89c7-9d6f-4157-a635-5cbfd8121c0d", "comment": "Malware payload (CoinMiner)", "value": "e804e04f055a0ec3f4ff1d03e49a139b735c30ff8c97ac0d82f8e18f66bbe55d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024829, "uuid": "0a137028-cd3e-4c60-b28f-836e90c5b1ad", "comment": "Malware payload (CoinMiner)", "value": "cb707b3f0f8b5a90ff03f3b0c23c7fa39376d7e3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782024829, "uuid": "4c0a93d1-731b-461b-ada5-ccfab59c220b", "comment": "Malware payload (CoinMiner)", "value": "6eba47d4e3da70f0419724b619b2ed1cc53b9f427a8d54affdecae636e1a3dc599aef7ff83a832a1c0d6cb2cd56335ca", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024829, "uuid": "839c6156-77d8-4e8c-b79e-9cf2d3dc7128", "value": "T130555C8BB7AA8C67CD12837CE8AA426A3B53C2392583EF2335C5CD1514CF9597F2195C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024829, "uuid": "d466cea1-3e95-4682-95ba-e44790d0e212", "value": "24576:OXSpqKcUpqKciQi6CxOS+zGCcIZ/evv9UcXHFg:0SpqKcUpqKcbi6COS+TcIZ/g9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782024829, "uuid": "89b3ce6f-a35d-4eba-878c-ff441185cc05", "value": 1341016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782024829, "uuid": "0e1bbf5c-6f2b-4920-8454-d392ecff473e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782024829, "uuid": "6e6d38b3-412a-4e90-8045-f44f8bac5817", "value": "y11.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39220323-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021937, "uuid": "3d70a8c6-9d8a-4dd9-921b-6687ca2a0821", "comment": "Malware payload", "value": "deafb7bd3ca87fe2bcbd6eaa8b64fa99", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021937, "uuid": "2a67e5d6-9204-4204-8b0c-6af25a932153", "comment": "Malware payload", "value": "e8feeee42b568fb762f0c397a65c4bcea8db21348719f8834b7ba3421a2ca282", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021937, "uuid": "add0dafc-7a23-4c1e-a66d-032fc53dae3e", "comment": "Malware payload", "value": "78a513e83510803b200b47093eba6418c80aaa1e", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021937, "uuid": "8e7c7a43-c7ef-46bf-9a7c-60d13d0e8e0c", "comment": "Malware payload", "value": "51419509481994b7ff5ba7f33e7b0c921fa5f66af0678b0987707872d29d90f5e52126e0368378f656586fb09e75aed9", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021937, "uuid": "d92ff227-c551-44f9-a964-99b6ca275b65", "value": "T13A8533EE9621EB8F98D0D4F552EF24A8B7A33043DE305F0D5283FA6948C1908894FDE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021937, "uuid": "be4950f5-baeb-4580-a58d-ff999779124d", "value": "49152:Y0Uv/18j91fGAZ9XV40+8FTkalHhrqtdRcUvVKrtfcTOkd2nB++:Y0g18j7GkK0+8FTxlHcdR1wtftH++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021937, "uuid": "b7c359c5-9ca0-486a-bb6e-1d91277753ed", "value": 1716576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021937, "uuid": "2186c6d4-b7ab-472c-ba49-65caea2e9041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021937, "uuid": "05bfc772-c5b9-4452-bd5c-0d4b4826cfaa", "value": "ecryptfsd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a5060d-6d49-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782029982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029982, "uuid": "8f33ad06-1ca2-4a31-9bd9-e73d114f6eee", "comment": "Malware payload", "value": "7efff53c307c52ce0b0c8d4e0e1b062c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029982, "uuid": "db6453ff-0616-48bb-92b3-912e7fb51ab0", "comment": "Malware payload", "value": "e9c77b34663601eeb0f3d89869b935315edfe27e794d572c0be0e1a66fcb6642", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029982, "uuid": "cb056240-1322-4e86-b153-7360b589ac6e", "comment": "Malware payload", "value": "62fe23dcfae70f7077e98649a85079a57e5d7a98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029982, "uuid": "64f0abfc-0b54-4585-8966-540bced16cad", "comment": "Malware payload", "value": "74a1cb1d651392a00d407a63eeb18167c34d62ba7aec9d214efa215e2256b55c2d00763e98aea392e64decfa14d09f27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029982, "uuid": "c6ea44c4-a3a2-4af5-b513-cc41791fefa1", "value": "T1E524B91A6E328F7EF368873047B74A34A75933D626E0D644D1ADD5142F1039E682FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029982, "uuid": "2e17001c-b311-4a09-986d-9c550bc68ca7", "value": "3072:V+Isqmt765X/k2c8VaeZyMgiqBczhQgw7oZFb:V+Tt7gs2ciwqq2hQd7mFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782029982, "uuid": "ba07b0fd-1700-42e9-81db-2cd7be459b34", "value": 214816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782029982, "uuid": "78190b7d-1e5d-433a-8e72-cb9d543371de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029982, "uuid": "e3cd4539-3cfb-4e3a-993d-213631a17320", "value": "lmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be918c6c-6d85-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782055662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055662, "uuid": "d8be4903-df42-4312-b6ba-acfdf799aa11", "comment": "Malware payload", "value": "e3a12d8a0dc98b06b548a766aa77dc9c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055662, "uuid": "76672b3a-a597-4b74-ad3c-92b6b72046d6", "comment": "Malware payload", "value": "ea2b1c6fa88da27a58e92ee93b752180fb6ca0badb297c3771a0f0adb4e49f0b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055662, "uuid": "7652e4cb-4bc6-4b1f-a89a-11b04b912bf1", "comment": "Malware payload", "value": "adb94417d3aec78b7779161ba359ce18816a3e09", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782055662, "uuid": "45e55e69-9551-4bee-b08b-3c9b3608257c", "comment": "Malware payload", "value": "b4c6acdc4f9402a61299252696b4421c5d152614da514ba6016d029cd584375717b1a817e29704dcb5043bfe201c6be7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055662, "uuid": "0ffdd3e8-2a7e-49cc-a02b-24933be77218", "value": "T15C529651ED26A270256D80F5BACB2501F50F412B460C7A05B1AFA254BF3CFAC61FD7BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055662, "uuid": "bbdf9ff7-6166-4b88-8b5b-8ce407bf1f52", "value": "192:5VtWxos/MbhrlqT8/2hEPVmhxZPKgjlhtOtHDmh5RDKlE3As+SU8x0PNIZXG8/Pm:dTlkES1LURYRQEw3FNnVUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782055662, "uuid": "d5abb949-2823-4174-8b52-eee3ff9d3113", "value": 13982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782055662, "uuid": "e9c3a85f-62dd-4d8b-95e1-f09abf7f4e7e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782055662, "uuid": "1f7da366-dae6-46a3-8606-826eaf909287", "value": "init.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b352fbc4-6d56-11f1-ae13-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1782035456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035456, "uuid": "9bacfaaf-b009-4bb9-92a1-b183b474387a", "comment": "Malware payload (njrat)", "value": "52141a7468dbfbc858f72d2ce947d6b3", "object_relation": "md5", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035456, "uuid": "b7bf9368-6fe8-4ec1-8f6d-e88878f45ea8", "comment": "Malware payload (njrat)", "value": "ea5bf6fd34986ea7ce7e9f9207742a2dad04700f23e25d2e3a861315503f8a2a", "object_relation": "sha256", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035456, "uuid": "49162219-2294-4fed-aa97-796a5e4715a1", "comment": "Malware payload (njrat)", "value": "5b5c1b64b8d00704dabbdf7d453029b00fe61072", "object_relation": "sha1", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782035456, "uuid": "420aab18-a9d9-47f6-9637-0f82746239d6", "comment": "Malware payload (njrat)", "value": "f452a5dca783c4761ff4dc066ca7ae1d64d73cf9fee4e09fe7886aa077428ce3416ce9a54b021c9d0277b459836de369", "object_relation": "sha3-384", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782035456, "uuid": "b857c0ba-d1d6-46ad-aa9a-978b716a4f15", "value": "T1DA23710B62ED6DA1D47D47767B3383C1C3B8DE024A03DA1E0DD560A5AA7E3837901BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782035456, "uuid": "ec8f195b-e7f5-4cfa-b27a-1da02fd191a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782035456, "uuid": "faf140c2-bb1a-4ec5-912b-6408cc95f869", "value": "768:FwkMajwRh6UmzvwiDw8EMlpd01dQzQbCMV4x5K+jHYi:OL6UmUFopkUQbqx5KMHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782035456, "uuid": "ddb73aee-4f86-4a1e-8aa4-7d5d52726e1f", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782035456, "uuid": "3ac8d55a-4189-4371-a6aa-4c8062313d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782035456, "uuid": "2f2cfd17-c464-48b1-afba-eb480e9e79e6", "value": "Kjaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e282e1-6d49-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782029981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029981, "uuid": "3c2b4b90-d262-4ed5-afe9-6d528c7279e8", "comment": "Malware payload", "value": "369d5a46897f834ff9b08123f5c22e29", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029981, "uuid": "44df17c0-6289-483d-9a09-5a9ed78dc3d8", "comment": "Malware payload", "value": "eafdad0e99c594f739c67f38820bfd2f37877b3f6a821d8253b13a954d2c219d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029981, "uuid": "53cac604-1a6f-47f9-aa23-7bc65910fbc8", "comment": "Malware payload", "value": "bcf6ac24631e0f5eb6d5a1fbb9fd986db6d71a9c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029981, "uuid": "5a9a5534-0719-4061-8fee-f2269b0e53c5", "comment": "Malware payload", "value": "f6549c45da159909843d5143e0f47ed1c8698d6091a50b762cebb6cacf2ae0a3ed4bb2834d96977cf09d9dd298123da2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029981, "uuid": "cdac41c2-2c6f-4da9-b376-4f9c787265b8", "value": "T112016FDA4650A900801A9A5F729765D0B811C3CF464F0B687F9D6D3DFB98904F176F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029981, "uuid": "070d1b8c-a81f-4a61-85a0-2200261c0106", "value": "24:kXCKysE2hi0ziQvZoha1tXN1LETLuw187:e9Qp+Ms1tXN1Avuw187", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782029981, "uuid": "f9c8a77f-1e9e-4f23-af20-d38e39d831d9", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782029981, "uuid": "10cf72b2-9417-425f-a46e-9158186b8197", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029981, "uuid": "aed1fda5-02f0-4394-bad5-f591f9687e4f", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac11f640-6d67-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782042746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782042746, "uuid": "3ab96ca7-6c3c-4d5d-8b68-9a751adbba9b", "comment": "Malware payload", "value": "eeaaed8dab26729dcc2d4ea71c997668", "object_relation": "md5", "Tag": [ { "name": "antivirusshield", "colour": "#9739B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782042746, "uuid": "e5e0bcd3-a7da-44fb-960b-16a25021ac1c", "comment": "Malware payload", "value": "eb4ebe8f50e313f917ea49cac37dd5fe6e05dbf095e741c45938632f3bf1558e", "object_relation": "sha256", "Tag": [ { "name": "antivirusshield", "colour": "#9739B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782042746, "uuid": "a2dea70d-8b5a-4c17-a129-51a690af27a4", "comment": "Malware payload", "value": "82cccffdb5139ea33c7cf907782f7936f7fbd144", "object_relation": "sha1", "Tag": [ { "name": "antivirusshield", "colour": "#9739B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782042746, "uuid": "996648c6-992a-4cb7-825e-eb858a49f33e", "comment": "Malware payload", "value": "eab9d680e9eff4380855e32e4aa2daee21908292f5e852d743f64883ec7a65d984c3a5691d57630eccff0e5b7dd30a28", "object_relation": "sha3-384", "Tag": [ { "name": "antivirusshield", "colour": "#9739B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782042746, "uuid": "27430a3e-190d-4da5-9af5-5ae2e777ca3b", "value": "T19DD412507BBD872CE6BFABB45A1272427F35FB253135CE6C68CE128C19A17108660B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782042746, "uuid": "b3d674d7-77c3-4d18-9a8d-c7cd2ebfb859", "value": "12288:vvnH8CdhTKv6GsA8Ef9J8DP9yRn9OIXSLen9OIXS9t:vfHD8vFVhlJsPA2ICXIC9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782042746, "uuid": "c6792aac-23a4-4e56-9d88-987ca2347987", "value": 618888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782042746, "uuid": "cff212ce-765e-42a4-af99-fa0225111790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782042746, "uuid": "3cf66d0b-fd91-4170-83a8-6a7f92d1243b", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836c279d-6d1c-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782010465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010465, "uuid": "75a05cd5-7d70-4d62-a7b3-935200f00748", "comment": "Malware payload (Mirai)", "value": "e6c8f4da015a10a73330f4e0fe5a9493", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010465, "uuid": "b26589ac-9a0e-4250-9f7c-a8b56baac379", "comment": "Malware payload (Mirai)", "value": "ed2077905881c7cf9686cb7cf89f8d3e3f637f482ab3d4fd47da92f0745b8c9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010465, "uuid": "e76b1a19-8b90-481a-b923-3edc71617582", "comment": "Malware payload (Mirai)", "value": "db4488ba9f4a85a0f1e31a4ef8251052ae6fbe39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782010465, "uuid": "c8336a90-c634-4bca-8ccd-a85053e8904d", "comment": "Malware payload (Mirai)", "value": "fa508f7eb4b6206e9569be42553182372a6bfc7977110e3a113094bdc25f0df9470029e73da53bc3c7dbe02f6a9aa383", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010465, "uuid": "1e5a9afe-8092-4217-9313-fa0b87fb1dd8", "value": "T1846302B2B498844EB6DA4531818F519BD039574B7986C367D6B8F0C7CC03A7EAD066CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010465, "uuid": "2e181999-3bf2-4d74-a70d-acc0264a1407", "value": "1536:w1XF1tG9dm6TvT56JvaFN+sKZsiEMrceVQa9rCPSnouy8tyO:0XF1tqHTMyWZsiEM9ma9rCCoutb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782010465, "uuid": "aff446b5-172c-41ad-92ff-a3c7954a7227", "value": 67788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782010465, "uuid": "8666513c-ee23-405e-ac10-85cb3c24425d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782010465, "uuid": "f83ce00e-5310-4676-b16d-d4ec6d6eb65c", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396b6f6b-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021937, "uuid": "fc8661da-9d76-4b2f-9cfd-1064cd6073f7", "comment": "Malware payload", "value": "3336213f6f5d1be80829354416f7ba9e", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021937, "uuid": "89a435ab-ae8b-46a6-b488-0b223c3c3a3e", "comment": "Malware payload", "value": "f00064de686e5d2a30ed5a1785cc432a5ff03de4b30b71381743aa57703f128b", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021937, "uuid": "dd491e8f-2ac8-409c-a145-1b839b06a532", "comment": "Malware payload", "value": "5d388e358802c975be7cba99d7e224ed9834844c", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021937, "uuid": "0f6bea09-e6d7-44fb-9a71-6fd2ab90e688", "comment": "Malware payload", "value": "310bb3f15358fded808311ce8d66f7111c444323b6f42a1958cccfd61b91111bae604b51f1dc26a5c42d0c98847e6d82", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021937, "uuid": "fc294a16-3d98-4e14-9ed6-7593214825a2", "value": "T1F6853367910B3B9B3130BA12750D18F46D00B67EA1CA7D538E8A8B15B007BD2EF7D5A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021937, "uuid": "4a92b4fa-d831-4653-8098-2e6e7d86668c", "value": "49152:hqmTX4cIjiQnNmJjeQQygGWGP337mZuFdO:hz4hDQQenjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021937, "uuid": "65528c2c-bff0-4fb0-a543-3d718a1d5da4", "value": 1732212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021937, "uuid": "b7e7e856-01e9-4808-83b1-49de4cfc8100", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021937, "uuid": "f8b1f709-41aa-4c60-b49f-fe6047882cab", "value": "jbd2_sda1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acae0c6f-6d41-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782026426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026426, "uuid": "df680ce0-df6e-4371-87fe-5746f8418d90", "comment": "Malware payload (Mirai)", "value": "af55f4e398920e1f39da538bad6d778a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026426, "uuid": "8edd089e-87e0-43e7-8ade-01011ad9e24c", "comment": "Malware payload (Mirai)", "value": "f08cd9ef0d20cb574b19797ca5005d8bd189bf7a15e880d9bd578b6472b35b6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026426, "uuid": "dcf52ebc-959b-4838-a9a9-71e036245cb0", "comment": "Malware payload (Mirai)", "value": "fabb150ac25e06ce9924c2c378625703db6287b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782026426, "uuid": "c6b12b27-5b82-4333-9091-24c498819919", "comment": "Malware payload (Mirai)", "value": "8d3ac8563a701301375129257fb91fe9a9885787f82d5398aaafae12c0c86919426aa5f3f7e78d02d6bd4f97d7676d63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026426, "uuid": "0b1cc482-e70b-422f-ae1b-98df8078af9c", "value": "T13A157B9DE7C6E0E1F26300F1025EDBF71934A12A9013FAF6EF45266374727916F1A21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026426, "uuid": "8163b676-9944-462d-a730-f063cd1a09fe", "value": "24576:/GdkhRfh1uIz/sotx/0c62aoy7pKcpXoD+7X:rhRfh1uIrtxrAHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782026426, "uuid": "1576eb93-ec4d-4464-94c1-007c74d896e3", "value": 931160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782026426, "uuid": "97b706e4-edcf-4626-866e-8368e7577ff0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782026426, "uuid": "52053cc5-9fc1-4f85-82c4-5bee54e3a0fc", "value": "data_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f743ea1-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782022028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022028, "uuid": "9cdf5611-a40a-4b8c-b569-9d0ea865b91a", "comment": "Malware payload", "value": "157362b125c08f5c21a316b5275dfab7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022028, "uuid": "bfea6879-4d67-4a87-a8af-e82d22a2de75", "comment": "Malware payload", "value": "f17c9a5836b8f3427b43726819d6925b3668b3a5f5df697f5520a27bb482aa55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022028, "uuid": "01de5e49-1006-4110-87ab-7fc13bb8c090", "comment": "Malware payload", "value": "18b4f87846521daba8041421948f6df3e320df0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782022028, "uuid": "7a6aea6f-5899-4aff-8afe-af4a8755e354", "comment": "Malware payload", "value": "a3336c91b65c6817fa4d0162a1634ccd1afd9de6d90ca6ac7db57932c362140b0cb81b2dffe6d55c601ecefbed729714", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022028, "uuid": "2632802a-e4e7-44f9-8393-12d3dc43649f", "value": "T1D4560857B8924943C4E83677B8BE81C433671EBA9B8752566D04FE3C3ABE5D90E38314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022028, "uuid": "7d148e7e-68ae-4c69-9c06-759b9aa66837", "value": "49152:0ndqb5vkjw1VgJ+0Gz/HR93bKr1fpDpvURVNCqDlPdAdg5EA4:cdqRg0/l1bWM5lPdREJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782022028, "uuid": "8c806c23-016d-4a07-b085-c97a8045874f", "value": 6160532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782022028, "uuid": "c76c47c3-dead-4abb-a356-cf769e7d07bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782022028, "uuid": "22c0f529-4ea6-45c0-b0ab-2a6efffd9e66", "value": "kblockd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f400a3-6d10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782005470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005470, "uuid": "42c2b579-5b4b-43ba-aea6-2feaa663c768", "comment": "Malware payload", "value": "ba552798ae5baef47a8ad89b1a60aba2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005470, "uuid": "87ef4883-4df0-4c9a-8db0-601ee1e35309", "comment": "Malware payload", "value": "f190ecfd22735272d373541ac3b384ad7180570aeea505323f4aeb2e2c6ac75b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005470, "uuid": "0cac11e0-836b-48ce-b5de-2ccabef19a33", "comment": "Malware payload", "value": "721e5170529b283970cb40bc8add1927dffffa9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782005470, "uuid": "7427547b-a815-48ea-8663-980c638b785a", "comment": "Malware payload", "value": "c6681e692827d71f97d7f7d225a99ec94265a2f1e27aeaf96839e74988d65c3484a12268ba5aefeed74277d5399b5f16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005470, "uuid": "08fad4f7-e1de-483d-a512-c6f092c7c413", "value": "T14614E55B6CA550E4D0EED178C62BF213BDB27458073833E72EA05A610F27EE1A4F8B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005470, "uuid": "2d22267e-543a-41c3-bdb0-a31a2009b376", "value": "3072:FxeuFzOPWO/E48DZpyxZIsCLl1Z9xhqmU:FqW48KxWLlr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782005470, "uuid": "543bab05-20f5-4f44-87fe-a00fa1aae7b9", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782005470, "uuid": "704f5436-1024-4420-89fb-bb1f47d9b4db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782005470, "uuid": "4535afb0-781a-4222-94c4-fc60bc21e4a1", "value": "f190ecfd22735272d373541ac3b384ad7180570aeea505323f4aeb2e2c6ac75b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab4e948-6d5c-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782038153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038153, "uuid": "38ad0c7e-bb8c-4906-aad7-ae4a10c39427", "comment": "Malware payload (Mirai)", "value": "bf5dc662833bb1dc277fed24feb88bac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038153, "uuid": "e4a08ffd-a336-4e7f-bfa1-42a8ea7aad6c", "comment": "Malware payload (Mirai)", "value": "f2b5721d0aaa1d2975cb5d2d8716b7b9ccec1139da2bf467080197a5aae82ae2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038153, "uuid": "f591143d-e64f-447d-8a85-1f677548bdcd", "comment": "Malware payload (Mirai)", "value": "04c89e4764feec065aff11ac9b629d38ffcb93e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038153, "uuid": "6f8ccf43-f995-4a1b-9bfd-721ced3932c2", "comment": "Malware payload (Mirai)", "value": "746351e6f2ebb566b0888ba332a22f6e3ab0f197969e56de1a1edb38e73a4ac9cab661296a91de2b7e6fe301db177b47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038153, "uuid": "df4ac2c4-c2c3-41d0-8e98-488bc6b6049d", "value": "T146B42855F8809F61C6D529B6F74D82A873074B79D3EBB2069A144B343BE786F0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038153, "uuid": "8e507ad5-d8cb-4880-810a-4d5bcb212ffd", "value": "12288:jiKaCUdFf5VMSOei1VhLQ6metoH8L6v4q8prPx8Q:j9aCUdZM5e6vLXmeb/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782038153, "uuid": "a51caedd-b95f-4e09-98d7-95ef2ed09ebe", "value": 518472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782038153, "uuid": "8fd26e11-baf6-424b-9f42-47968296af24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038153, "uuid": "810ffc42-98c0-4e44-9e1e-f3e2c95fab1c", "value": "bot.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdaf4ba2-6d95-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782062559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062559, "uuid": "855afc9b-30ba-4217-a217-8d268d4bc4e6", "comment": "Malware payload (Mirai)", "value": "c3f3c5fc18bb91aba656721c15c8dd0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062559, "uuid": "c315c1c2-8007-402a-800b-1022ec115265", "comment": "Malware payload (Mirai)", "value": "f3c6f1c46914bbeaea38f25ea221a75a0e0c70afc25e8191addb61b511d04b82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062559, "uuid": "9e241e92-c4dc-435d-b57c-be7384e84d31", "comment": "Malware payload (Mirai)", "value": "a4b69c1e413a84baf3efdb585d150104489ecd70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782062559, "uuid": "be480314-fb04-47c1-b593-854cacde7968", "comment": "Malware payload (Mirai)", "value": "00ff97b939181e8c470daf1e069a9323cb35cc5bc5443b3bdc3c2e651ab761b08e4322c657f9ff428f27a664f3e48ca7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062559, "uuid": "b6995392-834b-4c90-8b67-0b1fa366faab", "value": "T1EB242A45FC919E12C6D522BBFA5E428D372A13B8D2EE3103DD125F24378A96F0E77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062559, "uuid": "ef59bd53-784e-4b48-978d-09c3048dc1c5", "value": "6144:BOn7d6d6MYX5Jz6I3PWGEj4nKzSKhdJe7D:Mnp6d6MYX5Jz6+NEj4oP4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782062559, "uuid": "8f5ff8fd-0e89-4f95-aa38-08f677baf523", "value": 211040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782062559, "uuid": "a56b999d-0b5b-4f6e-99cd-aded4a257ccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782062559, "uuid": "2507116a-adb3-4f19-b62a-35c73ecc3272", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadfef52-6d28-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782015793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015793, "uuid": "486c3325-0e1d-428c-ba35-654695b1fbaf", "comment": "Malware payload (Mirai)", "value": "0898e1a64c2926627a562f5a590358d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015793, "uuid": "8934b1bd-245a-47ee-ad97-1e69246e578d", "comment": "Malware payload (Mirai)", "value": "f4580c5213d959886faac9e22a2a7bc6d6b4f52121d4f6e8757c21a6279a5a6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015793, "uuid": "21d474b7-1b58-4472-b1e4-92354fc6550c", "comment": "Malware payload (Mirai)", "value": "72d27ff2e1855c293e9ec37b4dc4c53f5af4485c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015793, "uuid": "107d6f94-6bcc-4fad-9ec7-17398554f102", "comment": "Malware payload (Mirai)", "value": "55371c8535cfdc3a49bf118d5e175c4d1c8211808c1e1f2b5b699f557ba8148810dd262345994c67aaf02ef1cfbeec06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015793, "uuid": "772ce8f5-d16b-4400-bf72-7b0a43965707", "value": "T178434B2250BC2F07D1D0B63B12778792B2E53B5E1A949B8EBD6A0E4FFF3125449271B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015793, "uuid": "e9f4c715-bc2d-4826-a229-c97099982700", "value": "1536:/+ttxz/KRSA2fIHdpUv+Ed5lcyiwoXzpfWIrE:mtnL+EdDc7XXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782015793, "uuid": "4d69608f-acdf-47bc-9ac1-c6af7ffd5b05", "value": 59592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782015793, "uuid": "f3e9062a-f67a-4993-ae31-4fb829e4ba6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015793, "uuid": "01da5431-cdbd-44a8-b6d7-96b764e62151", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab8ddd2-6d44-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782027818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027818, "uuid": "98f8b62e-6223-4724-b4c6-9399d2ca8b72", "comment": "Malware payload (Mirai)", "value": "094ef5b8de929aa37693e2fcc2ee81ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027818, "uuid": "d833ce9e-a5f9-4d70-a251-97ea4dd318e4", "comment": "Malware payload (Mirai)", "value": "f7613e56b2271e091bcc13b9cdfc451a94d8335f0e377f87dd079d2da7bce6ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027818, "uuid": "f2f4a7ac-8460-4b5e-a467-f616ba519eea", "comment": "Malware payload (Mirai)", "value": "9c863f81318510bbcedd2eb68fab3880932d41ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782027818, "uuid": "4690de26-0bd9-4511-b984-f24ac3cfa943", "comment": "Malware payload (Mirai)", "value": "3ada6e67a72161e2cbc4910970bff4b08bf1a25c2cced2480d9a894a1690d015a6a34b80cb5645eb596041718fd4b5d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027818, "uuid": "4398b59f-e54d-4fa2-af60-031982c431a5", "value": "T154E47E9DFE4E3C42E2D7E3789E4987E1621B71E0D32391A33982434DD5C69D9CBE1A21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027818, "uuid": "bd0e733a-bbc4-4f5a-a359-94db0400d11f", "value": "12288:jcDwr0p63dMbjuaUUUcmabqaNcukFWE37+zpbEz9Sw5LdtqA66:oD3p63ruUcmabqlPWAzXwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782027818, "uuid": "95d93bcf-8479-47d0-8039-a47370efb8b6", "value": 705168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782027818, "uuid": "ec6d4804-77d5-4053-a991-8b0d2f400cbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782027818, "uuid": "5969a0cd-bbfa-4676-869b-9d37fbe68941", "value": "data_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39be8037-6d37-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782021938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021938, "uuid": "890cef89-e25a-4a19-b71e-ea44e89614fe", "comment": "Malware payload", "value": "91cb6976972e53c7971ffb0086c9307a", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021938, "uuid": "9b631b1e-fd47-41a9-9eaa-cd6c2e985f3c", "comment": "Malware payload", "value": "f79446f5abe42968c3e6cce885eed17747be79b876441c084c42f848ba5cd744", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021938, "uuid": "456c6f86-f8ee-4e86-81be-8129da8b9fd7", "comment": "Malware payload", "value": "14aea1f462027319569a0f99ffc10c9471f0fc1e", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782021938, "uuid": "d01c3015-950e-49c6-8a8d-c32c10da4121", "comment": "Malware payload", "value": "ac5e00a22677c8a6e01d07ee1338f030cf1d0a8221805cf032365b227646f006b0a1fb4db03c76d5182facbbd2329cda", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021938, "uuid": "de7bf5a4-86c6-4b32-9089-384106c55b94", "value": "T155853308D66DE7DC265ABA9032D9D7920846333D1A34E72A187F5F9119EFF47C220E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021938, "uuid": "1f949289-9c87-423c-b558-06bea012e186", "value": "49152:CIZ0oNr93/kTwDNpRJLyZbAS/5TvO3BNfyxdJa:9Z0oNr93/1NPJ+xAS/yB9WdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782021938, "uuid": "ad7c5c57-10c5-434f-b5ca-b49b59332873", "value": 1736136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782021938, "uuid": "0cb27a5e-0e70-42c5-8e39-fc9353ce0301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782021938, "uuid": "1b987088-ba63-47de-8a3a-6da250138ad4", "value": "kblockd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bf6e51-6d92-11f1-ae13-42010a9c0009", "comment": "Malware payload (RapidStealer)", "timestamp": 1782061333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061333, "uuid": "8a7f57bf-3ade-4fc9-b920-3d3f25a32b41", "comment": "Malware payload (RapidStealer)", "value": "25a6f749fac33d3eee4b0bf685614f2b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061333, "uuid": "f2b5ad37-e49a-40ce-9c6c-696ff7e90d40", "comment": "Malware payload (RapidStealer)", "value": "f7b0d34a8cd8841cf48036e4155da13d741697f5f8e83965178e5e8f1763059e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061333, "uuid": "4fc23373-2aed-42fa-9d15-040c9bef54fa", "comment": "Malware payload (RapidStealer)", "value": "b47e6b31424ff2f4ea95b58a2ed568b6f401b773", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782061333, "uuid": "9beb8df9-3b05-4b62-9b24-0d54c65ccb74", "comment": "Malware payload (RapidStealer)", "value": "be5e049ea87bba2641c18179498ca68a496af4675ac371bfc8cf8c7875660a096f22f59cdbd8c7fd53341bb7b500516f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061333, "uuid": "0839ed3b-3f1f-40d0-beb8-d37a19850eef", "value": "T1A434120ABB8DE10DD93F11FB642DC7F2967447F1E10A250F3C5294A919B4B295B02AEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061333, "uuid": "c5b56f9c-110a-480f-b702-3760d11c7db3", "value": "3072:iDV78Kw4F/15nP8xtNg0mXk16NWmPjE8l/1Qs9w3ctwe0RnlzTOCgW37YOZhn:iuAF/15nP8xn5QNzV+sUcBKllg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782061333, "uuid": "95dffa77-bfd2-4088-93db-751138087f22", "value": 233095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782061333, "uuid": "941b66ca-9f7f-41a3-920c-179099153676", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782061333, "uuid": "91258b05-6c4b-466d-a6a8-3d9434e2d97c", "value": "kittycraft-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8269ac-6d40-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782025946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025946, "uuid": "3634458c-3a9a-4a30-b43e-d7a0ee29d0e9", "comment": "Malware payload", "value": "35c3a655cdac9779f6c5d6c3d1276cc4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025946, "uuid": "2a6e76bb-cfca-4e56-b2a4-135750047317", "comment": "Malware payload", "value": "f83a89d905554795f50b66809f0183a5c3e335700723e74600e089f1ae3df3c6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025946, "uuid": "9d3492cf-b06c-4682-a17e-217d80685e75", "comment": "Malware payload", "value": "57ddd017abcc0d37a44f8fc521345cf16745036c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782025946, "uuid": "cb0ae68d-aff1-4d29-881e-a89b6156c82c", "comment": "Malware payload", "value": "97b652b9769bd8ab1dee942e515471d6b2e780134a01c8ae00dc84c9311971c960844c2e3c772d4a3fbe49778ddba46b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025946, "uuid": "ef14deb4-1d54-40c8-aa77-c872b65c9b3f", "value": "T1FA3180EF10206A380202D9DE7362264DB41C8AFF2D4BD764DD484FAD868C5987262F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025946, "uuid": "11cccb7c-3287-4636-8a0a-24142344208e", "value": "24:OUUGmTE3VHHK/4vxSvI5lmK5/h/n6T5oViYa7+LQ:BmoFHnJSe9VnAoVNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782025946, "uuid": "f31badc6-5929-4ebd-885c-75959c39cc25", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782025946, "uuid": "973427e5-baf3-4eff-a930-7da237fa729a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782025946, "uuid": "f71e4554-0875-4c26-ae23-48800894a4d5", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4824a7d2-6d55-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782034847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034847, "uuid": "654d6fd2-535c-40a6-9f3a-5d565bd80c58", "comment": "Malware payload (RemcosRAT)", "value": "3cefc7d607d1bfb2ed3855cda11072c4", "object_relation": "md5", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034847, "uuid": "92682ac5-cf34-43c1-b32b-cb61eb536b2d", "comment": "Malware payload (RemcosRAT)", "value": "f93ff95b099ee0ae13f3bb4e6b80d3160b0485bb1e4f629be6895442f90355b8", "object_relation": "sha256", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034847, "uuid": "2e18d913-a46f-44a3-9d0f-0d59f21d94b7", "comment": "Malware payload (RemcosRAT)", "value": "4e04540fa4a792d958a8ac39ca1acbd42c6fac46", "object_relation": "sha1", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782034847, "uuid": "74307ea7-d735-4309-ae42-d986f3aacf99", "comment": "Malware payload (RemcosRAT)", "value": "d89e0bc69737480cf6a8f3514a3d6f38443898123cba0c7c4f800d05a6cc9ac1d8a40e3c8d70e0cfe86990ad93b91ffc", "object_relation": "sha3-384", "Tag": [ { "name": "46-183-223-7", "colour": "#AD1A16", "exportable": true, "hide_tag": false }, { "name": "kelvin654-duckdns-org", "colour": "#D06CDE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034847, "uuid": "e534945c-d59a-4703-9096-45001c48f03f", "value": "T129552326FE839E9BDD0E00349667A0D1791F9E22BB445D6F37483B4A6C72131C7B6A1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034847, "uuid": "930108be-55b6-471f-b145-1e80d2ccfd7e", "value": "24576:FYNSz7NRNXjA/+OmXCKcsKftqgyoQmuo/2rBWQA5U740mecvjJ:emjljA/jmSsKftqJoQmuo/OBuS40mec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782034847, "uuid": "bd5c501d-65b3-4380-812d-b5b890acf718", "value": 1312256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782034847, "uuid": "c181be4c-d29f-49f3-addd-74688390be01", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782034847, "uuid": "7e0752be-2074-498f-afe9-83ce66afb29d", "value": "Solicitud de presupuesto n.\u00ba 490526.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96d5313-6dae-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782073343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073343, "uuid": "98007bd1-7971-4fea-aff2-5556492ac8a5", "comment": "Malware payload", "value": "7c23e9fd391a6e1b4186cdd981523a38", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073343, "uuid": "7649134a-da35-4c5f-85d7-543481c985d4", "comment": "Malware payload", "value": "fa93ea4a6ce497c4f94ef8d50e451ff1ee81825319bfcf180eb003a61bec3568", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073343, "uuid": "7030ebc6-47f6-49b2-aeb8-9b7823403515", "comment": "Malware payload", "value": "ff9d41310d9524a06fa752ba210a567f7ecd204d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782073343, "uuid": "5c4e11b3-6758-431b-9c5f-98a981e71d3f", "comment": "Malware payload", "value": "7c5aa4f6eacf2bfca5d9a14615604fba252c8dc1c0765133d8fe48200fd4278b44d25222a036f5160a9425334a10c419", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073343, "uuid": "5c849a2f-6c31-4937-9823-dbf1eba8f105", "value": "T134218E10AAFC8E05B673DA0997BBE49015767AECDD35CB0CC354C10C16AE944D866F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073343, "uuid": "9326418b-90b9-4f82-a8e6-7196a9b66e36", "value": "24:Qlv4o4Kzyu52U/tMlBygklBRlB0P8wPMuZJBlBMwA6PFv+F5TN:A4oPtM7ktApDPwF5TN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782073343, "uuid": "36390185-8a2c-4d32-9015-e376382502df", "value": 1190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782073343, "uuid": "b759bb00-35f3-49a6-9489-816fac2e864e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782073343, "uuid": "57965260-cccb-419c-b3d8-e877c2fb55da", "value": "Lwoqo(1).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f105b0ff-6d28-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782015803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015803, "uuid": "58a690cb-e4a1-45ec-b595-225ac193787e", "comment": "Malware payload (RemusStealer)", "value": "dbd4b9870f55d57cb57938df3834984d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015803, "uuid": "a6e64d85-2c41-4273-a752-af7b6519dcd2", "comment": "Malware payload (RemusStealer)", "value": "fb7565d2611a76bd796aa438e907da5b8b59b5acc754b6031f56998468445be1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015803, "uuid": "9bac6352-79e4-45f6-85d8-7c46fa92ddda", "comment": "Malware payload (RemusStealer)", "value": "0ec9c0d2c4645776d630be30d41f60ea872dbd6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015803, "uuid": "0db675db-101f-4bd7-8411-955fa02827d7", "comment": "Malware payload (RemusStealer)", "value": "530289a6688df3607c63c3c42ee3bd5ff674fe4008adcfc35db6f8ff1c6e7ceca01d47916cf6efcce0eabdd71ccc5110", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015803, "uuid": "cca8a2b4-d626-48b6-bdcb-4886d1c7081a", "value": "T188C54947BE9148E6C0AAA2308972D2957B21FC442F2123D73AD0BF7A3EB6BD05D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015803, "uuid": "0991674e-372f-450c-bdc8-fd36f6e4114c", "value": "f23ee6cae9102afbfd90f52d60f792d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015803, "uuid": "76f2c0ca-da27-4f52-890d-38833c067d1a", "value": "24576:NmDSiSZpXJTNQL0mDQSgJQ8V54Wu4/lNYZsaemESBeleDsaFYApw4lpSMJLUhZ:NmDTgpX1mLTDeJQuvNNgsTlHM16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782015803, "uuid": "f703bff4-475b-460c-b139-21310850c96b", "value": 2605536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782015803, "uuid": "829269dd-2ffa-4068-8a4a-8d55f4ee0e45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015803, "uuid": "46b8d12b-940f-43ab-a8b7-7113401321c2", "value": "fix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd13605-6d28-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782015794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015794, "uuid": "eb51a014-2aaf-4baf-8938-5260b9e0d658", "comment": "Malware payload", "value": "daa74756a72e52544373792172891f9f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015794, "uuid": "78d9c758-93c9-4bb6-abb3-d3f5eee3934c", "comment": "Malware payload", "value": "fc3b52d57b500b749d687e61dd604a451db7c73558972b3881917f4dd6aed1b0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015794, "uuid": "5b356e32-edf0-41f4-aedc-6ff184b05b06", "comment": "Malware payload", "value": "2f9ae38c4e340735f298227162d5eb3799de3bb1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782015794, "uuid": "6bc85d8a-f53f-43ea-8726-39416891faf4", "comment": "Malware payload", "value": "1ebff710e6ad45245f6560c7334c3d8ec4b9882d27697d7768b9ec86aef3b53a5021bb7768f9849d07e9fd55230606f4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015794, "uuid": "977b6d18-2f7a-4ab8-875f-8f8184f56e81", "value": "T17D3130CF51106A391303CADD7766358CB40CC6FB2D9BDBE5ED080EEA864858D7262BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015794, "uuid": "d7a5c344-3ece-4afe-a6a7-98eec044b7fe", "value": "12:Ufi6fdN4q6i9EyRB99m6W6FbWd64wf9x8z68XlcIL06mI6mnoC2lRL6RxdwM7lcb:KN5HdmAbaM9cCR2o/DgXd7WJKFtFDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782015794, "uuid": "34c99dd1-87d9-475c-8961-3649bec01628", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782015794, "uuid": "059b7e11-feb0-4c06-b23c-e1fc22360865", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782015794, "uuid": "e3259c85-1071-4371-b71b-33157d297826", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fbb675-6d97-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782063410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782063410, "uuid": "54c379bd-a495-4a09-945d-3adc526a0848", "comment": "Malware payload", "value": "5741573fd7a10b5aa1093c27b8886098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782063410, "uuid": "824d0ae8-1abc-49fa-9d01-0b52d67a390e", "comment": "Malware payload", "value": "fc66451dd36b78415bc38c58a3bc474504a8cbd45b12dcd271194bf25af4c742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782063410, "uuid": "fc2f9178-2d0d-4768-b063-482bc88f03a1", "comment": "Malware payload", "value": "84a37c3c157ccd4e7ab13c13c77838bc2695b48c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782063410, "uuid": "6d5a7944-68b3-41bc-9b2d-9b692599d971", "comment": "Malware payload", "value": "cda35affef2e35e5d2b27e624eda6cee126f4d4998e6a6c6c18f69ce339d6ba6b3c482fc46adf8dda29749d7bb66aa8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782063410, "uuid": "f3fd4e91-e4ba-44c3-9f7e-371627d64a13", "value": "T184654A27E26344ECC56BC17887579F72B930B8594134BE6E1B94DB312F21F609B6EB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782063410, "uuid": "033340a6-f9fa-482b-a45c-63f1529bc828", "value": "004bd59890c98f7f71a4d60e300927b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782063410, "uuid": "1a824648-dee9-4650-ac8f-7f718daeb4e7", "value": "24576:/nRL5TTK4WKSRIdv4RTCXrFAbXjzIpgIiZdYIj0:/nRLtK48R6RRaTzImtZdYIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782063410, "uuid": "dc84c7e3-fe76-4d4a-989f-086f60eb6e9e", "value": 1457152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782063410, "uuid": "9ad44b4c-92f0-4610-844f-9e235365bd7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782063410, "uuid": "365df77f-ad6e-416e-a9dc-afda885ca175", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d386be-6d5c-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782038150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038150, "uuid": "e0bf81d7-e07f-457c-8e88-78557aae72dc", "comment": "Malware payload", "value": "9ec21c5e05638b1867057e9d33f65046", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038150, "uuid": "09c9d598-7296-486e-9b39-c647ebec3ade", "comment": "Malware payload", "value": "fd3b9be7ff9aad82baec194b849cec7478d59cdeec96e3421a372a585e79a70e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038150, "uuid": "482348f0-b07b-4951-b1dd-cd46e305a6fc", "comment": "Malware payload", "value": "3a03a2f3d034007fdda7e26cf3fd8d5c1f8917fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782038150, "uuid": "6abb0c1c-a7dc-4c18-a6dd-c2ee943a802b", "comment": "Malware payload", "value": "8d63fc6a27effd45eea09df9c25460f2a1461588bbbbf3fa6a0d03a485c2040b1de92e9e2831f2853f4440c9a4edeff9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038150, "uuid": "689f1b85-fe4c-452b-9b6c-908ec4a82d1b", "value": "T104E46D99E783D4F2F26340F1024FCBF20574A516A057FAF2EB852A5778727A22F15329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038150, "uuid": "272bbb0d-4bf4-43ef-8e5d-762c57c318a8", "value": "12288:PuTT1KV3z0v6rTnhe6hFqrqmVGR/Hp5xNyr8VDh0dLQewkVgyv6p2R9ciaVt:U8V34ir7he6hNHpvNyIVDhWQbkCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782038150, "uuid": "d4470473-7285-4045-8fbc-15bce9d98332", "value": 714868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782038150, "uuid": "58d442af-ae23-4ec0-b090-7d6dd01edc0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782038150, "uuid": "2b45a2aa-d903-462a-920a-2a9f11d07eef", "value": "bot.i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6390a44-6d48-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782029502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029502, "uuid": "5d363e02-b4dd-4608-96df-17f25266e480", "comment": "Malware payload (Mirai)", "value": "a39806439ca788eb5cfad73ead6c67bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029502, "uuid": "96264df2-af9c-4489-a5c3-d98487021075", "comment": "Malware payload (Mirai)", "value": "fda6258775198b58c4578ac4305a410ff8a1b3631335e3d86645db79fb9e849b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029502, "uuid": "4dbecb4c-194b-42fe-8525-00d8090b0a85", "comment": "Malware payload (Mirai)", "value": "0891d6e9310100cf396b7b829a02e338ebcca6e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782029502, "uuid": "2efdf2e8-9ff6-4e4e-b414-61d8e751e6f7", "comment": "Malware payload (Mirai)", "value": "365a71eaf957523f438ad74f56d5cf75789ce16b40e2d356232a5fb88dd4b05b0dc26a19de5268ec181fa09c0536cb77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029502, "uuid": "2dc717f9-01cd-421c-b6dd-7a7d4a1d79e7", "value": "T12324D709AB610FFBD8AFDE3706E90B0239CC591722A43B793674D928F54A54F19D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029502, "uuid": "7548c028-f949-446a-a559-e48eeffa0f51", "value": "3072:xYpvBaAhYyw2GfXDBen8egvGSrGvvWYRHIY4jc:xYpvBaA2fbBK87GSCvh2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782029502, "uuid": "a010a34a-f797-495a-b11f-942069de6d2b", "value": 216496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782029502, "uuid": "574b232b-e657-4a1e-a3b9-6359e7247f9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782029502, "uuid": "331863b4-4138-4ce8-85a7-1a4ab6e7b8e2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a8e050-6d4a-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782030092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030092, "uuid": "16251370-06e7-4c64-bdc3-d64071205525", "comment": "Malware payload (Mirai)", "value": "478f333970ee3a1866a83d3a3f49f0ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030092, "uuid": "5ad8df84-980e-4b54-ab35-4c2372d71ac5", "comment": "Malware payload (Mirai)", "value": "fdacc304a99402012f5b9e6708344b24ff21d7c79178633a3cde1411bef56960", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030092, "uuid": "065e84ae-643d-4782-bf24-53fd789f0d81", "comment": "Malware payload (Mirai)", "value": "c3673157f2d7af1b4e824d1aa2308be5dbb53ddf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782030092, "uuid": "3b553468-f67b-4794-8fd6-b7e94b0d3a10", "comment": "Malware payload (Mirai)", "value": "8d7deb0b2d82e3f1f0fff08f5cbf89edf455b8b1ae3e7f7042fa8ecfb03c2bdc96a4b3bd3c94f6f0e648d15c3435a4a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030092, "uuid": "a4135b18-4904-49fe-9e4d-2339f76c1357", "value": "T18A83C606BF610FFBEC6BCD3706B91B0525CC651A12B87B3A7534D92CF68A24B49D3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030092, "uuid": "1e3d3487-5ffd-4a70-a4f6-9e59aed7a47b", "value": "1536:uZFweyTOHoUxFo3kWMImsHLxGmhr1DR2WG:uZFwIoHLxGiwWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782030092, "uuid": "acb924a0-b6b9-4e25-9495-827d4865b7e1", "value": 88636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782030092, "uuid": "97e15df6-cab4-43b2-a5ee-4dc9a39699ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782030092, "uuid": "38af84fc-b453-49b7-8f9b-997ec13b1a84", "value": "kmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff8b099-6dba-11f1-ae13-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1782078508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782078508, "uuid": "b335f0bc-6eae-46da-bd9f-3a446fe7c96e", "comment": "Malware payload (Stealc)", "value": "86f1d93516e8e9a5626795670242fec4", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782078508, "uuid": "0655f9ec-5831-47a1-9bbb-419c9b6f1e33", "comment": "Malware payload (Stealc)", "value": "fdfaed3893bb2cf3ebd547c889e17c1e2f0b90208ecccc8591164bec41cfdb85", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782078508, "uuid": "df601141-728e-461a-a360-f22fd267a4ac", "comment": "Malware payload (Stealc)", "value": "812de14c2866861965796b7d89225cd559d10e42", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782078508, "uuid": "eb66e64c-5e2a-4077-b668-0fbba9788bed", "comment": "Malware payload (Stealc)", "value": "8d8d24828eb46304ce673be8d86ffbce9b91350ac6435d8897ae5342743c96275053b006ebf2d0caefce901ff0762cae", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782078508, "uuid": "e3731e90-a11f-40e3-81db-99b1f42b40b3", "value": "T1E7268D7FC13B0827ED9B63E58C591ACADC5CE7112710646A62BD189D8728EFEC0E1637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782078508, "uuid": "afc566fb-96b0-4efd-873a-0a37ab0fa32d", "value": "019ffc24dd80d5fd4d1178857048e434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782078508, "uuid": "86f532a9-155c-4820-aad3-5d555f5d7c1d", "value": "49152:ZDwU3chslKfVF3GD3sAZBnl2bAOtvLE2LW4Ow48uHoL4xqRtg/vc2Mrp9lRF5v+M:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782078508, "uuid": "ba6465db-c75a-429b-8454-0d23628c99cc", "value": 4597680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782078508, "uuid": "00436caa-5c8a-41de-b7df-8fd010cb0ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782078508, "uuid": "f9373293-d64a-4cc9-8a07-4c78694216a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652b4a67-6d24-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782013850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013850, "uuid": "d338aa1b-412f-4539-8025-f7b24ccf5160", "comment": "Malware payload (Vidar)", "value": "cc78cd65c4c0beba0d3d6db9f70401a3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013850, "uuid": "e58397c0-53bd-49e4-975d-9faa5944811b", "comment": "Malware payload (Vidar)", "value": "ff771fcecd52f9051afca243d97c785b4bec00bb87ef2392ed6a74c91c443fa7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013850, "uuid": "0b2ddc24-5682-4373-8646-9de9de1b2245", "comment": "Malware payload (Vidar)", "value": "e5b5c76a2180c85d7d432b358c07bc457e27dd9c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013850, "uuid": "dea362af-cb87-4db9-b883-0ce9e0c3e10f", "comment": "Malware payload (Vidar)", "value": "4c0b859cbf2ebd1d8e50e1e73d8c13ff72ea3478fda94a338c468eadc21a7197bb7263579dda93ab10bed399d1eb895d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013850, "uuid": "82ee3ea7-6ed8-41fb-87a1-4e8416f1a33b", "value": "T129068C03EF910C6DC456A27289A36291773CBC445B322BE36EA0777A3F367D4693A714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013850, "uuid": "b648297a-d233-4931-93c9-2a68831f5af1", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013850, "uuid": "4d77b611-13df-4c04-b880-bda59697e049", "value": "49152:nyk6SLO68u19ZRWmexb/Z3rc04BwVSBIMNVM25tB175hgsi:nZJLwJZbc0kLBIcVh5ft5Ssi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782013850, "uuid": "021da6f5-17a6-40ff-8399-8e26d13cc3e5", "value": 4014032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782013850, "uuid": "d1fcaeb5-a51e-43ec-8aeb-82d0774b4e91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013850, "uuid": "28cf98d7-576a-4f8b-9a17-70f318d86ecd", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d73a27-6d22-11f1-ae13-42010a9c0009", "comment": "Malware payload (SilentCryptoMiner)", "timestamp": 1782013016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013016, "uuid": "90e6d183-a49c-454c-8d30-5cbb26caa123", "comment": "Malware payload (SilentCryptoMiner)", "value": "82d94a9e1a29ce0803fc5bd0b228a94f", "object_relation": "md5", "Tag": [ { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013016, "uuid": "582a9832-7129-40a3-9ce3-0ddf29968116", "comment": "Malware payload (SilentCryptoMiner)", "value": "ff79eaaff344de14717cf301e0501b62407bc7a4836ade5b4c2c92b9ea2cc32d", "object_relation": "sha256", "Tag": [ { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013016, "uuid": "0f42113d-b695-4dd1-be92-ff474fcbfeaa", "comment": "Malware payload (SilentCryptoMiner)", "value": "e73867c158e8a2bf1c1201f397c24675d8a269c6", "object_relation": "sha1", "Tag": [ { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782013016, "uuid": "ee03dc1b-d842-4319-a25a-a9a2ee4a8898", "comment": "Malware payload (SilentCryptoMiner)", "value": "ac59cab6ac41e22f7ca685ae0c601300eb946b77f1a7e20235c923e086ee5db56f8d75db1e727182c0fc1cc219cad577", "object_relation": "sha3-384", "Tag": [ { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013016, "uuid": "03c9f0c1-1a02-4a37-8600-56af611ff5e2", "value": "T15B1733E19CA72545E8D6C8B3C9B71DC30C6B19DAFA65E3202D751CDF683910A0A6C4BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013016, "uuid": "2a004552-cc7b-4bad-9cb0-6eb820047167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013016, "uuid": "d6161f03-f787-4749-b577-b6c1d7936ed2", "value": "393216:21m9AF1xBMY7n6iB+ny9bqyeBwf8CBkZXTWztHPBFP5uGhtY:21r1PMInn+YqyeB8kZXopJVoGhtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782013016, "uuid": "38e89aa7-de74-4a63-84d9-7a9832e1bb59", "value": 19314176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782013016, "uuid": "6eb617a6-e8a4-4824-86c3-393130d67d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782013016, "uuid": "d54b7dd2-2ce0-4bb8-a825-c52130ce71d0", "value": "VORT-SETUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }