{ "Event": { "published": true, "date": "2026-05-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-01", "timestamp": 1777680182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b61d0375-ca20-48b6-9a05-6b9c4eadc523", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65a51b0-4586-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777658138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658138, "uuid": "66497400-358e-44dd-8274-de06631256ba", "comment": "Malware payload", "value": "036962118f21c988a085276adfcf0a14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658138, "uuid": "65b0b894-d18e-4fe7-a6fb-c4d1379f8e55", "comment": "Malware payload", "value": "000c6aaff73ab8b86bced644636aace5c1a1dbbaf938135216e426f5db96eeab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658138, "uuid": "c8a3645f-a859-4dd0-b343-64c4c0c111cc", "comment": "Malware payload", "value": "317b38d1b4b288b362cbe00a71c36144aaf90838", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658138, "uuid": "ab5aa437-7056-45ed-915d-011ed7defcfc", "comment": "Malware payload", "value": "3f597f9314811e2c19294e381dea340a48a666d63988d5259275e6826c873fee9aae9f7410dcea5c5af2cdda953c0150", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658138, "uuid": "65bde605-89a7-4722-bf85-305ad38e8c72", "value": "T1ECC17D7EA06A849BC104933AB27A5CDD69B4449593EDC6CEF764CCC309A3822E938158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658138, "uuid": "0db95cfc-7264-477b-a8b9-a2302bf5b302", "value": "96:MMQA8h/H3XnHH/c7IbLJsKRg4WChnKiGHWnI/LfTcKHrYSy/1JpZ6vSReGAsZ4X:MMQPHHnHH/ckLJ5gSULwW0qMlZ4SRVXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777658138, "uuid": "67713348-cbaf-45e2-a185-18ad379ad9ac", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777658138, "uuid": "3cfc5a96-b2af-46dc-b61c-32a0bd1c73e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658138, "uuid": "6cd44319-eed3-4860-a2b9-b2cf00664471", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdfcb39-4549-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777631928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631928, "uuid": "07ba17c6-bdc1-4656-99e3-41563a2c9765", "comment": "Malware payload (Phorpiex)", "value": "a399cb6fc83e493463e6d67d8c874818", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631928, "uuid": "bb726588-4be7-497b-8cdd-e5e9ae8b9609", "comment": "Malware payload (Phorpiex)", "value": "01b577ab165b9c1abe8385d21ba59e9b0417d0f04ab3506d1c200cbdfcef6a19", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631928, "uuid": "6085db5f-1cab-4d85-959e-15ab12819617", "comment": "Malware payload (Phorpiex)", "value": "1ebba363183dda64458224aebf44dd6a28a61d02", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631928, "uuid": "b04f4907-cdcb-4dd5-bd8e-ae86b12edee0", "comment": "Malware payload (Phorpiex)", "value": "357e03f3ad58193907d4f26ae45b26e4f872610be8acf9fe9e2f9d807e58a333ed648be27cb4f4d48a44f47e3e499ded", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631928, "uuid": "25dfe3a5-b8dc-4442-9acb-3860f41bdb2c", "value": "T190825B0FB942421AD0D100749636867BDAB998B637D814EBFBD08AED1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631928, "uuid": "cf3c61b4-ca2e-43c5-ba2d-6715b980245e", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631928, "uuid": "cff727d7-258a-49fa-b1d0-cb93a69e0871", "value": "384:hI7MVGASM1KwLgSZb7u9NHuagRhav8U9cb:6QgUb69+ha0UY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777631928, "uuid": "c5137a64-1acb-4aa2-b287-66156dadf204", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777631928, "uuid": "fcfd77fa-1e90-4597-bc35-33755a6c11ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631928, "uuid": "36342d79-53d9-4a3a-8691-13ecf843e82b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d05c0d2-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777635950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635950, "uuid": "e8821649-5a1a-44f5-a627-106bae12774d", "comment": "Malware payload (Mirai)", "value": "5b5a4120862dfe9262d6e20d955e1080", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635950, "uuid": "55cc6771-a132-403e-b789-d49d596d2194", "comment": "Malware payload (Mirai)", "value": "0218fd60627febd0baf123f95545e31bc569ac5ad94cf04b80aeffc12d39fb06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635950, "uuid": "040be0c3-e0d9-4dd3-8784-b100a3102af4", "comment": "Malware payload (Mirai)", "value": "8e3397e45da0dcfbb1f3cdbb9473045b704afcb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635950, "uuid": "38cde846-52db-4a93-97dc-9eb11a961b65", "comment": "Malware payload (Mirai)", "value": "a5b0fcd521ccaadf61c90ea3fff4c08a36e9de0d2f2d3f72f5feb2395ba17629805889a5cd1ff1bba225d894b5c1e75c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635950, "uuid": "fe97aea8-8ac6-4e1c-90a8-cf1815a1f30c", "value": "T129F33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635950, "uuid": "feaf6f99-6375-40af-9c14-fd0761dd5076", "value": "1536:hdMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMphEn5p5M/LW:x7vDtrnPTR71gmX7Dy7fMphxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777635950, "uuid": "cf175188-a35a-4785-ae6c-b445d8f81864", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777635950, "uuid": "76484c2d-532d-434c-bafe-b67f22e85c7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635950, "uuid": "7a89c813-ad59-4857-826d-b30787d6ed3b", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a69016-4584-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777657110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657110, "uuid": "ccf7450d-365d-457a-89f1-154349a55754", "comment": "Malware payload (Mirai)", "value": "9375ef228a3c7cee5018e3e7bf4e7240", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657110, "uuid": "7355d9b8-f242-4f1a-b451-718d1f864e2f", "comment": "Malware payload (Mirai)", "value": "024ccb548b5dabf50351d6ce470162edc6debb81770431fc0926be55678afa2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657110, "uuid": "1eb455f4-6700-492c-9e03-f479ba7e1073", "comment": "Malware payload (Mirai)", "value": "4b8bc72074281f6c3286df480bb15dd853aa0a7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657110, "uuid": "1e0f16ca-38b5-4223-91a2-ca50ad2701ac", "comment": "Malware payload (Mirai)", "value": "00b9e62da4e6440d8426c76fa1eb7376ede7cc63aff61110caafb898add26b973981c20bef91ab455a9b997d33a7b63f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657110, "uuid": "bc6e8ea7-fcfd-4a8e-966f-70082c8c5358", "value": "T132148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657110, "uuid": "c0b998df-fc3f-4ae4-9460-9f3fc2c71966", "value": "3072:BcHZcggFy1tJmajThwnKBDMOzsjJjL1lCRKUKG:BcYFAJ9/hjzsdjyJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777657110, "uuid": "bc6aa14c-2ade-490a-9d32-5ddffd6c0839", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777657110, "uuid": "9efe6555-957f-473c-a0ff-705c9abd8aac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657110, "uuid": "551c2791-1f45-4e30-a261-c3f6263a4473", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b665fecb-452c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777619376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619376, "uuid": "7b651a49-2180-4ce0-b21f-2091aa4dd15c", "comment": "Malware payload (Mirai)", "value": "0a5a50128bd9a6bc8636b0b834db0e63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619376, "uuid": "9a6072b5-0be2-430b-a1ef-973972542404", "comment": "Malware payload (Mirai)", "value": "02531eb6837948d225684bb14a593d5a3960a3d603fef54476cdd2825e211a62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619376, "uuid": "0764a30a-80ad-46de-b29f-6b88329d964f", "comment": "Malware payload (Mirai)", "value": "1aae123e831947bfdfbc589fe6f9d686d843a3ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619376, "uuid": "093ff67a-7d53-481b-9bf3-a1f966d9b06f", "comment": "Malware payload (Mirai)", "value": "4a43c5a822e7ef781a5e3710e0332b89aff1f874fc8db3a1c709a10e06e0f02c5a476f1af61bbc7d9966fb14d16ae359", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777619376, "uuid": "901d0d86-f0ed-4ccb-b27f-0098b0f19cdd", "value": "T1BD23E1E7C39EABB8D1609AF91F5BCD81CF15B489F200276F3DDDB6A1D4B480621629C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777619376, "uuid": "3de6ed94-6f73-4a50-b137-452f0a3e0865", "value": "768:bRTPn5rcXYjK2aPCTNUZAhZkpF860potyRiozAykwYG4BJP72VPjshPh:bRTP5oXYe2avZQkbSOyRpzAD1G4PPaxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777619376, "uuid": "5e5e6b89-30b5-43a3-bb01-8163b0641ec1", "value": 46596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777619376, "uuid": "4fb9e780-4d45-4620-874c-0fcde23ad8d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777619376, "uuid": "6389c962-5cc3-477f-925e-8e4426be61fd", "value": "rage.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b1d780-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777635956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635956, "uuid": "64d91457-1c95-42db-aacf-d8a5d6bc7ac1", "comment": "Malware payload (Mirai)", "value": "4515e7e989477fdd61848db9c501934e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635956, "uuid": "5a96e8ab-b7dd-438a-9e7e-99fb9b6e6d09", "comment": "Malware payload (Mirai)", "value": "0467c2e50e5accdb94e0f72cc4bae1cd212c9d939b24c785768fa87f62e3c2da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635956, "uuid": "24169f7f-bc3d-43ff-99a2-0f1d252efa14", "comment": "Malware payload (Mirai)", "value": "ddeca5878663755fcb91140f571e89981f542f49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635956, "uuid": "5dc58ad8-aecb-477e-a1f8-45a00d749224", "comment": "Malware payload (Mirai)", "value": "aff60a7afa3075d20a707286e1aedb4ea0c904025a5ba64b4086028027ab0d84340a8e1473ad9b16d142fea4f8359033", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635956, "uuid": "cbfaa6f2-e76d-4f82-acd2-ad2acf7d060a", "value": "T18123F157932BCABFC5228C79624E698CED72716BB3182F0E08D739A5AC77C801D346C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635956, "uuid": "c751db5f-1f91-484c-bc19-14592d545362", "value": "768:xpZeQQmIpvlgcnsCesfeS+0SL6U+0vfl9+W5WitRwqnirZiaHqaQxUw4v:DZevDvlfsJMU9LTF9+zitiqirwyQxUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777635956, "uuid": "e6cee08d-d102-4f19-8ce1-02e1b879dcdf", "value": 47720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777635956, "uuid": "8696aad1-6e34-41b1-9f78-0b41e0e37e23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635956, "uuid": "c7b1b821-31d3-43fd-91b9-f14aebfe9f5a", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df8c16a-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618664, "uuid": "e989f7f7-8d71-4a28-9579-0d747facab6b", "comment": "Malware payload (Mirai)", "value": "7cb67d8b0b1ed9f6a42b16a091a84334", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618664, "uuid": "809f51a9-a383-4c98-b7e2-3126ad4ac0ab", "comment": "Malware payload (Mirai)", "value": "04a554c09771cfe6148d6f16b18d71af978d5a730be669da76a2c2bed13d644c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618664, "uuid": "0c02e4a6-2601-4f4b-b46c-1df352c20736", "comment": "Malware payload (Mirai)", "value": "3ec1df0f468097224fee9dfa73cfd0b83a312b83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618664, "uuid": "12ad34ea-b116-496f-9fad-e0f02472cb57", "comment": "Malware payload (Mirai)", "value": "277a8eb3875e775b97ce2de0b5555e37f42650b781217b1d261b6f94d2b4bf68cb16e2fc07eb3cce5aee29dea2752603", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618664, "uuid": "a835e40b-3c58-4849-a824-b42eece00b85", "value": "T105B3C96B3A21AFFBE06983310BF79F2087D522D626915342F15CE7585E3128D2C5FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618664, "uuid": "c605f19b-ab79-4115-b518-8d17768db2d6", "value": "3072:DWmzrbF74jA5hU8tRreU4gQKdwwzF9GhsRiAe:DLzrJ8A5hU8t2KdwwzF9GhsRiAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618664, "uuid": "0b1c9135-9c1a-435c-8cd9-e2d9432cb8c1", "value": 114575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618664, "uuid": "1213e120-0692-47aa-abf4-5690d333623b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618664, "uuid": "d595368e-6d25-4804-b9b3-a71163dda6d4", "value": "hidakibest.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565899b0-4544-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777629523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629523, "uuid": "919693ad-6cae-49af-8b63-6a8a47a20f07", "comment": "Malware payload", "value": "f3b386c887ac00adfc5ea5c9607a80ad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629523, "uuid": "10370c4d-bf71-49d8-a936-30e8b710ea5b", "comment": "Malware payload", "value": "04fa680781838831d55105747081feca9e844e687ea4661f5e9e4f13c7081b13", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629523, "uuid": "7089e816-3d15-4cfe-91b6-9f71b320cae7", "comment": "Malware payload", "value": "0c51ce76abe29a488faa7ce80e1e99c5faf10a4c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629523, "uuid": "6fc1173b-e940-4d28-8ae1-f7055a923570", "comment": "Malware payload", "value": "22532c5055af5b60a270b121e58ca4fd75c67da94dd2b4bae4581b160a588134900ba4e74fe0ccddc5e05495b26ffa05", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629523, "uuid": "2667c319-fba7-4858-b4dc-f3426d8bbd06", "value": "T1B3D02E1BF81A048900EC4DC60A671A8C432FBC4488D9890CF60A26E9A15A212281DEAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629523, "uuid": "dd504a51-8d0b-4285-808d-1d3deeb3f576", "value": "6:iay2AOzckHHy7nhHSB4ZiQZRpmYHB3/Lrec9eCLNmeH03n:iQFkHSB4Z3JmYh3/fM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777629523, "uuid": "45c13f6c-5294-4d0b-ac81-93286c0a7ea2", "value": 245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777629523, "uuid": "87124acd-870d-4476-953c-05ba74be76d8", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629523, "uuid": "29f44479-a6cf-4c0c-8838-a811b7ec1949", "value": "04fa680781838831d55105747081feca9e844e687ea4661f5e9e4f13c7081b13.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090ae18d-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777618656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618656, "uuid": "982f7e82-96d7-43b7-81c4-5cdbf6354382", "comment": "Malware payload (Gafgyt)", "value": "cdc5f92ad3d96d67a748ef9d2eb801f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618656, "uuid": "d887f78e-f80f-4924-b791-b82b023dadec", "comment": "Malware payload (Gafgyt)", "value": "0850610d49a3a21e82f8b1aa31ad304d743c9c8c82fccd9ede53845cc5c448d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618656, "uuid": "7fced873-0c53-4923-b330-6050ae40b089", "comment": "Malware payload (Gafgyt)", "value": "480bf53cab2f09f72c7d0980eb07a0e50efbbd79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618656, "uuid": "fae67352-0e82-46d3-8ea6-48ab992b3690", "comment": "Malware payload (Gafgyt)", "value": "9b153645b8ef8637b614c344f90176488a6c4c81c9e52f842ec5256161d419d617457353ebc6b257157c612c07d54dd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618656, "uuid": "8fb1975d-4d0e-4101-a83d-dacf6b006b5c", "value": "T174E34C09F7408B57C0D22776B6DF524633239BA9A3DB33069524AFF43FC27A94E22951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618656, "uuid": "19e7e9c1-1431-487b-8bbf-52c1cf497915", "value": "3072:Tdbmn8aAEHqgSkano1DTAU5hWTGHJWM/9lxXmpwTsL/QMyn:he8aAEHKkdDTN5hWTGHIM/9ldmpwTsLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618656, "uuid": "ef0c1bd7-18c0-446e-92ae-b47568c8e177", "value": 154520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618656, "uuid": "2b58ab0f-0278-453d-a90f-22e2a6cb8627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618656, "uuid": "887d1669-4529-487e-b2c9-8896214fae4b", "value": "hidakibest.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af0fdc3-4561-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777641905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641905, "uuid": "6b3af840-004f-47d8-95f7-ed9215300957", "comment": "Malware payload (NanoCore)", "value": "6b9c4c8bd3691ad0446cfe15408cfa2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641905, "uuid": "7f44b85c-021c-4d28-b359-df7a53c09825", "comment": "Malware payload (NanoCore)", "value": "08c4cb2596ca91f4a88eb74eede2edaa801825724a2b77c00508374c5f89b689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641905, "uuid": "d5c5bb6e-399d-4532-84c0-3bee4f1a40f6", "comment": "Malware payload (NanoCore)", "value": "f7acaa913e414d3ee28998cc63e8628178db8678", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641905, "uuid": "6943fffa-dd75-4b16-8e67-d8970ed4876a", "comment": "Malware payload (NanoCore)", "value": "b10673a32a692294e48e5801f059d7f99f29c00ecd37a39408b1bc3b517cf5d609476f1f7283e19ee480a5840f355a3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641905, "uuid": "62d709e1-dde9-4c27-b78c-7e23a067bedb", "value": "T1F714CF5577B88A2FE2DF86B9611212128379C2E3D8C3F3DE28D455B38B267E5060B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641905, "uuid": "7bd4ff66-ad13-4a7c-9bab-53b26e80426d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641905, "uuid": "8edfcc46-ddfd-4b66-bcef-4da9dfe386b2", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HItusb4F5e9nOjbdIlmvujtJrAF:gLV6Bta6dtJmakIM5hSOvh2RCh2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777641905, "uuid": "bdf61ecb-86d4-4214-941b-50d23c9fe197", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777641905, "uuid": "646bc195-5726-47be-a829-3b8c132b787c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641905, "uuid": "857d5a1c-4c57-40c4-a4bd-5aef471e8284", "value": "namecheapnano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8063a3-457a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777652998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652998, "uuid": "f0edcdb4-4f36-449d-bab9-1cd25329a186", "comment": "Malware payload (Mirai)", "value": "3767331343ad575314742c4e249c1319", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652998, "uuid": "4d69bd0e-31f8-470b-9bcd-9e6dfb6ed7f8", "comment": "Malware payload (Mirai)", "value": "08cc6eabcf1eee097ebde6b25b8c1d568429f4c27f787da4eb8f03166e3a6459", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652998, "uuid": "ce118c2c-d9b9-4526-a43c-2c3437c9e580", "comment": "Malware payload (Mirai)", "value": "4990b4493b783f40517ef9b8cdd52bd6db9af632", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652998, "uuid": "e6dcc628-1bfe-4216-acdc-4bc05ef92ee7", "comment": "Malware payload (Mirai)", "value": "f808a1ae0c248256c7ffea1fd24a4f3cd194542f474703b7b900687fb06818cedf68afd4b1af85e71ab735644bfbafbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652998, "uuid": "d3c11904-f8ba-40aa-86a3-d810003abd52", "value": "T19A9312669B34A033F3A2A81CC085DB83AF531F73A63B77A1824DF76E0C314265E85816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652998, "uuid": "887b3704-a069-4109-8a41-d4eef1e8178f", "value": "1536:hQIxtLLz5XPOE1lpe9sKMbp16PehGSOo7qaAOLXHMtfJ0uGgoqs:OIPhGETjKipGhTOqaVLXHMtR0uGgoqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652998, "uuid": "865734d2-73b3-4373-bd21-eef546563e35", "value": 93380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652998, "uuid": "c0f1b77e-dcaf-4736-b8e3-4120f86fcb24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652998, "uuid": "38e6df54-c1f5-42d6-9196-b7d82e635752", "value": "vaxbot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ce788b-451d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777612926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777612926, "uuid": "97d98c4e-c0ab-44de-bdb5-9c8c8e895953", "comment": "Malware payload (AsyncRAT)", "value": "7f40dd3cea47abfcc795a3a3dd5610cd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777612926, "uuid": "6fdf19a6-66c5-4e1e-9ac6-80c4bc0b5904", "comment": "Malware payload (AsyncRAT)", "value": "093ab8d23d5331562f3b148c7f524c19a0f07a68115c229ec993e110e17242cc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777612926, "uuid": "e21ea5ee-1c4b-418e-9cab-2b3de4f7251d", "comment": "Malware payload (AsyncRAT)", "value": "244c190f1c749fd34caa3aa2a2a420de0935b5db", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777612926, "uuid": "f4f30d4d-5211-4ddb-8b7c-8dcb703fc9fe", "comment": "Malware payload (AsyncRAT)", "value": "e7c2b8244a039d33f0e5573e1c8502955131de0ce1670ec1ce41b15118b0812f1ba093214f5fc8c676184ad9eeed9f76", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777612926, "uuid": "b895e6cc-3bdc-4384-b1de-2772fe998ae1", "value": "T1CB150290221AD903C8935FF42DB0D3B44B3C8E89E911D213AFEB7DABF47A6816D55352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777612926, "uuid": "756ac2d7-9540-457a-9e75-edd2771a5cfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777612926, "uuid": "3d9b917c-9f14-404e-8877-65e339730f08", "value": "24576:SWoEGB6oiBh0TEz5JlJ8uwP+Ai9CtjuB3:1oR6DBhLF8uwmAbgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777612926, "uuid": "fd2db62d-4b5c-4c12-b82e-d1eeebfbda57", "value": 900608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777612926, "uuid": "d1443c69-2bbb-498e-8af3-39d5e4ca9fe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777612926, "uuid": "c63d0039-6ace-434c-b58e-df20c3dcea8e", "value": "TT-PAYMENT COPY -04.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74206aa6-457f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777654913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777654913, "uuid": "8497abba-5395-4d6d-8de2-7909cdde28b7", "comment": "Malware payload", "value": "690260a9f9f718ed30af33b95134e845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777654913, "uuid": "cab9edd6-6012-43d5-a9a9-1a54940338a3", "comment": "Malware payload", "value": "0a460aef2c3afb368cd33afa662ce37a7578fc5710b58c4d1fcd1aeb4ea28773", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777654913, "uuid": "93a9c86c-2666-40c2-96ba-5e69319f0f25", "comment": "Malware payload", "value": "2fe67e3e4be784a157dfe746e4ba94ae661c9307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777654913, "uuid": "c1b898ce-b1ff-41a4-b521-6448728d7e1b", "comment": "Malware payload", "value": "39583874c02cd8b222cf30ae85933d771e474e680604a69e86dfe54801ba8d4d1c9b147ccfa0d56ae7be80dfbc65bf1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777654913, "uuid": "71ee122d-031f-46f1-aaa1-c4af1fcf1fb7", "value": "T17CF7339F8ED64161E2EE47B7E3F139580438F7010F217C16699B2E8ABB24D4CE5EB158", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777654913, "uuid": "618dd8e3-25c3-461c-bd6a-68fe3865c4f5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777654913, "uuid": "2f8f489b-2084-4b4c-bb21-803e4993328d", "value": "1572864:MejOS3EBGv9GxAQNZcFr1dFW+kSnChwzVjujjlXeE7:MytQDm1dzkSCWFujjluE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777654913, "uuid": "de7454e0-ff8a-493b-86a5-d875451398d1", "value": 75461333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777654913, "uuid": "5927ef22-fcea-4968-b526-ee5fbed93d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777654913, "uuid": "83d1487b-f509-4948-b5ac-94f2fec83804", "value": "AiolosClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bc27d3-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618657, "uuid": "5053b82c-2412-49f9-83a3-0e8619c3c1ae", "comment": "Malware payload (Mirai)", "value": "8431b8e4d2af344f516a725a2ce3f897", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618657, "uuid": "3d5a7669-22a9-43da-8a06-3c417630854c", "comment": "Malware payload (Mirai)", "value": "0a514337ff595f39ca33d3615ba61bbe80ba22682620a0398eb7490f2aadf10c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618657, "uuid": "2072a287-8ea9-4b87-8209-e45b6a5d9945", "comment": "Malware payload (Mirai)", "value": "56b02ab7abda5242edc2cc5496f11f6a8f5d3b47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618657, "uuid": "9ee29cce-7780-4479-8de9-a0584953a27d", "comment": "Malware payload (Mirai)", "value": "fc7f316f3b5793e4d811fd4c0e0f89d83f1692f61590b869ef9654d7dc195d27c2a5fef9e1de22936a4c43f9ad796adf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618657, "uuid": "ab0d9268-6011-4f7f-867e-3eb0a9ba9138", "value": "T134B3E817FB61CEB7C85FCD730AAA4605108EA99756D46B6B73B4C96CE70694F08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618657, "uuid": "1ccdc05a-d290-4eea-84a0-dcf852dc7e77", "value": "3072:7rfMt6MUEproqT5hY1zVKdwwzF9GhsRiAe:3vMzproqT5hYNVKdwwzF9GhsRiAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618657, "uuid": "51637e40-8524-42ad-bdf3-75557bc78382", "value": 114719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618657, "uuid": "b8250a8d-3838-4e1a-91b7-f46d73f3b45c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618657, "uuid": "45c5501b-b43a-4cca-8ff0-9680cd3f4ebf", "value": "hidakibest.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fa46b1-458a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777659533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659533, "uuid": "a936698e-f5cc-433c-8db8-21bafec93d06", "comment": "Malware payload (Mirai)", "value": "4dbb8c55bdfb49a75a0d424b938fc15b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659533, "uuid": "8b8d2b07-6388-4e90-8fd9-10b4a4286e6d", "comment": "Malware payload (Mirai)", "value": "0b4614d6de69ea531924366a03f365fc6df87d6cc1808ac0d545dff0a7199732", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659533, "uuid": "a90b4801-c2a8-40c4-8a84-30ee7d38b3aa", "comment": "Malware payload (Mirai)", "value": "21b9c9736c661aa359fcb222bb2394015aad55fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659533, "uuid": "d93b2d18-67e3-4729-b2e2-7ba29333ee74", "comment": "Malware payload (Mirai)", "value": "771770fac99e77bed4edec1ac62e26d815d81cb946e5add067e6b7df1474fbfa5b3bd2c3a4858cb045494a5b32e917fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659533, "uuid": "8135770b-4a32-4b52-84b7-75c4150134d5", "value": "T1DED3C021E4006DD1EC2129F578BA96B80350EE740BDE1582EFFDE95E647BD94386D2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659533, "uuid": "df34276f-38c1-4bab-a79e-e2e569e3e8d6", "value": "3072:PHiBTNkAgcly+hoVpE6AKUjq+8biA7JBd/xB:PCdny+hovsmzbisJfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777659533, "uuid": "70eea508-7040-4bf5-92f4-b0a4f6e4ea67", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777659533, "uuid": "1ea83cde-4b91-4b39-8a89-150357c079e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659533, "uuid": "e172db4d-8441-4a12-9a79-9e4c7ca5f6b0", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0a8766-44f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777594476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594476, "uuid": "9cefa1fe-3792-42f1-a971-92f309bbd0bd", "comment": "Malware payload (Gafgyt)", "value": "dd189a30f8c25876f0493ad9488554da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594476, "uuid": "f3f370d8-3ca6-4b5d-91a6-7cd0d1a9857c", "comment": "Malware payload (Gafgyt)", "value": "0d1b3a22df47f8abe2906bd7baf4192487122cea92fb61094f5e684dfc4f4853", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594476, "uuid": "bc8f302d-5fba-4f31-b757-f5e692f422ae", "comment": "Malware payload (Gafgyt)", "value": "f984b5b019d78571a80344b9acb6197a3de0ddb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594476, "uuid": "cb944647-a113-455e-b57d-361a199e9d40", "comment": "Malware payload (Gafgyt)", "value": "4f07db1c1e66ec6cf8f46d0eecc8a89ea2e16f3b7651b01277966531de0fcf6c456f44ef774b6d9aa437e97a9f4cc6fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594476, "uuid": "566906ae-e7c9-4c00-8bbc-f302259e091e", "value": "T175C33917F9419F41C1D325BAFB8EA64933136FF8E3EA7102D9209F60278699B0E76941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594476, "uuid": "1a51eac3-0b54-4ab4-81f3-d8b8de6354ca", "value": "3072:uyR9yVznJoEsaMD56iNwaQFgei/oCkRXY5hTpZ3n:uyHyVzneEsaM96iNwa8ggCkRI5hv3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777594476, "uuid": "9157235d-6f60-4b1d-8d1d-6b7cecca744b", "value": 129968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777594476, "uuid": "551eac0a-8c25-4aba-b786-0009d934b84e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594476, "uuid": "949318f2-93b0-4e3e-a8e3-c72eb9ec6d82", "value": "FBI.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb3ac41-457a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777652996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652996, "uuid": "d30197e4-77b3-47a1-af41-38159b289585", "comment": "Malware payload (Mirai)", "value": "715e21431a089f11eaaa4921cabda45e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652996, "uuid": "2dff6f29-bd83-4113-8434-1d7955503339", "comment": "Malware payload (Mirai)", "value": "0d7df761f976ef40ad8d187c6d0c480e91e4b089f39640a1bb301c6009c63b2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652996, "uuid": "d0294853-1f3f-44fe-9b98-496955f522d7", "comment": "Malware payload (Mirai)", "value": "26a20c75b265f4e94c9afe4ea0b130f75c4f83a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652996, "uuid": "f6b2489e-920d-428f-895a-7504a215fb2d", "comment": "Malware payload (Mirai)", "value": "40cc6e77cf27fc30659d831f97a8c38e897f18fff414412e8f557924b145669f2dcbecf21add8109bc830b8df78e4892", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652996, "uuid": "47f2c182-1647-473c-a162-a676e2479aa0", "value": "T1F67302B24500AFED8B9881F668C902CD87F828F951FEE3963540453A7D8E82DEDDE413", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652996, "uuid": "12f06383-1276-43ac-8ddf-f3c252b53828", "value": "1536:wpOF3Qn/QzDDY3QIs66KBrWsEHmqRtHfIiWk+UgvDLk:gOqnIzDmQfKxWsBIGDbvDLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652996, "uuid": "51640816-b95b-4c2f-bf36-eaed95a5171c", "value": 78376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652996, "uuid": "80b40c60-760d-4fa2-bfcf-73e78989b3a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652996, "uuid": "dc1df89c-37ea-4233-ad4d-1e3c36c1510e", "value": "vaxbot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d21364-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777635964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635964, "uuid": "8812f3f4-077a-493c-a28c-a991d24bd5bd", "comment": "Malware payload (Mirai)", "value": "eaa573587f94bbf4af23159c0c3c1fac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635964, "uuid": "7f814068-b01c-403a-98d0-497ab02420a4", "comment": "Malware payload (Mirai)", "value": "0ed3477d45990d119a3dfcca82b3845fbca552353067c422d22756a1d78de8c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635964, "uuid": "96e123f5-5b45-478a-88c5-8931cf012ea3", "comment": "Malware payload (Mirai)", "value": "fb1e092bddcd98aa3780c5f23dcad44003d0d39d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635964, "uuid": "c820bc75-3a0e-48bb-b59e-a9ca110520da", "comment": "Malware payload (Mirai)", "value": "fa08dc4926abaf01bea6935517a00825ca87bd8884c0bf278b75913db320c4502849bbfa528196bc6b3ca5263bb4e29d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635964, "uuid": "b279e537-3680-4437-a53e-8aec9f51e07c", "value": "T165D308C7F900D9FAFC0AE7374853080AB230B7A545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635964, "uuid": "f878aa8f-4336-4ddd-8320-5d462b373e8c", "value": "3072:aSbul4MGHJvkrybLutTK/OwpiZdDoOPVO6V1jbiALNHFI9x:+rybytG/Oyi42VOgLNux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777635964, "uuid": "bef80bcd-0e72-4a2d-ba79-e7d7e0f25e5a", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777635964, "uuid": "cfa54c2c-7f53-4074-ae07-9b055dfe9437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635964, "uuid": "c2f65f40-3fd4-4a6a-818b-570a6c79bea3", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f818e84-454e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777633941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777633941, "uuid": "7fa2e4c7-6519-4f84-9a46-a3a46b5b5abc", "comment": "Malware payload", "value": "f1d8c9cd33b7da9356615a650cfd2d7e", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777633941, "uuid": "b2ba6696-736e-4980-9e9e-1516a7039777", "comment": "Malware payload", "value": "1047faa264cefc527c216a86a5f246f8fea3758371417aae0e51b05660338403", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777633941, "uuid": "1877d2fa-6105-4170-bec3-ac67bd9fa6a4", "comment": "Malware payload", "value": "6a2e52e6c6f6b58716c5199a973713c2dde47e03", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777633941, "uuid": "1c016f2e-34fe-4fcb-9b7e-eea7e1c3d34d", "comment": "Malware payload", "value": "3b9a9bcd3a49d8c7df340d187a52d1bcc30f65f2e20f41c4be95542d5bac2928f1a43900af2d304b212dea6f64f0a1e1", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777633941, "uuid": "5c7ee8bf-5d24-4edf-9f43-5ee92d63e417", "value": "T1978733137A97299CC824CC7C55CCCD885E50008F653AC43D6D59A7826F9A8EF7B2E29F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777633941, "uuid": "59df5eaf-5865-48c7-8359-eae0550b5b30", "value": "786432:VdBx0gyQCY/+lUU9gcHJ9E1mglXX9C2YuorftEw12WSx0x2hIKGT23Mk:V/x0MCYWNjM1m4XIftz1x2RGq3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777633941, "uuid": "bc2da1b8-9329-481d-b39f-dbcd46c6a441", "value": 36501561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777633941, "uuid": "33b01c20-8ad0-4462-b4b6-6691570df9d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777633941, "uuid": "cdbdf2b0-1d1f-404a-85d1-ed9ee1df1a12", "value": "public", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2754292c-4572-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1777649201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649201, "uuid": "3724e2a5-38cb-4223-9efd-c77072a6123f", "comment": "Malware payload (GCleaner)", "value": "b13cabb5d9cb6335cf7ab3d387acaaff", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649201, "uuid": "1f0a2ab8-09f9-4c63-a46c-d47dbd5485ba", "comment": "Malware payload (GCleaner)", "value": "10847ef36961204caf2bee7e2f1b902f7f94e16955a9df076b2c41e7728f3ca3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649201, "uuid": "573d47c6-e08e-4c5f-9a09-aba2f0389385", "comment": "Malware payload (GCleaner)", "value": "1e5843a277c698a8bfd62c9b290dfe7469841176", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649201, "uuid": "ba878365-ac2f-4f7a-979e-ddb193075e18", "comment": "Malware payload (GCleaner)", "value": "2b27ac3cc03afc082e2c155185d96150590ce373e3be3647b462dfadf43f424cc0a40b100c6c37c1af5a7892c648333d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649201, "uuid": "fff5cd98-243a-4bd6-a6e0-0bad72db3c6f", "value": "T1FDE48E23A1B14833D5725B7C9D1BA35C9C3A7E003D2C984A6FE41F485E3E69137AA2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649201, "uuid": "3665284a-e400-4ede-bfae-6eba7052833d", "value": "e772ed2994ba9b8b6608cbd1b812a317", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649201, "uuid": "df81a0d1-2272-4da6-a6c5-f326fd61f4d9", "value": "12288:ROnHL01TBcI0ODlRsl/ChyGpvuH5Z/79P3wNGWip197WM/H2nBJE39k:RgHQgI0ODlRsl/feuZ1N3AGWSvX39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777649201, "uuid": "16c40e11-a56a-409c-9bdd-7260b7907933", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777649201, "uuid": "c2732b20-0883-4c78-be16-22a65925ee56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649201, "uuid": "4154a596-935d-4bde-a541-d3e43264a3d6", "value": "2lapisunivnocom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb11ceb-4595-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777664514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664514, "uuid": "037591cc-4ff7-4f3d-90b4-150cb17c96d2", "comment": "Malware payload (Gafgyt)", "value": "66d2c4eb96d4d095b11cc10388e068b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664514, "uuid": "ed22f6f2-76ae-4ea8-8612-b1dd8681476a", "comment": "Malware payload (Gafgyt)", "value": "112477336bc947bcbd254f47282149140ea71eee82171dc73ad916298cf9c63e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664514, "uuid": "925d88bb-dae3-4642-b6eb-8e385033dbbd", "comment": "Malware payload (Gafgyt)", "value": "fa385f854fc347779253b898a6d27b4e7cece054", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664514, "uuid": "92f22acb-07c4-4fdf-beb3-3d139a90927c", "comment": "Malware payload (Gafgyt)", "value": "b05edc765757ccf64efb9265a4b5bebe7fe53e31bc2f1be3837048c3376b0db37bdda873f2e7aac1aa1b2d576abd9b5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664514, "uuid": "c9b9ec9f-cbbe-4457-b349-1940e9f19682", "value": "T1DBD2E0474594E6E8D97FE03A1C1FB2061918BB1C428267176F8DF23B79A1F7A7B13211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664514, "uuid": "b0fd092d-a1b6-4c91-ac9e-708f6489bf88", "value": "768:QnOmBii8NtYhx/f8mc6t6TxAw/TlnbcuyD7UryqS:QnOAqtC/FRWAMnouy8mqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777664514, "uuid": "2cb08240-c994-4751-be43-056dab1bb741", "value": 28372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777664514, "uuid": "7c4e81b3-4f7a-4d74-98f4-dcb720bb13d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664514, "uuid": "19bdc7d2-a61c-47e6-a46a-0d987dc22cb9", "value": "I6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a97ef9-44fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777597811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597811, "uuid": "9c953ca0-fc12-47fd-b719-953be3f23a8b", "comment": "Malware payload", "value": "70b3e9567a6961295672e1bc8e363edf", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597811, "uuid": "905d82fc-406d-41d4-b0d1-355b89224038", "comment": "Malware payload", "value": "121c9cdbb081b8023746dd7d3b6c56f1d3c22b717eef971e919deb738ef0a3ef", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597811, "uuid": "9169f306-86c3-4c49-9fcb-ef5d7070959a", "comment": "Malware payload", "value": "eba7e240dd538c9e7ed23277eee800a790585308", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597811, "uuid": "a1108ee7-4d3c-4ac1-905c-05a0e01baa6e", "comment": "Malware payload", "value": "baf379efca055273b62a32e749d43e411163aaf8933ad933fc4d20a9417eb125e1bf1cd65de8a2580ee3d3287cb5737e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777597811, "uuid": "f4c6a199-7b60-4b32-8da8-e1c1c52ebf18", "value": "T1887141973E911D69D85588A0C5BFD66667E0F04F91417EF0E2C921E1F8212CA17B3CEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777597811, "uuid": "4ccf93d1-ca5a-4e13-a255-57686a635653", "value": "96:2Q+WG/nB9DCXDpX4IAKqwaVaDofLnFMyQkfKPHPnPNevf1/749l93DVDKk9:2PWG/nB9DCTpoIAKqwaVaDojTQkivflj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777597811, "uuid": "90200b5e-e634-4b80-83c5-9a91e8e08412", "value": 3558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777597811, "uuid": "831e9700-d3c5-4942-bd8a-6faf7462003f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777597811, "uuid": "445666fe-7149-4304-bff2-59e45e1174c5", "value": "DESTROYER2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ca8c56-4529-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777617825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617825, "uuid": "75fbd1e7-1e3a-401b-93df-04b80bed8bb3", "comment": "Malware payload (Mirai)", "value": "f28649e4054757186f9890faa5256328", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617825, "uuid": "2cb6579b-22bd-4592-807d-cccf54f3ffc9", "comment": "Malware payload (Mirai)", "value": "1532b9a36fafec051270fe64a23b267f58d5a2d17f7c32600b666608511feefb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617825, "uuid": "696763f2-b750-4e8e-997f-e6735e88255b", "comment": "Malware payload (Mirai)", "value": "9971c72cfa16e64f93d03ae3ace7270042c553b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617825, "uuid": "dbac1a48-f96d-4a5e-9fa4-c00a529c0f79", "comment": "Malware payload (Mirai)", "value": "6bb413b2b4887ee9fd9b0e034de28884a1d4a520b835feaee17b33d43226bb1b7486ed8b7c36dfab9da852e4ad5b7915", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617825, "uuid": "65e24847-4931-4fd0-b976-7f653145d30d", "value": "T19363184AF9806B11D8D621BEFF4E024973534B6CE3FE7211AE245B2423C7A6B0F76406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617825, "uuid": "5e48e98f-7530-4711-a163-97e30d6fafc8", "value": "1536:RFn+BItvzfmaH0s6/mi6WJlbLiqmkXqC9/XZ/Y62:KBSrfmaH0s6CGmkXqC9/XNZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617825, "uuid": "74b4eb00-a528-4118-ab44-b754afbd2eb9", "value": 68400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617825, "uuid": "a568633d-e41f-4b27-a700-918ececf1e67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617825, "uuid": "ec049699-d13b-4506-8024-b2b4c2f801a5", "value": "rage.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f50104-4549-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777631938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631938, "uuid": "eed64a60-7d89-42f9-857d-6a838104552a", "comment": "Malware payload (Phorpiex)", "value": "d4a8611ef4f1a235fba267c352ae23c3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631938, "uuid": "709df525-1b53-40c0-9f61-11074624c97f", "comment": "Malware payload (Phorpiex)", "value": "171e378b1142003caeb42e376b79d7c6a07841ab7354e84cce53d7dd28bcea1c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631938, "uuid": "9b1a832d-cdde-4181-b3f2-9d95adaa6980", "comment": "Malware payload (Phorpiex)", "value": "30e603356778b8a8cd6951eda15176a087745166", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631938, "uuid": "725145b0-d08f-4acb-8526-5080e86db267", "comment": "Malware payload (Phorpiex)", "value": "e166213dc2642672eead51a5eb85bc1de0e4e464afda2acd061a556752b7fe0ff989fd358f020c53dc6d11aef2535b7c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631938, "uuid": "24690ca1-46ce-49da-a634-c10e11d57827", "value": "T157823B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631938, "uuid": "9037ea7c-2247-4a80-b662-13aac1b611b3", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631938, "uuid": "b3654780-4280-49b3-b14b-2d582c64abf9", "value": "384:pI78VGQic1Kwzw077u9NHu/gBhav8U9cs:yAo0769Zha0U/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777631938, "uuid": "93cafc5f-bb55-4ee5-9028-8cfe94356d8a", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777631938, "uuid": "33066bbd-3dcb-4a6c-80a8-72ef42582895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631938, "uuid": "81977b05-0d74-4da3-bee6-00c7f3b8eef5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5171fb4a-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777635957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635957, "uuid": "6fb269aa-add8-4b6a-b031-71c07ce958dd", "comment": "Malware payload (Mirai)", "value": "ccc9072dfc17247df6047a6ceb39c7fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635957, "uuid": "43fb6c80-0810-4548-8c36-2e25b99fb2bd", "comment": "Malware payload (Mirai)", "value": "1728882748391ea49a8754360475cd70dbbef993f0910abab330d239fb702c4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635957, "uuid": "c9e7a122-68e9-40c0-a737-01e551f37f4d", "comment": "Malware payload (Mirai)", "value": "cf29e346c00a860b35a7a3a0decc703f343e8efd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635957, "uuid": "c465ff7c-4f62-4215-b9f5-5d1595cc6daf", "comment": "Malware payload (Mirai)", "value": "0ab5818d6b61836c5360af13ff20b4ba6a197a3b2df87e9eeb76193a76fd900bb630557f711464af6ec211150674f05e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635957, "uuid": "009f9e03-503f-46d1-a657-f45e8a3fa9ee", "value": "T1E8C39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635957, "uuid": "8f31be3e-bfc1-4b57-bc59-3e6af1c11ff6", "value": "3072:2f0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4dqe:2f0tJBR4NSALD7rnCrheiOqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777635957, "uuid": "fa57d9ef-98fb-4efa-b185-b51cf22f1974", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777635957, "uuid": "9dd3a311-e2b8-4aba-ba3f-ff29d423889d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635957, "uuid": "99edc0b3-baa9-40cd-85f4-a76882479eda", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d646eb51-4595-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777664527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664527, "uuid": "9e91ee84-3eef-4828-b3bf-10c39f1e8149", "comment": "Malware payload (Gafgyt)", "value": "68e023ef274388186e6ed4b1ea7bada3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664527, "uuid": "ade4340f-d2c9-4b42-8003-1bbe79295bff", "comment": "Malware payload (Gafgyt)", "value": "177c820e390451ef4119879af77cbaf780f0434b9f5602b8cc585d092a6456a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664527, "uuid": "c68b63a9-9f31-4292-b5bf-02b0ca33ec44", "comment": "Malware payload (Gafgyt)", "value": "a650e1bb2804d515b0fae8f84277c60780b1719f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664527, "uuid": "766cafd9-2f24-48a4-a418-fd69e6b7ebc9", "comment": "Malware payload (Gafgyt)", "value": "eee29d50881cedce771b78b61558710e3ba7d1c00a87476a245705093d3949e3b52b520c45b36898ae36dad1d2b13cb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664527, "uuid": "93fbbec3-8790-4e18-9dc2-d229717ed539", "value": "T1B4C2E1B1EA6824E7C5B10837FAFD0B4623067258EDC930BB51645778EEC50C995FBD84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664527, "uuid": "3e9355a4-1f6c-4740-a27e-655001717c80", "value": "768:s4+qcw8FSTjpGY/10eIvQzPyHnIvyW3UB:s4WFSTj4lQzPenI6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777664527, "uuid": "bed18810-8cf6-4861-8cd2-fb8c8ad62a9b", "value": 27480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777664527, "uuid": "78bc3f32-f1d3-48a6-b373-d939bc8fa5bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664527, "uuid": "c32056ad-128e-47c2-a930-f96cde2a9ab1", "value": "AV5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35eaa22-458f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777661864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661864, "uuid": "f71b5229-23f1-4914-b9c6-d5659b3cee7d", "comment": "Malware payload (Mirai)", "value": "28522decaaad8fd46e2c3e500494650f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661864, "uuid": "bf5976a9-7980-4e7f-afe8-8e359c6d3952", "comment": "Malware payload (Mirai)", "value": "17f1eb824112ed6109d15f25c84446dce1f1d09d2be8d76291f93bca159fd9fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661864, "uuid": "0f349e84-d768-4e44-93dc-9a7f381e8ac6", "comment": "Malware payload (Mirai)", "value": "fe2b682d02632c54049acde80b298ad20a419d68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661864, "uuid": "7e560c41-23a2-467b-a11f-66615e3af404", "comment": "Malware payload (Mirai)", "value": "065f4a3dcdbb83d81ffb27234ba64e088ed92172e815bcb30ada96b5895340253f2a6ecd00cf83eb553b533c4c53207d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661864, "uuid": "f0c167f9-9017-4d8a-88e0-93bbd2994e97", "value": "T169148E68FE8E78D2D2C7E37DAD4A0FA230277D749565C0B11A00A29FD5EAFD489D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661864, "uuid": "461532d1-3ea8-4eb0-8077-9cba3ee869da", "value": "1536:OYtdyYq3BANtiz4UoUWHyeCFbjKEdAStt8YTpQURvqL4dqiofCsHNNjzPx+P7db8:/yt4wz4UJP8EdAxYC4qfiofCeNRzPxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777661864, "uuid": "e9a97428-a9d8-4625-92b7-647599f07c26", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777661864, "uuid": "86a9e18b-9c4d-4e66-93b4-51be5fd3fe68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661864, "uuid": "95465c4d-3c97-4b16-9c68-312dcaf4913b", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3624d442-4584-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777656957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656957, "uuid": "a15318bd-f304-4675-8909-67e88f84623c", "comment": "Malware payload (Mirai)", "value": "b5059795475e1d5a5688ecd43e67dc8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656957, "uuid": "b1ec9b09-407d-4f19-bbde-8636a412a8ac", "comment": "Malware payload (Mirai)", "value": "18779dddf30166832ef4a5fa5ec472adc828557457e1c168006916588f6fc98e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656957, "uuid": "5053a966-d766-419b-a06b-db56778b6017", "comment": "Malware payload (Mirai)", "value": "63bcc4cfdd48c1b1a02918ff109d023ae2f4c064", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656957, "uuid": "58bcccd6-31a8-4db3-ab2a-4819e69b752a", "comment": "Malware payload (Mirai)", "value": "a84c1787cbef895a09f3d4352680a043abf857e1ac565498c69ad88342cef27701650a6572c2be7bbc54139aec3398bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656957, "uuid": "dd7d3744-2549-45a1-8ee0-4a0dad1b6e63", "value": "T12BC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656957, "uuid": "961262b1-05cc-4580-8dc9-4d4e5deaa653", "value": "3072:36tJsoRNjmj1VGCLUZMIV9Sr+QVrxZNio6w:VoRNjmj1VGc3rRioN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777656957, "uuid": "ebdc02c7-13e6-4579-abc4-82bc30644e01", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777656957, "uuid": "3ff9b1de-dbcc-40e4-a3be-91a45f7b58a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656957, "uuid": "d2dfe64f-63e0-467b-84be-28f5d75ce541", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ccf4ad-4595-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777664521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664521, "uuid": "e9f60269-6746-4ce2-bc60-9ed76fd6bba7", "comment": "Malware payload (Gafgyt)", "value": "678b435ca23622b962685b471ad37105", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664521, "uuid": "ecdc39af-9e87-4edd-98e1-3b3d7465766c", "comment": "Malware payload (Gafgyt)", "value": "1a77cc4339949d0b53836d7e10a7f189012e5195551d74d27793c0d53a9d92c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664521, "uuid": "0ad7b98d-f8d9-432b-b2d0-7b38b38b3675", "comment": "Malware payload (Gafgyt)", "value": "7f133791f2e4d14a8ccc67e6413d2b1bd720a59e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664521, "uuid": "a3a937af-e0bb-480b-8b57-683c41db3aab", "comment": "Malware payload (Gafgyt)", "value": "c57a3aaa767559121d2162977e5e6238868ab97a951fa755b52b6ffbda4f51d48b8d4ebc66c0f6506b7b856ae1f029d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664521, "uuid": "8eb5ca65-8d28-415d-a58b-c4abaaf8fd9c", "value": "T1C573B73B7B130E23C1C6107152E30172B9B9DF5938B88797A8E07DAD5F3998835526EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664521, "uuid": "c067510b-fc8b-49ce-b104-0005fa42f013", "value": "1536:1sMPeJ8jvstw/A1a8XsN95hru3xtLsWf9:1s598usNPcY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777664521, "uuid": "499f9ebc-c5e8-4149-bb64-a1265abe3a21", "value": 77880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777664521, "uuid": "16005214-21eb-414d-970e-1acaf3e710d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664521, "uuid": "d2edbe28-ff47-41fe-887f-0f638683f24f", "value": "SC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583ff0e0-4501-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777600750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600750, "uuid": "aff72d47-4fcb-4594-9f10-64d8eea7cb9c", "comment": "Malware payload", "value": "41f10b1773d9324211d90e075911e6ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600750, "uuid": "3e02b965-9225-48e7-8973-918cfd33b479", "comment": "Malware payload", "value": "1aebaed9313ffd9e172616436d4365f68e0ecda87d63f107f2e995c79098c98d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600750, "uuid": "a92b6a3e-a77b-4954-9ab9-57c9d47809e0", "comment": "Malware payload", "value": "186cc8ccd8412d6bf8fefdfd6f8e6bf6c8854f03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600750, "uuid": "8c8b1042-6839-46c7-a838-6cf0a07773e0", "comment": "Malware payload", "value": "6226a63bad9a3bcc416cc9680a9d55318748017d953f8d399229ba9b0df608925f8e7180eee6dafe230bb1b68660922a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600750, "uuid": "05da66eb-ba75-4863-9bbb-a4381c1584f4", "value": "T1DBC1B4879798476AF062033178B317522778E8114B7FAB9F29F4137A7EBA78048433B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600750, "uuid": "02dcd04d-d8f3-4037-bed5-dd8e3f62023b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600750, "uuid": "e5b61099-f0a3-4c5e-9184-69ebd82144c5", "value": "96:Udew7V9rSbZRg8zZgyTy12A8BynqgHlNxHES7umtKbOzNt:Uvv2tzuyTy5oyqgHjqS7Uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777600750, "uuid": "26799c5f-909e-4af9-ad23-56b7863ab168", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777600750, "uuid": "d5449746-31a1-42c3-adde-eadddfaaff92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600750, "uuid": "e84e89dc-3f8f-4c37-acc4-884c6b653b51", "value": "program2(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b508f54f-453b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777625816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777625816, "uuid": "98c39928-43a9-4cee-984c-361eb9740033", "comment": "Malware payload", "value": "da0a86f5835192740fb2466b23372e67", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777625816, "uuid": "fdb9fa52-9ae4-4395-849a-3991d7d3cbb9", "comment": "Malware payload", "value": "1bd64a69dae0713b918308ed954708495633840384b58e03078721b41566eb43", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777625816, "uuid": "492d096e-95c1-4d83-b359-7fb6c4392581", "comment": "Malware payload", "value": "61cd7d1648ab174f33f16c011499e4cda2e1de0d", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777625816, "uuid": "3b6e7bb2-99b9-4080-8952-bb264abb729e", "comment": "Malware payload", "value": "d453f7d7cdfe3b4ac4af146a9930ac8a23db2a333f7aff5739732ead4a32c238e47cd97527295b8fc3db941c241ab0d2", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777625816, "uuid": "5bf95e14-956e-4eef-8307-f82c9f5e847b", "value": "T1449733F8C9F0C5AFE86B577BE2B1AA54A1D2D877FF020419D4205BEB4442FC866BD049", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777625816, "uuid": "7be8a90b-b92b-4095-8510-548141b4f5b5", "value": "786432:/bdcUjJX1WGqbLqQs+gL+pgepWLtYqiza5wxcW9R+xG9xeAiMr8ivtENPbpgEA6X:/OMx1UGQsIooee3I4e9k8ivtEN+V69J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777625816, "uuid": "4045fffc-9179-45d6-b4df-00c932081bdf", "value": 41728036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777625816, "uuid": "905d3e39-1c8e-44f3-92ec-993f0198dddd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777625816, "uuid": "665289fe-bea2-4ea4-9e22-cf1c5d82c0e9", "value": "HWID Spoofer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd544d5-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777635951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635951, "uuid": "5d69bfd1-d22a-4b0f-b3dc-87584a85079b", "comment": "Malware payload (Mirai)", "value": "3dd41edc1b58bc15bc871c2cf5a84a96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635951, "uuid": "ef965d97-a137-4b83-aae6-11963258398b", "comment": "Malware payload (Mirai)", "value": "1c17159fa0268c9b377cefcb126562fe53f846e1de129d68037de80d828a4423", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635951, "uuid": "e8ffabaa-773f-4256-be10-b26be4367753", "comment": "Malware payload (Mirai)", "value": "35b7bae7b6357a172edcd2b9a9b6c7be30155fb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635951, "uuid": "cd281a22-3e24-459f-b804-6a7487bd3f9a", "comment": "Malware payload (Mirai)", "value": "dcb4a2c80dbc53d5bd5297fd039a5c30c3734733e5a632f8434c53b887abb095ced34d7bfc0aecb12bafc40b9f4aae8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635951, "uuid": "4aba6e07-4da2-461b-bdfe-2c02a45daefc", "value": "T179B30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635951, "uuid": "5bbebd35-eb37-4088-b845-df1ff42ef854", "value": "1536:37jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxK:LzPqF41OUBljSIxecUtCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777635951, "uuid": "b13f8f61-2ea0-4271-aff1-5cb561e0d27d", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777635951, "uuid": "8c147c6f-baf1-474c-8add-8c6ccf19c302", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635951, "uuid": "314db5f7-1f92-4e9c-89e9-5c48d08cdaf7", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fceb007d-457a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777652995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652995, "uuid": "0f693af9-4b55-476d-b527-88464321bbf7", "comment": "Malware payload (Mirai)", "value": "7cca82cbbb9e0969ab6695b4e19aeb18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652995, "uuid": "b5e06e78-bf50-4a54-882b-2707b887c6ac", "comment": "Malware payload (Mirai)", "value": "1cb5952f52617bd3e028d911292f0a9d0656c5692ed5874a4c8badb396ce5c5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652995, "uuid": "d67ba2e1-0985-49f3-9c84-6718afa0fef3", "comment": "Malware payload (Mirai)", "value": "750973a37ed06f58f654d517113d98989ca21865", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652995, "uuid": "55352dae-cd92-4752-ae3b-218eaeaeab91", "comment": "Malware payload (Mirai)", "value": "0c817c38c92770630d8855cf3a62e1b04332a2468c1cf8940ca57defb2ea4553e85a84f43bcb6728ac4d045133e3c489", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652995, "uuid": "e57460f7-7601-4987-b663-64bcc82c196f", "value": "T17E630234F3C22DF5DBDF4FB04DEDCEC12A62458A66B28650B895826754D3A21F39C9C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652995, "uuid": "cbbdca32-9de4-41a1-9e33-c4e86bcbfe2b", "value": "1536:RaCYU/Myh5hP+ArgYjmnfFeH2RWrE+qv5fNRBTmO4u+qgw09w:DN0yHhP+z+goWRWQ7v5Th4u+qgw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652995, "uuid": "669413bd-e53c-46de-988e-28e37f51c278", "value": 72388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652995, "uuid": "67fa9472-9417-4719-ab87-dd6748b9f419", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652995, "uuid": "abcc234b-a61b-4d85-bb34-24fc8daf82e0", "value": "vaxbot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20122d6b-4512-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777607957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777607957, "uuid": "f4718f76-eaac-44a0-ba5d-07c791129df3", "comment": "Malware payload (AsyncRAT)", "value": "c390e3b0ad9b947eba153aafd85afccb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777607957, "uuid": "455362f2-19a8-44df-be3a-aa3a2eeb2c33", "comment": "Malware payload (AsyncRAT)", "value": "1cc98ff5e33c3eb7195ba60846afc7c7d7005cbab3df3488279e6e3c657673c4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777607957, "uuid": "f64af4a1-2d80-400c-baf6-c3a2e075e81d", "comment": "Malware payload (AsyncRAT)", "value": "339015e8fcbd9800561cf5e23bf139f4bd43e136", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777607957, "uuid": "8e715a88-435f-41db-9164-85780a5e756b", "comment": "Malware payload (AsyncRAT)", "value": "e8446a3e5eb05a052d1dd08fc481061e0a4d52cc5052c561f8c9116cacc3002916a1cde988831e20ac047a3bc138c021", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777607957, "uuid": "a39cb51e-e1b7-46a4-9559-8b53ba416010", "value": "T122537C0DBBF24125E1FF9FB518F12262CB35E6271D138B5F24C4019A2B17A8D8E916F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777607957, "uuid": "50399cae-f80f-4ef0-a29f-dc6443623d1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777607957, "uuid": "998c5314-b07e-4feb-8c2d-dac055918aa8", "value": "1536:pxQZCT8uDB4wWCVxPTNNc0M9lkbIX+CPU5FGSOC9L:pxQg5DeQNRM9lkbIXNPmOCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777607957, "uuid": "1af3df88-7957-478c-a536-dfbbf44242e1", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777607957, "uuid": "29a5cf4e-bf38-41e2-a144-758fc928405f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777607957, "uuid": "e6ba992f-2bb8-4445-8ece-2f6ce07dbe87", "value": "program2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cd6bc1-4503-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777601826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777601826, "uuid": "277bbf2c-9a05-498c-8f83-0426b66fc62a", "comment": "Malware payload", "value": "ee86bc5864068c78808bd6edf09c0399", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777601826, "uuid": "f8ade461-391e-4603-a151-0d3186cf97a9", "comment": "Malware payload", "value": "1dc4fe76cb896c6230b366712003ae0deee2cc46432d1938723a9c557d566ed5", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777601826, "uuid": "7bd01610-f8ce-4887-a034-73ed181a8a2e", "comment": "Malware payload", "value": "28288fb286293724ec1f55253e094bce31345469", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777601826, "uuid": "f6246f4f-1ac3-4ec7-b19b-822e33e2c8d3", "comment": "Malware payload", "value": "2eb82cca68136df26c774e05218e8f37e05b8d5ef7be11b808c1be2354f8c8c2b70ae360cd4b7d1646a50997734c291d", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777601826, "uuid": "7d0f74c9-e66d-4f07-917d-e81354fecd00", "value": "T15994E134AAFA502AF1B39F54AEF42596A96FFB233A0E545C1081034A0733945EDE573F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777601826, "uuid": "ea648624-32ee-492e-ae0a-d7be63d2ba96", "value": "12288:3e7apDK5Myn/0B8/fPopTWDSyYcbi3j/5G4AhrHttguM:RAzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777601826, "uuid": "45ddb5d7-eeec-4f56-81b1-eb8bae93f071", "value": 431536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777601826, "uuid": "5e201112-3e43-4e66-83d9-451d1fa508da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777601826, "uuid": "2f23abb4-3699-4f1c-8c56-47c3e20b18ed", "value": "INV PO4510192681.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8718f3-4528-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777617452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617452, "uuid": "da1d1ff7-d10e-4adf-a211-79b479ca5773", "comment": "Malware payload (Mirai)", "value": "8903645f72d43356b77304ac4ab2a225", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617452, "uuid": "65c9f2fe-ad19-455d-b37b-69c838163dff", "comment": "Malware payload (Mirai)", "value": "1dca929006d2967232169d29d48bf3645d604823fb128af43836d0986f94e5d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617452, "uuid": "63b0b88f-86b8-4e28-a96c-c34f8e4b66cd", "comment": "Malware payload (Mirai)", "value": "f51290f94b4578556d2851246ed9d8fd91c7ee46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617452, "uuid": "7a73abd8-2f71-4361-8688-48f0d650545f", "comment": "Malware payload (Mirai)", "value": "94565aba4e48d3660e10153cd0c4fcdf8874588d16eb7216445015bbe9910a57f3c7e267167c4bbe254973257dfbb9b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617452, "uuid": "e98784e3-afe4-4f31-b453-44ef02dd4b5c", "value": "T12953E946B9829E11C5C8077BFE1E118D33137798E3DE7222DE116F11BBCA56B0A7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617452, "uuid": "5e82e2f8-fa4f-419b-9ed4-4615de343b0e", "value": "1536:wRnv4wzuC+eysWYG6fRBscC6mbBrqrrYmPOIRiM/3qFsIwbZnE:84GuDeyJY/Tscsrs/3qFsIwbZnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617452, "uuid": "9ea133e5-f1fb-4260-b907-1d8f8f1d4757", "value": 62640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617452, "uuid": "1d03849a-9e07-464c-a02e-7174ff70cf33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617452, "uuid": "6fb35f62-23ac-412c-b4a0-0d18419259a6", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82c7ac9-45b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777679992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679992, "uuid": "83aa5c26-f32a-4c86-afa1-44b9952a47c6", "comment": "Malware payload (Mirai)", "value": "0eacf121b9481fad13f81b2b348bd896", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679992, "uuid": "3c2cd26b-ba68-4910-97ca-c0f0d4070010", "comment": "Malware payload (Mirai)", "value": "1f05101f387df8f5a4702f16b12787f853941f239d4065a656a06af8db921710", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679992, "uuid": "cfe2b03c-522a-4e84-b506-b722f74d883d", "comment": "Malware payload (Mirai)", "value": "003b3eb3049f7687b7557416eacde261164c1745", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679992, "uuid": "5df5ac88-4891-4f8a-ae3f-e07195d4eded", "comment": "Malware payload (Mirai)", "value": "778c661ea83546ca6e8e0743e07ac6ecff47fc66f884a7350c6c70fd9167fd8f6e977fc182930fe485aa8fd7fc9b39eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679992, "uuid": "406986dd-ba7a-4939-a41e-da1a4c933172", "value": "T14D947D98E90F7E02D2C7F2FCED4A8BA27027B9F8D56190F27E03025DC5A59E5D5E2424", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679992, "uuid": "01d515f2-c304-4d0b-b988-c5d1a989affe", "value": "6144:i9xrEs3OZPaFcE6HIT1xZMLasyTmYrpSxCGkUwR1mUq0LHKURx+:U5Ese6woT6LaflMenXv1RE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777679992, "uuid": "e0d2421d-4597-4823-8db3-1ef185800d43", "value": 429728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777679992, "uuid": "f1d0e74a-9141-4eec-9d57-1edcee5c418b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679992, "uuid": "c5758b67-65d2-4e51-884c-892fbcc44e3e", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf84de3-4595-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777664513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664513, "uuid": "8b673da5-284a-482a-9233-156e1f354eeb", "comment": "Malware payload (Mirai)", "value": "1a43ed40f85848e0d34835745dafb8a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664513, "uuid": "bdc54582-ca0b-4c9b-aa38-378929ca62d0", "comment": "Malware payload (Mirai)", "value": "1f9a7eabc027995907576bf213333f72c527337389de23eb898ad976bb6e39e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664513, "uuid": "f035c646-3d54-431f-9516-20efc5944d2f", "comment": "Malware payload (Mirai)", "value": "fb8dfcbb35e714f89007530303807f9c0590b29e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664513, "uuid": "b78fc260-776e-432a-9cc8-346366eec957", "comment": "Malware payload (Mirai)", "value": "3f01885448ce059d524733d5a492cf4aea2e3a1b5c0a164fb98e517b9c5866cd15363b93d6397594309f7d7f1f7f9cb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664513, "uuid": "c6d6076f-40ed-4bf2-8ac9-921099318973", "value": "T18D03E196E184D8F1C6F05C7BA8EB4B803359E6BC90ED22145798DF0CA4D33698B5E2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664513, "uuid": "fa31a0a5-d944-431e-9ecc-68e0c0490be0", "value": "768:HjbU9OWK/0Y1a5ZlRb/gCBcx+bwWRHesqLvkKCq3U7t:H6Obs5PRbJUwwuQv+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777664513, "uuid": "2c3a4102-d612-4528-a473-6ccbbbce0368", "value": 38712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777664513, "uuid": "35e21673-6d70-46fa-b42b-6994b13dcfcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664513, "uuid": "847226fe-f7a4-4ef5-8bd2-c3298abdd013", "value": "AV7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c0bf2c-4561-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777641927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641927, "uuid": "ffcf69eb-3eb6-48b9-9707-75367c47e051", "comment": "Malware payload (RemcosRAT)", "value": "0b24c6e63d13c3f5e577cd7ae1286c8a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641927, "uuid": "afe4f8ce-9682-4ce1-80cb-0dbbc6a6f810", "comment": "Malware payload (RemcosRAT)", "value": "2083f8f020e70d6cbc297d65953333d181dd251a0bc5ce1a49b4f018a3e26fde", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641927, "uuid": "3a1459a4-ea74-4af0-8f32-2c7f78156cad", "comment": "Malware payload (RemcosRAT)", "value": "6f128a46caab6ff79762de5e42c776562fb33e5c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641927, "uuid": "039fde97-69a6-4e3f-afe9-39079c56b6be", "comment": "Malware payload (RemcosRAT)", "value": "d82c4ba42112fd5c07e5b94e06b71c31cd2fe20a7a106150f1f5f32281c45d63f898632fd768d48af30deaacf0734df5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641927, "uuid": "134b37a3-b170-4097-9831-84ffd0201afd", "value": "T1B3A4AF02B6C2C0B2E57E18340425D775CEFCBD21187D9D7BA3EA1D6BFD70140A639AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641927, "uuid": "d37bdf7c-77df-487e-8fa5-afb23906f949", "value": "36a8f09a2ba830fc08b8b6bba7c9d4c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641927, "uuid": "c39a0a42-52ad-433d-be6e-4b842abbf13a", "value": "12288:uLFP5PZRGDW1pSvKe4jeosl65Vj1sPZPU:KpZRJ1pyK+l6TjMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777641927, "uuid": "c9beb4bc-8764-4356-ba21-76d984ca6df6", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777641927, "uuid": "a4219b38-a0b9-47b5-ae2d-45c3c6bca685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641927, "uuid": "c98ab99d-82c1-4f43-80ad-d5f94359bf89", "value": "2083f8f020e70d6cbc297d65953333d181dd251a0bc5c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2d5a71-4528-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777617453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617453, "uuid": "d5cc0f30-f40b-453b-86b1-422473649dfe", "comment": "Malware payload (Mirai)", "value": "970d52cbcb83cacfae8b5243e523f101", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617453, "uuid": "633ca03f-e0a5-4edf-ac74-844a0ce04431", "comment": "Malware payload (Mirai)", "value": "211a611a9f7dbec831947c76d20354243d253bacf50a63b9d6816ae82f8ced01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617453, "uuid": "923461fa-8346-40d1-80ae-6427d4f1d6ee", "comment": "Malware payload (Mirai)", "value": "b47e8ab73b4426f02040afdbbd0544276a3ec4ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617453, "uuid": "463cc530-11ac-444e-a4d7-405edb36b7ec", "comment": "Malware payload (Mirai)", "value": "db474b68ae53bd96582466196b6d7de352bcbabaf43bbe8b73219f14aa82758d61c02ae8b3c9f6d3fea27c1b8337d461", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617453, "uuid": "648d6323-d57a-49ff-9990-2440e0a75fa1", "value": "T1CF2302705E88B698C1F068BAEBE9428F37C6576471AAFB1F1710C8F6E5C605B0739203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617453, "uuid": "7e4de291-14ce-4a87-88b2-0d0d5e1cdc94", "value": "768:MkzF3+UawGPRDzFpqDl6imDR34XihQ69R49oeXQwvUd5FN7R/r3Ufxp:M+jA7qB6Ll3N/9IvuFN7R0xp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617453, "uuid": "699932c6-ea43-46fa-8982-ea919e29916d", "value": 48996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617453, "uuid": "253425eb-0f5c-41d3-836d-84317380d123", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617453, "uuid": "5c119f84-84e1-42c1-83f1-0ba031bfc4be", "value": "rage.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3cdd92-4523-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777615492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777615492, "uuid": "f7058af2-a989-4c1f-93e8-31692e5db418", "comment": "Malware payload", "value": "b401aa2d2026c48bd3f7bcaf993aad92", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777615492, "uuid": "1315a467-f84d-4a08-8e78-591307becac2", "comment": "Malware payload", "value": "21fb8a29a6808997d040b563da3126056a853c978d8e6514ecb4d42fa81fbee6", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777615492, "uuid": "386c6d40-ddbf-4d7b-be27-a3733e0bad1e", "comment": "Malware payload", "value": "972e898d42357b71586ed75d25073b4923740639", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777615492, "uuid": "2714a59b-b785-4f54-8986-040cf8393f72", "comment": "Malware payload", "value": "a1fb975359aa9a09c70d6a620d24393fe236467b7889f6bd0cba826bd665810e95a94c498e20d17e4860e1337d4200ce", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777615492, "uuid": "3dced589-0556-4f37-b445-41528dade151", "value": "T1E9165A31624AC52FD9A289F1196C9A9F506CAB710F7254C7B3EC2D7E0BB85C20736E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777615492, "uuid": "2d7c5713-2187-44f6-a63a-960d87d41ccf", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777615492, "uuid": "932b9ebf-d9d9-434e-9c94-c6c5670a635a", "value": "49152:zWbbWb9tjju4k9y6lHao8JhBJyRjYQcUBiUARPU8Gbr2Y5l5ML9PAELcpB2MpF8p:zr99u4kc8Hao8eRjYBU4UAir2Y58L9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777615492, "uuid": "67130d7f-07ac-43ae-868c-07833f23d716", "value": 4209664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777615492, "uuid": "81473093-1c5f-4a4b-a045-3e6413ec42d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777615492, "uuid": "47c3ec4b-50ff-4cad-ab99-63f443a45dd7", "value": "MW2Old .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e97c1f-452a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618468, "uuid": "c141ab07-8aef-48ee-9f75-40095a958b7b", "comment": "Malware payload (Mirai)", "value": "615a9c5aa4be29b9ad9972a9751fda9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618468, "uuid": "9640319d-6ee3-4a88-8248-22e2b37a423a", "comment": "Malware payload (Mirai)", "value": "22e823044b9fc470a9a83aefc0f92e6bdb9906308346ff26a247f50bec6a174e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618468, "uuid": "152afa96-fea7-412c-b575-77222ef46a6a", "comment": "Malware payload (Mirai)", "value": "a1dd0c75918776214577d8f93f25994e1b748a3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618468, "uuid": "268269bf-6646-40ca-b313-7b00b5dcf596", "comment": "Malware payload (Mirai)", "value": "ae78be15f06e7290ce9670af4e8e9778c183be3730982f4311e41ec22dc831df094c038816bd32823144a56d478c9e62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618468, "uuid": "a8a4024b-8232-4001-a47a-2ce412c4a1fb", "value": "T116933963CD266F19D629D6B4B0B18F792BA39A10924B0FBE1977C3744043D8DF6067B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618468, "uuid": "a288a85c-b473-498a-ab98-ee271c488ca4", "value": "1536:XUcFbeC70KDNNBhrUxBC0ASzqtfWfLBA5i+mN6RfM:EcFSCDQxB/A0qtfWD6i+O6RfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618468, "uuid": "6387b8c5-a8c6-4bae-92f2-a1dad75b007b", "value": 97508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618468, "uuid": "3a9e8fa2-cdef-4344-810a-5fca909c1caf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618468, "uuid": "8c32cbad-47f5-4ad3-992d-3e36d836b09d", "value": "rage.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509d2317-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653136, "uuid": "ffda33e4-8d70-4bb0-af33-750bc822bb8b", "comment": "Malware payload (Mirai)", "value": "0dc58d01c650582a6babbdeaac46c2dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653136, "uuid": "dea8c1a2-5d6d-4d15-80b3-81995f83c0d9", "comment": "Malware payload (Mirai)", "value": "2364325c7e9cbb23ff76d517f155cbdf6b33985cd36e05362d2807bdea299745", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653136, "uuid": "ff8e48d2-38ca-4234-8dfe-e5dda209dd31", "comment": "Malware payload (Mirai)", "value": "e6b5132cfb6354376287edf2cb3275181cdf41e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653136, "uuid": "867cb991-85b3-4cfe-a975-e6e6a2ece6bd", "comment": "Malware payload (Mirai)", "value": "2dcda9c406defba2ae88ceeb49f113f0d3121dd6b4b123dd4defff17707235cf8892a2f66f5d9d77a6005b3236885cbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653136, "uuid": "a4102a6c-d96e-4227-8aba-1ed209fb32a1", "value": "T1A3F48E58FE4E3D42D2C7E33DDF8587A1612BB5F4D32382B27981125DE5D6AECCAA1201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653136, "uuid": "e2483db7-d18c-4fd8-b2b1-d1f904f19636", "value": "12288:RPWpL5fa3/PtSjw4WnwfYfUY1wcqSQOkUIs5u1LFZY:BWtxaAjiwfYMJcqbLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653136, "uuid": "cf9fe9cd-ae8d-4e23-b8b5-f6fdcaf58535", "value": 735648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653136, "uuid": "99d2ea56-f303-4bee-885a-47cd8f040f86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653136, "uuid": "09438868-74de-4762-be6b-a9618ebf4689", "value": "vaxbot.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a6300d-4529-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777618120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618120, "uuid": "b9398387-478b-4a9d-a59a-245586ab4387", "comment": "Malware payload", "value": "8a7a89ee6885395944dcd0fd2a34782a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618120, "uuid": "16207e66-bc3e-4334-844c-7564daf79aee", "comment": "Malware payload", "value": "23f79635109cfdaea31620ee5b4b1790cf212056d7875365ace65bef99522985", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618120, "uuid": "6f7212b3-eec1-4cf4-8cbe-aa9d7d8eed81", "comment": "Malware payload", "value": "08754b0f9a6a35a8dd0e208d5e75bc0aea438a14", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618120, "uuid": "852e50f0-d36f-4f19-bac1-5784b0e83e12", "comment": "Malware payload", "value": "3a7f11d26b8aa6aa850084bc4d84f5eebc1deede9cb512358af5729884c2b5f1f3c636543a47632a986542cc4f5e7c06", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618120, "uuid": "f8a541fb-0a2a-409f-a9ec-22d4c42d7477", "value": "T170136D6526953C25AE99883B5C7F2F0CB9A983E1304891DDBFCA3CF18C15A9CE31871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618120, "uuid": "8f1fa5ff-91b7-4a95-b0d1-fb09b8080e27", "value": "768:bgs9NyXsZztCv9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b9HusZFcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618120, "uuid": "60fa91e7-1a98-41dc-966f-15483f17f92a", "value": 45433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618120, "uuid": "2457987d-ca2c-42cf-81d1-1ed36e758726", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618120, "uuid": "b3ab2987-df9e-4ddf-8ebb-d14c2f4cd671", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b841ec38-44f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777596186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777596186, "uuid": "bee04482-55e3-4cc6-a70b-d59f58dbed41", "comment": "Malware payload", "value": "9f67d9c7816095393a6a8f2739bb1c77", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777596186, "uuid": "137fde22-daaf-4063-a2ed-2b773317d80e", "comment": "Malware payload", "value": "24d7c67c0e89e51b71c65927845e918070ce96dc6e5f43e4b7734933d129087d", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777596186, "uuid": "80305d48-a1cb-42c9-92ea-a5c62b01e42d", "comment": "Malware payload", "value": "d894d8800a541d4e5ee58ed05ebdf7710638c284", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777596186, "uuid": "ca82fd73-0613-4c83-9e32-67b24b5525c0", "comment": "Malware payload", "value": "edc9b95ac6843ddcda708b3f782be40f5fdda7ed2d0c70515bbf50dff6a54e4a07850513b91a372fe49d6201997d1be7", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777596186, "uuid": "01e47f69-6edb-49dd-b27d-7fcf82980f4d", "value": "T1A58513AC7471B99BF4A8437AC6C52CBBDB2CA445DB993DDF8E2001427D8310E5F6B861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777596186, "uuid": "c2131413-1858-4c39-b3b4-5b278d1a9e62", "value": "24576:NR42Lp08/l6h51a71/Lz8LO5EZsHICUYOed6xBxjNWPXvWyDnz:N1O51e1P8ilo2OM6ZNOWyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777596186, "uuid": "29c2fd73-52c6-4647-a932-c0ee52d9cbd9", "value": 1726208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777596186, "uuid": "b7c794e4-e035-4995-8825-7ae6c294e5c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777596186, "uuid": "a61f6329-2034-44df-83f7-c131a5152eb6", "value": "MW2Old_.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a80d71-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618653, "uuid": "c6a0429c-ffc9-4e50-9885-0e93b36ce5b5", "comment": "Malware payload (Mirai)", "value": "85a6ad366bac40c2e1414ff659c38e40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618653, "uuid": "04320019-31e0-4bf1-a11c-707cee58f942", "comment": "Malware payload (Mirai)", "value": "26a923b1d9876dfb126f2dc9478c6daff2110e4d5c0574de0e5e7328e17090c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618653, "uuid": "08d48cf6-55c7-4bc1-ab12-66d4f2407643", "comment": "Malware payload (Mirai)", "value": "00453b4c7cecea95c1b54863d634f9e35a4f6265", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618653, "uuid": "7111b349-e837-4ad1-9cdb-e7a6e683e3af", "comment": "Malware payload (Mirai)", "value": "577f975e84eb0b670b858bfd285a20d00b40a381de58b0d96028f39173b4d12271b683cadd8f7949c962cc10d2ede68e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618653, "uuid": "7747a395-5fd7-4b68-95b8-21258e235b70", "value": "T110934C336613C6BAC08766F527CB9B159C33B8BD0B632106B3D47DE82F955C62DA9E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618653, "uuid": "86e01e95-1c79-4bb9-9b8a-0747149822d2", "value": "1536:N7R3dgFgpm+U3owTmlfX8xbUHPN+83Xapha3N5iAoxg6I5um2Xj5YZA0e:t0FghURKlfs+vN+IXapha3zoxg95um2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618653, "uuid": "21fcbbeb-e35f-4795-8c5c-87c3d1f41b4e", "value": 92628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618653, "uuid": "df3d9470-6533-47d3-843e-f8f5ea2998a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618653, "uuid": "c9fc5877-4caa-46ca-8ed2-f9e7b9a1924d", "value": "hidakibest.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd362d1-4527-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777617030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617030, "uuid": "15d0c483-8a20-4b18-a75c-090b4b8faf17", "comment": "Malware payload (Mirai)", "value": "5dcfd52009dad6fff01a21b39bc0abbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617030, "uuid": "6d5571c0-c626-4a93-9f94-68a9d434be31", "comment": "Malware payload (Mirai)", "value": "27e8f7034eca403984d9d40222dfccbecd104e9b57630c8d9b3c2474876f58fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617030, "uuid": "d3f90e61-f074-4a74-98c2-2bded0f3295f", "comment": "Malware payload (Mirai)", "value": "40a65ce57aced0e400140039974dd863659e4bdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617030, "uuid": "358f8c94-e3d1-417e-a136-3335c47668f4", "comment": "Malware payload (Mirai)", "value": "4606d0f60545eb9123101dbd0c6a34719f0cf5751a36d711d92932af415b7e59c8070f926c3dd9e89ce680d8412b2d87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617030, "uuid": "b324eb3f-f668-4b83-99c1-c27d451fe482", "value": "T1DBD2D124B1E78678C0C275761D2E7B87C750E22BF1C14A52B6FA312D89B7773A42C352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617030, "uuid": "88fa327a-3abe-409b-9b32-19a0dce36acf", "value": "768:YSKz/yen/wXec4OCdMvjBB1MasmoXSU+SlznbcuyD7U9Uct:YSKjyOWbCCvFMadoXSU+SVnouy8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617030, "uuid": "8a3f1f58-0125-42b0-941b-563209e9e5db", "value": 28476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617030, "uuid": "ed1edfce-9bc2-4dda-bed7-9d9c2fc1c951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617030, "uuid": "cb5c20a9-a397-4d3c-adca-58f9389252e6", "value": "rage.x86_486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe95486-4596-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777664650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664650, "uuid": "4261088b-ec01-4999-a657-00b82a3f7a0c", "comment": "Malware payload (Mirai)", "value": "ecb02b76938aa695967d764ff1e92132", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664650, "uuid": "8da6bdc4-b197-474f-b4bc-50d1d51352cf", "comment": "Malware payload (Mirai)", "value": "286f6e82b68c6e434b332eaabd801cc9665b78bd40aa74dd3e7449b95804a675", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664650, "uuid": "caf30568-d309-4981-a687-cd1bc9ab85b8", "comment": "Malware payload (Mirai)", "value": "f3a6db071acc9b5f61efd3f528910338910554bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664650, "uuid": "769f388c-4309-42a4-895b-68b0dc81aa96", "comment": "Malware payload (Mirai)", "value": "ad492cb3463cfe10f7aa9b5691b02a0affb6ca3434609e6cee2c27da37581edeb4b009ce10e94bae8ad621a0d59a56c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664650, "uuid": "96806da5-7715-416a-a5ed-969533093f5b", "value": "T19953178699629FB7C006A0F129B61D750B16BD624E1F0AD97439FAE4037F5CEB00EB74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664650, "uuid": "b2f836fd-3623-4d65-ad14-c5917f1994a7", "value": "1536:duAmS3LaqQdn05wRXM+KM+D3uk+dCD4sYoR:duAm+m052X2Mrk+de5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777664650, "uuid": "b9f80c4d-275c-4df8-a436-ecf0305cb2eb", "value": 62540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777664650, "uuid": "38db6e99-fc69-499c-8581-e09abc05ca62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664650, "uuid": "c3c4d590-014b-4bea-9d8a-706d58c4c57a", "value": "SH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a929030-457a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777652642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652642, "uuid": "2922da2c-b2c5-4c67-b08b-c03fc990db9f", "comment": "Malware payload", "value": "8e9146d64e3c38457d6916be7e14139b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652642, "uuid": "3730738e-05db-40ed-bb57-23a5e916f12a", "comment": "Malware payload", "value": "28cdffe24c8e11cba16a079b91f2f36df76d4b24a9344441fb7fbaac912130d8", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652642, "uuid": "f0bfde27-6ded-4ab6-9cd2-da1e6eea8bea", "comment": "Malware payload", "value": "9a58eebc6201050082b6ca754dfd8920baad7753", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652642, "uuid": "7f81183e-f7b6-4e17-9ec4-7da81776b6a4", "comment": "Malware payload", "value": "9b62ed5fb263f22d9d93a7c36ee66cc12dade717a9c2609506e43f145d0c09f977e2922fc5a5e4adbf4466f15abd1a0f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652642, "uuid": "3d60144d-fe64-4c76-ada5-6686f3057e60", "value": "T16252E890BC52D8D481F353BECE9FB558FB2B586B12651004B2ACC1E07FB4DA4C268E68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652642, "uuid": "2661e2c0-a615-41ad-b8f3-043f2961d744", "value": "192:teaZUMkKuLF5dzi9ye297UfhqoYkEr2Sz4fcJfHBWjKGb+Tqim5:+KMe0N97MES/ivBWj2Tqi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652642, "uuid": "5e0a099e-c6d8-4e08-81fd-9041bbb62021", "value": 13874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652642, "uuid": "919fae74-23a7-49a8-af0e-ab2af730ff87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652642, "uuid": "8b012951-abb6-47cb-88e8-3832ce2f0bb5", "value": "gB3_LoeN.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab5b2ee-4526-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777616914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616914, "uuid": "608f3456-f198-46cf-be72-1271ec813a7b", "comment": "Malware payload (Mirai)", "value": "4c40a364edcd2f8e7a858be0664f7e05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616914, "uuid": "dc714237-18a8-42bd-a667-22ad1b586205", "comment": "Malware payload (Mirai)", "value": "2a0695cac26cb3e4683e7fa623c4e49d7650f8c9a48b3951fdb38c157cf6ac7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616914, "uuid": "5b714e6b-2958-4e6e-8b36-7e1b30c83e7f", "comment": "Malware payload (Mirai)", "value": "969a8428c00c3ae5f8adf782b2582db1244b5b64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616914, "uuid": "d53af09a-94fb-441a-9bb2-4f42d6d123b9", "comment": "Malware payload (Mirai)", "value": "fe75b29c7392140c3bcb4424344c3b88ac5d081f48ccfa8b932e7b9ba21142b92e11b94a5233a90ec9d2ac5ce8d14f45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777616914, "uuid": "8f443f21-e2eb-46b7-8946-5b65157e80ba", "value": "T120831756F9829B01C6C112BAFE1E528E7313077CE3EE73169E24AF24678756B0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777616914, "uuid": "eee368fa-7e1d-4ea1-ba96-4753de7c8597", "value": "1536:FwniEwPrPZwXKFPKazFw1Ja7gjM/iYjJXNMEmzYK67sZCm5PYWJbZ:fRwXKFyaxgiNNMEmzYK6OCm9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777616914, "uuid": "46f77c91-4cbe-48fd-bb82-087ebdeb0011", "value": 87520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777616914, "uuid": "b52c51bf-e781-4241-af6f-7c5ac2fa428c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777616914, "uuid": "4a46a09b-7c0d-455c-8974-28759fd25673", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e8121f-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777635960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635960, "uuid": "1332078e-8be9-4b1b-b025-2f8ab03ea744", "comment": "Malware payload (Mirai)", "value": "96159ac9e1a2aa06526699176b0412ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635960, "uuid": "08a9d45b-beb0-4ba0-96b9-13aa76ae7a80", "comment": "Malware payload (Mirai)", "value": "2bacd2a8dea88032cc7ccb40502a14bde367859de9a18ec5d8724337168730ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635960, "uuid": "42ee9633-2799-4cd3-9b3a-e58999682bd2", "comment": "Malware payload (Mirai)", "value": "48e6e9784a4b5c5de5d9d5883385fdf921e9e496", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635960, "uuid": "a97d48fd-acf4-46b8-934c-6b367123ed98", "comment": "Malware payload (Mirai)", "value": "3bd4a1c8ba66a9bf882c2417e12b75ae2a4e9694c78bd136411b69c8afb24f25865eabf1a98adb111dd7b05cf006d314", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635960, "uuid": "45667f32-5891-4688-823d-801b9dbe66cf", "value": "T17DE3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635960, "uuid": "27e83d2e-6e9c-44db-be32-9e169389618b", "value": "1536:p+1TcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxgdbK:p6lybKpzEOfGQ+vEubTt4ouftL48dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777635960, "uuid": "42854149-b54a-485f-92b8-cdeceaf90d7c", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777635960, "uuid": "33eabca5-713b-41ef-8e82-618c5322dacd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635960, "uuid": "44c51c2b-90c6-46d1-8f3e-09a9153590e7", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7592d4-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777618662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618662, "uuid": "c8b604c9-d960-46ab-8275-09150955a7ec", "comment": "Malware payload (Gafgyt)", "value": "45931096900e81d6cc2f0602490c356b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618662, "uuid": "df5ffc3c-1333-43b4-a84b-fc1d052e7452", "comment": "Malware payload (Gafgyt)", "value": "2bc1dbbfcc067bef5c395ba8a8c65f033ae67e848684a83e14a680c33aa28eea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618662, "uuid": "6beba47d-2d1b-43a3-bb9c-e18ce13c25f9", "comment": "Malware payload (Gafgyt)", "value": "133d4a9da017dc0f8bfcee4168e6a871c2a9f376", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618662, "uuid": "9ea5e0a1-ef55-4069-b567-01a98aa68823", "comment": "Malware payload (Gafgyt)", "value": "d51d626bd25453f4a4d40b8e69246e248b736033da11ff54d298037da1a75794ecbc7265288d12f0f3089e75bbefe09d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618662, "uuid": "d4738771-54bf-4cc6-ad41-766500a1af33", "value": "T155933A03B72D0F43C1DB59F029EB27F18759BAE202A36181A91BAED05773A792413FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618662, "uuid": "fd71af2d-637d-4f1d-8c92-0daf92aecd23", "value": "1536:b73KddvUAXKPjVgCdmH5RHvDpRIBiHh1h/lLKVL5hvhUROFOmV6qDjjoflee:b76bvhXKPjVWnLPIBiB/M5hv+ROFOmVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618662, "uuid": "631d467e-b365-4652-9ef5-6912433338b8", "value": 89416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618662, "uuid": "1d9c7d5a-c247-4b75-a087-ba09a72bd5fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618662, "uuid": "fabed403-42e7-4886-b73e-4e45d483d501", "value": "hidakibest.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00875b9-4595-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777664516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664516, "uuid": "9545d035-cfe3-4e5c-bfc8-508406b3eac8", "comment": "Malware payload", "value": "26d75f2ef5076a485d2dd6c978cc1c60", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664516, "uuid": "dc659241-365b-463f-ac6e-bb8df59e6107", "comment": "Malware payload", "value": "2c95a7f6f8bfff7ebdefb0cf3dc44bc57e1605268838e526ba033c16c4bfae54", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664516, "uuid": "df71e4b7-6c8e-4350-859b-756bfd3e7530", "comment": "Malware payload", "value": "7ce01b43bf6b41ca099e4ea8be446f56710634ff", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664516, "uuid": "8f6ed2cb-e257-44d7-a968-047bb922a0cf", "comment": "Malware payload", "value": "0df06cbbb58956a9a3bb456c8b091deee64bfffc706a0abb5fa00997a4ae52cff524b079bbba32e84c2b78d38cad8d54", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664516, "uuid": "d08cc0f2-9053-4ee1-ba28-bf391f0b5ed9", "value": "T167311ECB21A159756CE6E96772AA880075D4A1CB14CF6F4DACEC38EA90CDE08B410B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664516, "uuid": "63b78a7e-e2b2-4b20-90ff-460cde7b66f5", "value": "24:vp73pLpXpXp4fspQbapTTLp7pjcWpv3pbpKsps:vpjpLpXpXp4UpQbap/Lp7pjfp/pbpLps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777664516, "uuid": "46a2af71-aef8-49bd-8b57-3b5aede19e98", "value": 1502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777664516, "uuid": "55c311ff-e9a2-48a8-9464-4c3985d77523", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664516, "uuid": "14f41d35-490a-45a7-b5b3-0008b32a1ec3", "value": "Cia.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e1bfc2-4522-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1777615005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777615005, "uuid": "75a0845d-2bf7-4a89-8e63-aab2b9d31f43", "comment": "Malware payload (Joker)", "value": "d520a7bf3a1ee8ce6dab897586828353", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777615005, "uuid": "2a2e0228-3ba1-4443-90ea-9858e03804c7", "comment": "Malware payload (Joker)", "value": "2f7574bd43fd4af4df8330461cc3ae10ea287ee35e2f3c76a1eecad567886a32", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777615005, "uuid": "ca4b7ece-4cd1-4588-9e59-07733355bf86", "comment": "Malware payload (Joker)", "value": "ca3fcc0ac6add26f6faab04d70605f3486128d30", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777615005, "uuid": "339512e7-71df-46d8-9b95-81d179c098a8", "comment": "Malware payload (Joker)", "value": "593d47035bb82451077642ec98bf041ede90568d8d77a708e0c18aca80db12118a6f93b3ac88270ebb87811f0692b49c", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777615005, "uuid": "57d39c00-5b83-4958-a7f1-bec64dd4068c", "value": "T16D17D04AF60CD42BDDE9B0BCCD8B07A3B5667D151610C18B2821B20DF9B37D49B66BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777615005, "uuid": "14091a8c-c529-429c-ae0e-4cea18a01e2f", "value": "393216:c9v8BjWzbc9cQXRJJi7LnB6rQxCuKrW701QCFu:c98EbJQXRJonnB6cFv4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777615005, "uuid": "e7e5cb96-5f64-4736-8d45-53950633adf0", "value": 20067953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777615005, "uuid": "282fb7d6-f24a-41c7-abd3-aa97289eaaa2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777615005, "uuid": "89e00dae-1d2a-4296-ad69-bca9be8e30f4", "value": "com.chat.text.messages.sms.messanger_1.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3684be9-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618968, "uuid": "2d1e11af-f234-4779-8cf9-d4c5954b2f53", "comment": "Malware payload (Mirai)", "value": "2260962ca1611ec4b9c4b1f409a75c2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618968, "uuid": "45bf2635-2a65-4e5b-bf6c-98dbd356a827", "comment": "Malware payload (Mirai)", "value": "30ff9bee96c6cb9f79022644b84fcd3a897629fad51d4d033fa01ba52c886557", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618968, "uuid": "b48aabb6-da45-4767-8897-3ebff0bd95b7", "comment": "Malware payload (Mirai)", "value": "3a74c06b88a3b858adb0c4e276889444d23055e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618968, "uuid": "0cfcec2b-5517-4b16-bbaa-1c11391e0a62", "comment": "Malware payload (Mirai)", "value": "3d1bf6351ba3db89aaaa0db95c5b2becaf99b75e8a9a41d1f99b5872d1f8a7ed34f80c77d8760f49429820b8414d571c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618968, "uuid": "d149f4df-7bd9-40f1-a287-4d3fae7d041e", "value": "T1B9F3551A3E22DFBBF56D827047F38924579876D636E19689F25CD70C1E2028E141FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618968, "uuid": "f6950489-1436-4eca-b8a3-e8bc4ac570b4", "value": "1536:cI7yGM5z2EJO3f0OQI4Rmh8eQrwx8x6yEW6TVbD8rYNUg0Qeh0/KTk:cA+22OQI4RmhDx8xBQDzNUg0QeK/KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618968, "uuid": "0c6c7ca3-2071-4cf9-9e61-4495f6c92466", "value": 172096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618968, "uuid": "81edd91c-d5e0-4e2b-8f24-b2b5205d0542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618968, "uuid": "247cd80f-f409-4a8b-9e7b-65a4eef09123", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be17111-4520-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1777614124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777614124, "uuid": "4bfa853d-67bf-403a-89ee-0edf88358252", "comment": "Malware payload (Joker)", "value": "5dfed88c70216d0bab2a17d690917d4b", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777614124, "uuid": "e0bb2455-0014-458a-bb60-9dce71660e7b", "comment": "Malware payload (Joker)", "value": "317295aa6e7fdd6e23fced07e6a9245499a973d4eb8212963874c8cd7e4e3949", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777614124, "uuid": "3165b935-0141-4642-ab52-1be1c9c2e4bc", "comment": "Malware payload (Joker)", "value": "7c00b892de7f6e3f36f333dbf87b64412137557a", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777614124, "uuid": "5eb859ad-6edc-40bf-98f0-ad3edaf00e74", "comment": "Malware payload (Joker)", "value": "cdef4d47561087d91935181dc8dde4e7de3022307914253fd0056cd0e2e7e1b320b4df4547ef659898256f067575d8d2", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777614124, "uuid": "a17d5219-a72a-42a7-9efc-b03830807690", "value": "T19157120EF70DED1BDCF2F078955A126279566C58AB0287971901F22DBFB3AD48E1A3C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777614124, "uuid": "446e239b-641d-4c4a-b233-e2ec053c3b64", "value": "393216:SHsJNANCF5FV4WjiFlRuMiLKt6ZAAozk/uViuugjFw:amZjFV/ybw/AiMjFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777614124, "uuid": "db51a4e7-2a08-4c26-9ae4-ebd85a1363b3", "value": 27081660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777614124, "uuid": "a12c8966-42ac-4520-b301-f28a2e4af5b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777614124, "uuid": "eb692533-b964-45d9-9ceb-486cd0d26ca5", "value": "Aura+Clean+Pro_1.4.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5dde7d-450a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777604730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604730, "uuid": "e50653cd-5cb8-4e0b-b73e-9fbd5f146b1a", "comment": "Malware payload", "value": "c965920458364982e849e8919006ff26", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604730, "uuid": "c709bb61-66b4-43a4-ab12-34ec334bf70b", "comment": "Malware payload", "value": "3336c0fe736b0a45f375a5fef60fb7a33db39e331ccbceb372f5162846e145fb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604730, "uuid": "36799385-c2f2-49b9-9a07-40e0390d2a97", "comment": "Malware payload", "value": "6e619f6bff6f3ae7c3bcca55124e839202df6b3e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604730, "uuid": "dc2027fb-5f89-4d09-bfdb-fd5ab793d0c1", "comment": "Malware payload", "value": "53f7991ccafcba355d94ad02f4c1c12a3c01c38c67fcae778b58748aa3c0323378a5bcd555b4922ed8241019585ef5a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604730, "uuid": "f254fabf-4490-413d-98f9-d6c5dfe523b1", "value": "T19411AFCA45112D604043446E2BD664B8B8D9D28E83060F807EED4C3EF7DC565BC39F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604730, "uuid": "2f791631-1ee3-40d3-927a-5c107272718a", "value": "24:kXCaKvjuZI4WuBl0B8l/KielrNGhalalgSlVTYM:eUh4NBCB8poNkH/TYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777604730, "uuid": "e01c485d-3306-4c76-b097-e6a5d06cba25", "value": 865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777604730, "uuid": "f9e10a1e-d5dc-4257-9962-74e2d712e7d7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604730, "uuid": "329379e7-d68e-48fc-8f0d-d61e680e23fe", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83af33e-452d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777619916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619916, "uuid": "c9917224-e5c9-4891-b3f7-4711ed758afb", "comment": "Malware payload (Mirai)", "value": "48c4f1192345f820928bfbff0dc8ed53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619916, "uuid": "c29c3261-657a-4fea-8aa1-27a8d27c4db5", "comment": "Malware payload (Mirai)", "value": "34bfeac94a7f55ab2295f801b702fd443a9c640481d621e9483a29beaffd4955", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619916, "uuid": "f59a6827-229e-422a-8315-d587c2d3f36c", "comment": "Malware payload (Mirai)", "value": "b5cccc6ba5d55b2b0f5676e690b421ca6ba45a6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619916, "uuid": "045a537f-99f4-42c8-8a4c-50640b8cb1a1", "comment": "Malware payload (Mirai)", "value": "6077f3d2e4f47c8a5c9aab351f653221d78122ca212e726bc780b908c9fc951214278492ecdc9211208afe183d39a3d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777619916, "uuid": "2da53951-da3c-493a-83fa-a0c18044049a", "value": "T172B32B05B30C0D47E2633EF43B3B27E193DFDA8121A4F640655FAA8991B2D325586EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777619916, "uuid": "7a67164d-b2bc-44af-8c01-46db4cecb43d", "value": "1536:7SN1fbEMxdHklw4O5W2dGzkgjCjSXAavAR31ONlxdVEgNoiVTnqsK5Dh:2N1fbEMxhBXGzkICbDREnvAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777619916, "uuid": "b7b9e2a8-1377-4c75-ba2c-683f903a6ea5", "value": 113412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777619916, "uuid": "7c156b0c-e897-4fce-b2be-91f2473b2e60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777619916, "uuid": "dde6733b-4457-4ec7-a902-1d98c7e892a5", "value": "rage.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b55bbe-4524-11f1-a769-42010a9c0008", "comment": "Malware payload (Moobot)", "timestamp": 1777616048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616048, "uuid": "37b1db41-ffdf-45e0-aee6-b2c96a455ffd", "comment": "Malware payload (Moobot)", "value": "3810f74d7db80023b9ff8a368868ca8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616048, "uuid": "a15793fc-3d92-4b02-b421-ca5b61931cb6", "comment": "Malware payload (Moobot)", "value": "34c361cbc786c97f75f026381023b63a83ad99f59fd4b49ec20c46a59363524c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616048, "uuid": "a6417ce8-2133-4168-82ac-81fbb58a2254", "comment": "Malware payload (Moobot)", "value": "efa51becfaad50e13dee9c3ac28c66b929a93333", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616048, "uuid": "9aeddee2-eccd-473a-8d1f-6cb9a5ee62df", "comment": "Malware payload (Moobot)", "value": "d4ed0dc74029f29e9ec694ac769e3baef108ffecf9cf2863a956621acaca3dca1275881440b5507f743530e582e1a97c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777616048, "uuid": "a4ff0188-3171-4fa3-893b-ef632bb38324", "value": "T16F73F649FD829F10D4D813BBFE1E018D33536798E3EE71129E116F11A6CAA5B0B7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777616048, "uuid": "e141d040-7804-4957-a7fb-b405fa5b30b0", "value": "1536:K9nhz1Sz+9crO9rQQh0n2waZoZnknrw6iYhf8XllzfisgAXU5wbZn:IZU+GrOaQh0qo2nrw6iYhMVgAE5wbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777616048, "uuid": "121f0e4f-0c60-418f-9c53-a2d051cf8c2a", "value": 75616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777616048, "uuid": "1f482b7c-04b9-42d2-8efb-a88a3f3e7f37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777616048, "uuid": "ec6bbec9-6964-46de-a87c-450641910978", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56ff5cb-454b-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777632689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777632689, "uuid": "e6bf4a04-1fd7-4149-bdfe-799840a1012b", "comment": "Malware payload (CoinMiner)", "value": "38e906aa7bce8176261d50420c593c87", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777632689, "uuid": "fa14d4f2-9746-4c38-8aa0-88b32a2a6534", "comment": "Malware payload (CoinMiner)", "value": "35b6acc05cc54134f6699028dc55764ee3a4b3c5c1e57a5fe687af1cb9121c4a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777632689, "uuid": "89615bf3-8b72-4684-a853-c265c8ae7b3a", "comment": "Malware payload (CoinMiner)", "value": "b465a6d7f28459ead4ba08c757b56bea4f35d4c5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777632689, "uuid": "1a692616-66b4-4b5e-b372-c3337c61c77d", "comment": "Malware payload (CoinMiner)", "value": "146b40eac5cf6a4cfd1c6aab2b436bced9695b6707309572b41e15d0154e0232921c536a45ac069d2b09e79ac7c33ec8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777632689, "uuid": "8b876f66-f697-49de-bc76-9466b54f4e5b", "value": "T14132291D7E490332E3A489B41879824B517C6223E793E3EFF7339A5A5A962448840DBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777632689, "uuid": "1b912877-a4da-4ec6-9649-29cf739cff91", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777632689, "uuid": "5f37a177-12d8-4e33-b72d-0c0271a6503a", "value": "192:U94so2WPxTBjx+e3yzsQPFJxTEZmFhS2cVRpE:URotxFwjPFwZfpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777632689, "uuid": "960870a0-8710-49a2-b969-1ee83639fca1", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777632689, "uuid": "b7ba2af6-b2ab-4e63-bf27-a05c3ccac2b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777632689, "uuid": "65bb9df7-10cd-4a66-816a-7bc96f0a75ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34c67fa-44f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777594138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594138, "uuid": "34f51296-5ed1-4abd-96c9-bdfa96e43098", "comment": "Malware payload (Mirai)", "value": "c27bfddd27f4cd87fb9318fb03501c55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594138, "uuid": "be1b7b99-f723-45d7-8693-d568ac118d81", "comment": "Malware payload (Mirai)", "value": "364bd4fa4fe1a4008d1399a722a1ae57068357d1613991fbd36d05d349be354a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594138, "uuid": "70597a24-e7d6-438a-97d8-faf8db96e795", "comment": "Malware payload (Mirai)", "value": "f80dc28ed70f0a29aed13b85fe9c3987c0b31278", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594138, "uuid": "3dee21d8-d636-407b-ad77-e43a95f6dd62", "comment": "Malware payload (Mirai)", "value": "447a7c8e46c8d1bd0aa247b316c0021c1b61a57ea2361bea3f18f551bd3582f12dc0fdfce4652006e10a8a48e06a899e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594138, "uuid": "a2c00d5a-4c00-42e3-b377-0204b44ca871", "value": "T15DF31B46F8818B11D5C111BAFE1E128E37131BB8E2DF72129D246F65778A97F0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594138, "uuid": "c425fad2-8e8c-45da-8876-c49a044a72c1", "value": "3072:CFtcp03pPoPXJMU0X/nO0Xj3yETFaTJNPFB8PrPq5s:CFOO3toxMXPO0XbyExavkPrPq5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777594138, "uuid": "5d1262e8-9826-480a-8b11-c6c785bdfbfe", "value": 160828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777594138, "uuid": "feea4c6c-df22-4d77-a8fc-0a9f552b85c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594138, "uuid": "ecded3ac-e4a2-4088-87c4-d36548c47c96", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7f6ca2-458c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777660536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660536, "uuid": "ba13d35f-2771-4f69-ada5-d5f651f04476", "comment": "Malware payload (Mirai)", "value": "87ae55d85e6e078948a4f3273819579a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660536, "uuid": "2469c3e5-20c0-4203-8c7d-f353f0216163", "comment": "Malware payload (Mirai)", "value": "37485708dbae5a4db5f4d960e209dda7871aa8f21aba90536c6a4c76f129d3a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660536, "uuid": "b8fd6893-d042-48dd-8ccb-e344b27b29b1", "comment": "Malware payload (Mirai)", "value": "409989def0640c8fd4f647cc67dedb3b087ea7df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660536, "uuid": "855eb060-27ac-4280-9ded-c9812b18fea7", "comment": "Malware payload (Mirai)", "value": "a1302580ad6c019ef8d733ce7deb8a7ed1dccbe704aa0a057b47c849cd02c9e76a71968b04a5df35fb8c3740ce3ceb0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660536, "uuid": "f5908dfb-946e-4721-ad91-e9c99b9fadde", "value": "T16AF33C47B7208FB1C368D67009B3CB67A6E6269216E19985E76DCD107A3075C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660536, "uuid": "ee9cff8e-d3e3-4c0b-8af3-a77c18c2a870", "value": "3072:o3VJgzikZXyrNo/tqTHmnsHgCtEUQW0l/1wLxpvEcJz3nUfau:oFJMZBtqCnFCtE1R1WpvDGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777660536, "uuid": "f8e90641-6158-4a85-852d-992ceba171a1", "value": 166944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777660536, "uuid": "3b8c341e-cd6e-41d8-9d9e-20cfc098911f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660536, "uuid": "986cf747-ce91-4ca1-9c75-7a397e3f9d13", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e6738e-4557-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777637629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777637629, "uuid": "ccd762a8-04f9-4509-8907-616c2e75df83", "comment": "Malware payload (Smoke Loader)", "value": "a086a0bf40da79a90f7958bca6b5c94f", "object_relation": "md5", "Tag": [ { "name": "pw-7744", "colour": "#361E9E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777637629, "uuid": "c883c692-a05b-4b5d-9c52-7cedb70ac2c9", "comment": "Malware payload (Smoke Loader)", "value": "3773c92b8d47d860efd62e8d5ad23f379da867b91400fd7591e1009153ef6521", "object_relation": "sha256", "Tag": [ { "name": "pw-7744", "colour": "#361E9E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777637629, "uuid": "8dea1b56-9a41-408c-ab1c-d8fdb8bd1c52", "comment": "Malware payload (Smoke Loader)", "value": "1756966ae8702a2c897a356b886a1c881d26bce6", "object_relation": "sha1", "Tag": [ { "name": "pw-7744", "colour": "#361E9E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777637629, "uuid": "8b5a3570-77df-4066-a93f-2ae1e1324aab", "comment": "Malware payload (Smoke Loader)", "value": "5a0ce9ddc615cb27963182199ca9bbe8e795ed63ef6241199b46b1f54de71eb12aed91880a318d7e829885e2bd67eb84", "object_relation": "sha3-384", "Tag": [ { "name": "pw-7744", "colour": "#361E9E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777637629, "uuid": "0984e3d1-b6b2-4490-9541-9b6f04ae10cd", "value": "T1B3E6338FE0278697770B4635A1B115DE1DA4F3ACDEB85B97CE2CBB91B0749E444880F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777637629, "uuid": "7fc59dd0-242b-4e77-a023-bfaa2d70ee6b", "value": "196608:/SljSSM8d/Ht2Xuc91wGg5fk757fHdI+BMB1IlIzWnuwIFjwlZtbB2xeLOD9Xa9w:tV6Ht2J1S5forPMcl6wIFUlZBLy2jS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777637629, "uuid": "380819b7-9c1a-4be6-bb65-72fe9b536283", "value": 14567150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777637629, "uuid": "4582b7f7-1ca1-4f31-87fb-43f665c31c20", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777637629, "uuid": "d7658f13-420f-4e31-abd3-6fdd1cb86e05", "value": "Kiddions-5.1.4-win64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d42470-4599-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777665915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777665915, "uuid": "b8c79843-865a-4fba-af81-c3daa0dd667f", "comment": "Malware payload", "value": "ae6e348237ac609bf3e2a702bc1af158", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777665915, "uuid": "0d2eb40c-3e79-4a24-9d77-0652ccd0401f", "comment": "Malware payload", "value": "397566a51d405c351e5134650463d5872e218682f7f34a5f314539d087837ea4", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777665915, "uuid": "c5695234-84c8-4b56-ae47-18e3ca325e69", "comment": "Malware payload", "value": "c4831ec2b68c576199245eb877e83f9b5e83dd3f", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777665915, "uuid": "9fdcbed0-a238-41d5-87fd-32e08cd4b9e8", "comment": "Malware payload", "value": "47cd154ed066be740758c2cc8841c27056282c780126449cbc01cd58b2134891bdac4e6c98dafbb63eae4f3bdc6573ba", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777665915, "uuid": "362c8f3d-3a98-46d1-a98a-c758a0e3f537", "value": "T106653A1BBCA409FAD0AA9332887751917BB2BC450F3117E73A60B3782F726D49E75784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777665915, "uuid": "cc5d403b-e944-4dd8-af38-3781ce270e17", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777665915, "uuid": "2b92398c-94aa-4d34-94ec-51898fe992b8", "value": "24576:gT1U1eNHMGDPcq3msdSs7Q/NBele5zK2I/LD6eFI:gT6sNsGv3FSRGnvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777665915, "uuid": "125517ba-474a-410d-abcb-a8f25805fa84", "value": 1539072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777665915, "uuid": "6a410e3d-7db9-43c1-ae07-3b6a4abc5fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777665915, "uuid": "a030dc73-4dea-4646-a77f-b9d154c5079a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a823a7-4531-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777621246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621246, "uuid": "a4b2bf7f-fac0-42dc-9f58-5c431d9316d1", "comment": "Malware payload (Mirai)", "value": "cb89db136249272d98884ef28dcabd24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621246, "uuid": "fece214d-8500-4054-9c22-b9cc209c6803", "comment": "Malware payload (Mirai)", "value": "3aabcd10853f5bb4d0ee0daf9898ad7dde88b40ead7c66c90d55ad3cd5b3426e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621246, "uuid": "41fdd2e1-058c-4777-99bb-2c5022325a60", "comment": "Malware payload (Mirai)", "value": "9812b39accb459b09a3824e38ce0aad6a419a865", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621246, "uuid": "01eae264-09f5-46fb-aa10-b236ad781459", "comment": "Malware payload (Mirai)", "value": "ed6d687442375bd7b15e6844c8f355e6a446e59d7d3aa1a6329ccafa4575e31d034a9c31b938da83c009a65b685e8184", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777621246, "uuid": "1836b373-3951-476d-a963-3fbc431052f1", "value": "T15FC30702770D4E03D1633EF0377B2BE0979BFD5628A4A640752EBEC992719F22541EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777621246, "uuid": "5f6a3529-b918-4f43-ad86-a11b31349579", "value": "1536:lm7KTx1WTpv3WiXEM2JO+Uq6oPzvA713SMfR1nK4EZZ0qawylqGmchO2:IKTx1O+fM2M+dPkJrSJGmMO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777621246, "uuid": "8276fec7-0b82-4b49-ad88-294fadb1ce18", "value": 121908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777621246, "uuid": "a62274bf-e743-4a30-a457-c76d5349e137", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777621246, "uuid": "1a5a8517-98da-4879-a1e3-9c477e49b897", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9186eea-44fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777599677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777599677, "uuid": "c8ea8765-198d-48cf-aef0-c37a01ca3bf6", "comment": "Malware payload", "value": "98db39cf72add0132ee4d9769d8e71f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777599677, "uuid": "74e3b5cc-c025-46ef-8021-580d6e14f4c5", "comment": "Malware payload", "value": "3b2b56fb9987a8e5b76360aa983de511daba8a51660cd1168d38a7fa83bb9acd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777599677, "uuid": "9b7bf3d0-9450-4400-bac4-feadee6b6dbb", "comment": "Malware payload", "value": "1ab6804da1c3ecda6c2c07c2f5eb9a8cd87f4694", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777599677, "uuid": "d368d069-3f09-4e91-904b-9a1c2c341213", "comment": "Malware payload", "value": "ea412fdc0f748bff62ff5998d1da9864fd15d485e342d80d013e49d40b63e00286c3ff6f91915ccc9083940bb1f7607f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777599677, "uuid": "fc2ae785-8370-4494-8d17-3a3525981452", "value": "T1D025178035A08573F8896B340FFE3AE4079D7ED90A50B52E5812B29CD13D2AB5CF5B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777599677, "uuid": "cbf2a775-bc78-47bd-8c7a-fbf07924657c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777599677, "uuid": "2ec683b7-4e2b-435a-90ad-3fd13bc3c560", "value": "12288:7kbTiQE3/H8PiBwAB0Ftzk9pWUBNiq9iBHp1ECrk2Qbb2DjaedC7ysG8Ub:7UiQW/Huw/aFFUBj9i5p1ET7m8Ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777599677, "uuid": "2aa3930d-f803-403c-ae29-905d23ca239c", "value": 983416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777599677, "uuid": "6be2c4f6-0df7-43b8-8316-637cd3a0d8b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777599677, "uuid": "8c889503-5586-42ad-b25b-aa85935510b9", "value": "qlisSuzazQfclu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe72cd9-4561-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777641914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641914, "uuid": "7349b073-ab05-4c15-88ef-53cd001adeec", "comment": "Malware payload (NanoCore)", "value": "0ad27ab64841eab5ba19bcc4638a910b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641914, "uuid": "a624b75b-1cc5-4a6f-a06b-8d943c7e7b9f", "comment": "Malware payload (NanoCore)", "value": "3d18b9960c88a9a1b9ef9c7185becb7da53e8be6ac799e45bebd8057421fee99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641914, "uuid": "30d4387b-1e24-4634-91b3-3d3e884eb61c", "comment": "Malware payload (NanoCore)", "value": "79400f8e53d496debb424221bca6a14311755459", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641914, "uuid": "a6762f8f-b3cd-4ab4-872a-f3aea636c319", "comment": "Malware payload (NanoCore)", "value": "127a1935088731549d49d2cdc86ed56beca44453f002c9a43516b30c4e36703abc816a53407d4f54aa58e0a98733aba9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641914, "uuid": "39647066-3298-4f4c-abca-9bb4fa3309f1", "value": "T19614CF157BB84A3EE2DE8679612202179378C2E3EDC3F3DA58D454B75B667E40A070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641914, "uuid": "2edba0ba-af12-42ea-85d4-920d5593e319", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641914, "uuid": "4073b1f0-5f69-4489-808d-ca0565176557", "value": "6144:MLV6Bta6dtJmakIM5dplNzULgm7SB7e+Vc:MLV6Btpmkuzcb87er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777641914, "uuid": "740c2c0f-ce0f-4004-931c-d97a25c514a4", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777641914, "uuid": "7191106a-916b-4546-8d46-3868b29c8c09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641914, "uuid": "0df83e0b-791b-41c6-a2d0-e237f6619680", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e55b72-453e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777626890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777626890, "uuid": "cced6199-f827-471c-b90c-97f438075531", "comment": "Malware payload", "value": "91a599cfd650d3ef333c50b7de50eca0", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.cw", "colour": "#C0EAAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777626890, "uuid": "7912fd31-78e7-41a2-a294-4aaa01aafe17", "comment": "Malware payload", "value": "3d41180b98b1ccd9a6a1a1d971d84f609931c280223e9bed0952a8349b7439e5", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.cw", "colour": "#C0EAAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777626890, "uuid": "ca61a5b5-3bf1-465d-9bb2-b404551e27c7", "comment": "Malware payload", "value": "5dec0b4a106431b1cbdd6c4f899120105d0d2bf0", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.cw", "colour": "#C0EAAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777626890, "uuid": "c15a2058-2767-46b5-9f31-cc13b3df14a1", "comment": "Malware payload", "value": "bf585e3031442677e418a10daafb7c92cbd52381bc0c33f42d44ad3d62dab63c3e4c1691b9a20b6be0530c508d7b74eb", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.cw", "colour": "#C0EAAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777626890, "uuid": "e742ea63-c29d-496d-a8e8-4520d639be83", "value": "T11BC73335B5CB8A36D51C007AAE29FE6E06BD7E63033005E7E3E9BC6AC175CD15270A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777626890, "uuid": "0c13b1b1-592c-44d3-b234-701b9c0a9c9f", "value": "1572864:FYvq2MPudIkMUvHHfu9w/K7YuskJclPwAkZJrLcMEW:FYyZuakM+dKVsbPwAyJPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777626890, "uuid": "b1d7984d-ba24-435a-9750-258e550df2ff", "value": 54303744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777626890, "uuid": "e7dbccc5-fb8a-415c-b035-e550a4fdd53c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777626890, "uuid": "5e43ac5c-0e15-4c86-9843-ef9fb4bfad4f", "value": "Clash.Verge_2.4.2_x64-9806.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b153841-4582-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777656106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656106, "uuid": "e02d619d-57f1-4507-b05c-76066ea0c219", "comment": "Malware payload", "value": "2046bfe300e1f583a60dbafe218cf70e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656106, "uuid": "daae0776-ef77-41f4-9ed8-0099fb899ee7", "comment": "Malware payload", "value": "3e0a0f8e842fcadceb192851df32b8bfa708f255a03f80a8bd329f810673c519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656106, "uuid": "bf41758b-8226-4ffe-93a4-d1842e904f4d", "comment": "Malware payload", "value": "8444f950bf329494d8a41080ff69a117dd90701c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656106, "uuid": "6647d481-9f80-4988-8b51-f98caded9487", "comment": "Malware payload", "value": "d3ad849a60b49b0ae3f67e53bc8fd25ee7b3f79a3684b48a93e70e8122294fca1979a264a23d76461fa97feb0e0eeb86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656106, "uuid": "190e97c5-ac52-421c-866e-311834e087af", "value": "T1BB56C013B299253EE87B1A36483F9754983B7EA126924C0797F42A4CCF7E5401D3AB37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656106, "uuid": "d9725db3-eca2-482f-96ac-944a9d71d9ac", "value": "ebf9f50934ebfc138912ce0c5847005a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656106, "uuid": "105eace6-2a67-42ba-9f91-db02d32f9ddb", "value": "98304:lIS6/e7gju6UY3Q0YPEgRHTsm+MCvkBpeq/S:uSwUY3Q0YPppsm+MCMfeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777656106, "uuid": "1bf5978f-667e-4ea4-aa63-8e7cda6d962b", "value": 6036841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777656106, "uuid": "b3802326-cff3-4f35-a8ab-57b6623038d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656106, "uuid": "b4d20fb0-1248-4188-9ef3-b86147099a83", "value": "3e0a0f8e842fcadceb192851df32b8bfa708f255a03f80a8bd329f810673c519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9844256-457a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777652989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652989, "uuid": "13fd5e40-7e43-4dc1-82a8-27f507f6b7de", "comment": "Malware payload (Mirai)", "value": "17733d53014261e94773f075d2a838df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652989, "uuid": "1962910e-ada6-4683-ae33-cce0f10c4ec3", "comment": "Malware payload (Mirai)", "value": "3e386f28e91c3308cb16392e29be58f181da854c6cd63b45b45714bd4df0f34b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652989, "uuid": "76ec05d5-70b1-4533-80e1-7ec59b21d829", "comment": "Malware payload (Mirai)", "value": "67af31d83d244a0733d13b05d56956c736d43cf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652989, "uuid": "dc436b79-fe0d-4b46-864f-9247d6881cac", "comment": "Malware payload (Mirai)", "value": "7f685584995a0bb7969809ddf820be9ceefa2f11eeed2f80a631d9a447b4cc33f66b594e9848f47b5e8decb2a813e3b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652989, "uuid": "7d98c8e2-3ec5-4c79-95dc-2140a94e85e1", "value": "T12D53018A3CC1C7A0C07E313CFCEE3B4A5459F6BC5154868EAB5E14A7903AB0D916C67E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652989, "uuid": "6682f00c-65de-40b6-9c45-7679342fce54", "value": "1536:UHjkH+k8srS4rHi0GjZUjUpPGB9MoTkkuxUiSyZGnouy8Hyw:UwH+am4rA1UjSPGB9M0ucA2outH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652989, "uuid": "ae68f0b3-8039-4778-8bfe-776694f4a9bc", "value": 64960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652989, "uuid": "07de9b7a-6964-4f6c-8411-6801504cbd56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652989, "uuid": "a6e9af2b-b4fc-435c-92f9-7a241d2096ff", "value": "vaxbot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8768bb-454b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777632780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777632780, "uuid": "84b692d9-2f60-49f1-bac6-335b570b22b7", "comment": "Malware payload", "value": "d16487243f0c47e0812d6ed58cbb7e74", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777632780, "uuid": "ec808c8a-a79b-4635-8923-b5f3b5e1eb45", "comment": "Malware payload", "value": "3f0441ab40cdf30b9d145d5dbb9872fecd800a448ae9c242f4d834d072b5b44e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777632780, "uuid": "5d3d33b5-7d3e-4c45-b27e-a342d7c10c45", "comment": "Malware payload", "value": "ecd2435ac3f107cdc76e16599d6d21635a1276f9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777632780, "uuid": "8e36d0cd-7eff-49e8-9693-73a126c29554", "comment": "Malware payload", "value": "79b0efd0ef7a3cdb318739ce2ca8b82ad76f6d74418de29d530a3221a3e4f679a45e5fafca327580b3479bd0a3d4066c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777632780, "uuid": "a7f80bbb-3d59-408c-bef9-3db09608063d", "value": "T173968D07EC9155A5C0AAE6318A729293BA717C485B3123D73F90F7392F73BD06AB9740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777632780, "uuid": "df70847b-6142-417d-9160-5e916757db6a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777632780, "uuid": "1a0a080a-0c3b-4aca-8c1c-07d54ad2f3b3", "value": "98304:nUFtBMHqONe81qwktfpmv/wkVOUjNX0RAkZ3WZ5stHnE:nUFzMKONe8qZfpY/rVbjNkCcGkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777632780, "uuid": "60e28658-3ef0-43f2-b166-8c16aff0ae40", "value": 8744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777632780, "uuid": "c4918098-fee8-4f37-9608-d93e5d01d180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777632780, "uuid": "c3e058a6-0bee-4f6d-adf8-b9b843aefe3d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92d5713-452a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618575, "uuid": "1a11faad-33c5-4e0a-af50-2f7c6eb8481a", "comment": "Malware payload (Mirai)", "value": "7db27e6400b5fc6b8774572a70a616ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618575, "uuid": "aab0a5af-8802-4f54-a695-e98373b382a8", "comment": "Malware payload (Mirai)", "value": "3f13e18e190a7fc4c795d7caa83534d2879376ce43fd1a9120f23e48639cfe85", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618575, "uuid": "30d9413c-0cb4-43eb-bd12-640fa3baf0be", "comment": "Malware payload (Mirai)", "value": "e23e6b65684a78d87e6a319d56cbf23aa554f537", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618575, "uuid": "455a9272-6c75-4ba1-8977-95273c6fe290", "comment": "Malware payload (Mirai)", "value": "c578276972371f9694d5118577c53c674546a48b8cf09fb1c364475475200300f20fee280ad037aaec90071aa8760071", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618575, "uuid": "199afaff-4d81-4a43-bad0-481f6433461e", "value": "T190D32949B9919F12C5D722BAFA6E428933137BF9D3EA7102CC205F5437C699B0E77212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618575, "uuid": "0156f4ce-f25c-4512-b98f-95ab6c6834d5", "value": "3072:iKe9wxWf9BVrIaBHCMVKzTCpK+DeXwxr822a7E/R7+4Pm2C52m5SvR3HsL:Beqkf9BVRPVKz+pKVXwxrJ2a7E/R7+i0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618575, "uuid": "94e08eea-8768-43e3-9921-4a3c1608f56c", "value": 140256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618575, "uuid": "e2f7b64d-2de2-4a28-8102-588c3238536c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618575, "uuid": "f0e35b5b-580d-4168-ba6c-17c739016b48", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cff2e25-4585-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777657398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657398, "uuid": "6691aceb-8d18-4559-a881-f62ab60bdb4a", "comment": "Malware payload", "value": "16beda08072cb06c5e75a741018d927a", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657398, "uuid": "e686ade0-47bb-43ae-bd72-2633402c28c9", "comment": "Malware payload", "value": "3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657398, "uuid": "8b610f5b-a173-49e1-991c-4911957ed82a", "comment": "Malware payload", "value": "67399fe752d7946a31b630bbab600a15c1b0b89c", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657398, "uuid": "780c9ae2-bbf3-4914-84ff-7ef5cfc696f8", "comment": "Malware payload", "value": "77ca8a11ff63149f7a7c85b1e8651d4435f891d62021e7ef3eb783d8ba973a24d131e214161bd15d131c55d37b2841f9", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657398, "uuid": "b0eedb30-344f-4a28-bdf4-7be3c6d08db6", "value": "T16DD57C07689100F8C09AF73194F67A95FB35B80847393BE72B525EB02E7B7C09936B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657398, "uuid": "56c3f1bb-ae20-4b42-8391-ec90b7e128ba", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657398, "uuid": "d6089cc0-a43e-4757-83de-932c67ba3875", "value": "49152:5qwiMrDNBP8GpGKUVH4+G3Jw1OU7rg+GTeviOmQp:5XvzpBP3C0QghT4iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777657398, "uuid": "26695776-07d7-4b6d-b9e1-9fcabb197eae", "value": 2946776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777657398, "uuid": "dd745956-9508-46b5-8500-f347ea093672", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657398, "uuid": "0976ba42-2134-4e24-aa54-5efd323f51f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dafb125-456d-11f1-a769-42010a9c0008", "comment": "Malware payload (Panchan)", "timestamp": 1777647010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647010, "uuid": "7742ada3-0816-4c9d-afb5-28787648575e", "comment": "Malware payload (Panchan)", "value": "be871db016d834b6703d3e686da2797a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647010, "uuid": "053927a8-c5e1-41cd-9653-87bc69b26e59", "comment": "Malware payload (Panchan)", "value": "409ce2138c23d1cb005a420d568b77422dbfebf15049a9672be7e429fce20356", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647010, "uuid": "9b45ef86-636c-4b8a-a45d-c0a83b586949", "comment": "Malware payload (Panchan)", "value": "9096d187a9bb6e7200616b54752c836d49ea5552", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647010, "uuid": "70002954-9aca-46e1-8726-6192229f561d", "comment": "Malware payload (Panchan)", "value": "8ef5b70fa1eff2dd7227d1a365ad8e90fa77635ccdef8183b720753c514d0bd2b9ded7e699d7c36cf013ed876fcd6cfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777647010, "uuid": "415d1c73-ea63-4eaa-a462-e71ba4c5baf6", "value": "T1A1E69D73910638E9E5A98CB4D11425426DAC38875738A3C7BAC871F667FA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777647010, "uuid": "c22806f7-c3ae-4c09-a56c-b16a420e660a", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnak:sXyWSpV+Wu7rI3JEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777647010, "uuid": "f6c894e1-79b1-4571-9fa4-d754492d998b", "value": 14745600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777647010, "uuid": "a7e0aa99-6bd0-4ac1-8757-1f0ad11c2fba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777647010, "uuid": "97f8b36c-132e-46a5-8081-d7f90d2281c3", "value": "409ce2138c23d1cb005a420d568b77422dbfebf15049a9672be7e429fce20356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d37fce-458e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777661330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661330, "uuid": "12ddae0e-c85c-4130-9e05-431bb90fc7cd", "comment": "Malware payload", "value": "841866f628bff4bdcb58cdf1bca1b9ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661330, "uuid": "8e6fe8ea-e740-4503-ace3-2497bf8a1529", "comment": "Malware payload", "value": "416324ae92bcb9d70b3158ac745ca5302dbde1844e0f6d46a485adce13cf2702", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661330, "uuid": "67ff2885-c716-4868-aed4-60909618b64d", "comment": "Malware payload", "value": "09ffa527c0d4dddf2803a17ce1d5758b34ddcc86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661330, "uuid": "4863f3ce-9a74-4a45-a4cc-138f5ada0862", "comment": "Malware payload", "value": "7a8d843bf68f2f5f42799218a4e35f7bb41a3f4d0a6c2715d26246897ae99fc621b1cf4c40bf62c020b431036484f646", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661330, "uuid": "41d782d9-f75c-49ae-95d6-d022ff5e1315", "value": "T17F836B8BB24B5DA0C8524BF00BC75BDE2E2372119E1798F73C1D2A7919752DB5D0A3D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661330, "uuid": "6489a7a5-19fa-4695-b7af-8af1f0dfb23d", "value": "768:fg0pfl2f3+LZ3gQbHFIqTIXkVhk43mY92F9aKAOGhyFgaLpB554RZh7IfuL3mmx:fg0pflm+11b+IdVK+mYqPzGoFga+/LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777661330, "uuid": "b32b3cee-5c9d-40d7-b702-bebe1898710d", "value": 83476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777661330, "uuid": "8fe5661c-b4e6-4c35-bd72-263b8a6f5190", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661330, "uuid": "df28327b-ce7f-41d2-9cd5-aea2d607f2e6", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2224047b-45b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777676680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777676680, "uuid": "34b0eade-65aa-4273-a9a4-4e6e6d64af33", "comment": "Malware payload", "value": "6f9bf6403202860583cc80f73c08458b", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777676680, "uuid": "ebf2f4a4-abd4-4ae9-b044-8cbab0955510", "comment": "Malware payload", "value": "41bd075c007bbe6c331e596e2b844778ae5fdef1f813b363875fd63b13a941c3", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777676680, "uuid": "fd098625-7b5d-4f9e-93a0-f2f449a8b7f7", "comment": "Malware payload", "value": "5044360ed4f5c82e28a1e9ee30eef25de4098964", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777676680, "uuid": "803162a3-2741-476f-b0ec-9b73d71f13ec", "comment": "Malware payload", "value": "9f1060f554aa4e5b06d01c88617e8ea081ec4f00b2f4770214e6ede3203eb157a85b7c90bc37c95e22e76433c47b0f2e", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777676680, "uuid": "040b705c-2446-499d-a20d-bdb98a4582ea", "value": "T1D005D56BE953D4F8CC1A9AB46EF7943661B1B8CF0C142B5E07C1D2243EC28250BA958F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777676680, "uuid": "67f0628a-8d10-4904-9b20-df9ceb4adbd0", "value": "79b9112a5439938fbf2130bb6447113d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777676680, "uuid": "58451909-3ca9-43b9-b6ff-28f64e8a10e6", "value": "768:Y9NXvHHdY8Eto2FqAKRJqLPw7RliQTqEi5zD7pSfpUBhn:YT68EZ8HfqLw7RliQTqEiNpep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777676680, "uuid": "dc55582d-887c-434c-a466-044418e414dc", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777676680, "uuid": "f10de8ed-7c6d-4235-a393-2e9be98b2946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777676680, "uuid": "261e980c-d767-43a5-b8f2-21e8a0022395", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cbec40-4554-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1777636662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636662, "uuid": "451ccf34-00dd-4629-8929-dd31390075ef", "comment": "Malware payload (njrat)", "value": "58b659d29a25885b6530d97527eeb33a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636662, "uuid": "da3511b3-d127-4465-a035-9b63f6e623e9", "comment": "Malware payload (njrat)", "value": "457ee25c806d8b4cce736f18ac897bf464de671edef18df590220f87043f0638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636662, "uuid": "091bc53c-d141-4efb-8ec1-50db463291b7", "comment": "Malware payload (njrat)", "value": "546f6bcaf11bafa164c193f99dffaf86052a292f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636662, "uuid": "185fb95b-d356-4049-b1ac-231351d8d209", "comment": "Malware payload (njrat)", "value": "f2fc57d7efdbc6156e142bff69590b939db17cf51443e8526d63de6743a450cae0c1d285ef1b42c0b02c86459588c961", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636662, "uuid": "707f6815-50ae-4bae-bed3-a703263b78a0", "value": "T117150149228BCE02E8954FB41970E37557744E88E424C307DFFABDEF74A9AD269253C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636662, "uuid": "03757524-c167-4843-ae90-8dfc6be4c937", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636662, "uuid": "754ee1c6-1fe4-4eb0-9cd9-fd2017f48af9", "value": "24576:9SHfgywdagDyZfndmdAgDy+4gntByMoLDvO/Q:9SH4yw8gmlnseISgnTyXu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777636662, "uuid": "7bde75bf-b9a0-472c-b418-17e3ccd46da2", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777636662, "uuid": "c4fb3015-8b42-4305-a4fb-83c09ce0ef4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636662, "uuid": "45dc2f8b-48d3-43e5-8e67-fa7e080fabee", "value": "QT_368164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ea1b6e-456d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777647340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647340, "uuid": "788a6fc3-83af-45b1-a913-ba6ac84209cf", "comment": "Malware payload", "value": "3d97e6d90507cd5a9d0a3264f1814a2c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647340, "uuid": "6519a6d1-136f-4c3d-83b8-9b5e6a29f8a5", "comment": "Malware payload", "value": "47158b3f83846c028e0f1da35af21ee064417037e9b48d4ebf1070f44f3716d1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647340, "uuid": "74680705-1a47-490a-bb1c-8ddfd2dc3ff3", "comment": "Malware payload", "value": "fa31758ce57b06a52eb1192e05f150b7950399dc", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647340, "uuid": "adafaf2e-66cf-4ad7-9e50-e4a2272f8e2a", "comment": "Malware payload", "value": "736300e368816a2ee8cc2c8267a638fab100ba6587c0e80799fd9bf92cc4fc00b63d3287cbf695acaef23a3330b6b083", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777647340, "uuid": "2e4cf707-9eff-41b4-b49b-cd002824e1a3", "value": "T153B24B16BDC62E188BB25061ADFCA4CA731F578B13628CF9520F66BC95940E1F0DD9EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777647340, "uuid": "74f1ebdb-b758-4a74-b03c-3ed9a74a3588", "value": "384:NCZczarF34W/alxXKhTDoDEEKogR2WQtB4GGSmTDnXeC2IdHFMBNSD9PkB/:NC62rFI+alxXs3oIE4HQtBIXeXIdlPlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777647340, "uuid": "f7f18a17-4fce-44a1-bf84-f17972027dc3", "value": 25370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777647340, "uuid": "75567453-299b-48f1-9d58-02c438f8cc81", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777647340, "uuid": "7a4e0192-6fa4-40d6-82f3-cfcc9dab1f39", "value": "NOTIFI~1.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f38b827-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777635953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635953, "uuid": "9d1f8611-e4c8-4be0-b238-c8b63e53d568", "comment": "Malware payload (Mirai)", "value": "c09811c646fb3717d5aac05634bc7db8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635953, "uuid": "f10726e9-e73b-4009-b2cc-0a400e009e42", "comment": "Malware payload (Mirai)", "value": "481faa99627564c29ad50a7a24547a6ffcc84c4c2820f0135d4472672b79faaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635953, "uuid": "aa9ca22c-e167-41aa-ae48-3b4c86e90441", "comment": "Malware payload (Mirai)", "value": "0158fa03bd158e145340eb9722aa243db175ec34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635953, "uuid": "4f06c428-342f-4197-91f9-637c2d96e705", "comment": "Malware payload (Mirai)", "value": "8b8d4280e475c8130f5b2707a6ce426c427ed88da9a628a5f38ac8fc1e3872cebce5a868210c5e8162b8a787642bc7ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635953, "uuid": "4abb1ec0-3487-4430-86db-486a0bb98b51", "value": "T12D32C517A7BBAE1BC4D037770193072162E99F916024472FBD0D1C8E6E9A3412D3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635953, "uuid": "64c33601-6ff5-4942-b769-610dbba811d5", "value": "192:xvrOR1CQOsz1NxfAzFH9iG0GhWaDpU/O7Q89AGSybiqeif:xvrbCzfaF2GwIU/kwGSdUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777635953, "uuid": "97177fc8-5a75-407b-96f9-65bc2d08ad4e", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777635953, "uuid": "96f91e0b-c370-4153-bbea-91e745c78172", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635953, "uuid": "b6668eb4-e3ff-40ee-917a-5d3d78e1277b", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d214520f-4595-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777664520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664520, "uuid": "ef073338-c4a6-4d44-b852-ed0c59851baa", "comment": "Malware payload (Gafgyt)", "value": "c84765a915d21f20036bb814dd7bd678", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664520, "uuid": "04cdcb1d-a350-488c-aa4e-8035e64ceed3", "comment": "Malware payload (Gafgyt)", "value": "49b98e0ef80243d75bc93ed662d5b4dce00598428c926e3292cc7177b8030649", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664520, "uuid": "85fd0a14-97a0-404a-9b01-4b84a3bb71a7", "comment": "Malware payload (Gafgyt)", "value": "f7c531bc3b21b341ab54175d28a88bb592428968", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664520, "uuid": "3416604c-cf96-4a62-a1a2-9fe71fd82b33", "comment": "Malware payload (Gafgyt)", "value": "288cc46c88317596140b267cf5fbcb504fc01977caea32ec90686fac11046816d2fea1dab5a71a3f43cbb27e001b62a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664520, "uuid": "6ac557ee-b1ef-4783-af20-54c71f69113b", "value": "T1A9D2D0605144E035E2A21C71FFEE0D4D52C89D70AA8634B87E14569DB2FB086FEF6B27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664520, "uuid": "53b4337c-06f1-4f8f-ab86-c850846aea2d", "value": "768:f5ftYhbqB9OqkCa5pbWHggtr+B+bIA3UU:f5ftEi90FpCAAlbI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777664520, "uuid": "d70d46e5-2a57-4327-a74c-264368280725", "value": 29004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777664520, "uuid": "a91b0e87-4079-4ff2-a984-3b90bcf7263f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664520, "uuid": "c74b042b-4d09-472a-ae76-13e9651f3ba7", "value": "AV4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0f6e2b-458a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777659790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659790, "uuid": "7928cd6d-0ad0-4894-b14e-b70503f90c6d", "comment": "Malware payload (Mirai)", "value": "c4f273ed02eeeb1f92b766ef687717a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659790, "uuid": "518bab78-62b8-4d2a-a313-3a71b3c32fbf", "comment": "Malware payload (Mirai)", "value": "4b151344e399cba0f1ed1d25aacde5b8aa51f727cbc17007d4caa07788fc9a98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659790, "uuid": "dd058401-b443-43d6-99a5-986ea1ea0592", "comment": "Malware payload (Mirai)", "value": "2f157f7b5591919c27ca626e5ceb1149f3ec6e10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659790, "uuid": "3eacc2e5-0c90-4a40-a75e-bb6ce1ba2966", "comment": "Malware payload (Mirai)", "value": "c09160755561e92c122fc6c1ccaa561e9bd073fb9fa112bf9dc4524201bf2f95d416112b64f6e8744070ba31b48b289e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659790, "uuid": "d31c0056-0d28-4c18-ad62-46e6f97bda6b", "value": "T1FDB3AF87B1907ABEF0A49E3FC4135E26E6259F705583173D71BDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659790, "uuid": "b7d968d4-c0f6-4ec4-b334-b296e0b6e41b", "value": "1536:toOxCg+uUGWkCqYUqwaJ1XqfXg5AcS5blaZeCtjHXNLdCS2T15OvhSkzf8rSx:t1xKlGWnqTUcXgZS5gZ7CSXhS+USx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777659790, "uuid": "fcd7a6b9-521a-4bb9-89bf-339cf2f36765", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777659790, "uuid": "51da8189-e560-4ae2-82db-894271f20326", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659790, "uuid": "2614dfca-830a-4042-a71d-863c671afb39", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6c8e81-452a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618556, "uuid": "0325c41e-95e4-42f9-b751-9c0fc4ef1ff0", "comment": "Malware payload (Mirai)", "value": "c96db97d089f3c2d32f6fb064bbd9545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618556, "uuid": "2d3fbc2f-ceb0-4a6e-ae23-da6f1861f94b", "comment": "Malware payload (Mirai)", "value": "4b5d83e14947e40498a84eb34b2497ae81f7b955ec028c7ad71a27f89e4bf99d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618556, "uuid": "46388a5c-06be-4da4-a85b-a6b7e85013d3", "comment": "Malware payload (Mirai)", "value": "9a6d3d9dfbf26ac4242d28657bba941f43f6b257", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618556, "uuid": "9595abdd-8493-42fa-a9fe-d27995107aed", "comment": "Malware payload (Mirai)", "value": "f4258095ca6f14de120d091eab1c31970592c3bc53135272c35b438af0d98fcd5acab67fb0ad7668275a4a6dc0a90769", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618556, "uuid": "3aa522c1-8cc3-47da-a022-9ae7eab60d8d", "value": "T14563511E2E618FADFB6D873447B75E21F24863D212E2C640E15CE9015EA034E785FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618556, "uuid": "e15d154f-dabc-4a01-a396-097cd52596e5", "value": "1536:FqZqWtGWyu8jDZAavDMNYdDiwZwnRwbZn9:FGGWMlAvNYdDiwZoRwbZn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618556, "uuid": "6b1d9662-f218-4551-8b36-4c68226c02bb", "value": 68008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618556, "uuid": "82e2d602-57db-4e65-bf2d-142133a746a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618556, "uuid": "0484193a-5602-4fe4-a291-37d5fe7d1870", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb00e1ed-4579-11f1-a769-42010a9c0008", "comment": "Malware payload (Tofsee)", "timestamp": 1777652562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652562, "uuid": "97c68889-30aa-479a-9c28-45d51ee57821", "comment": "Malware payload (Tofsee)", "value": "3a5039b6c739fdded8e31979e5ce62f8", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652562, "uuid": "bdccc35d-fac4-42bd-98b0-d01ca528b18f", "comment": "Malware payload (Tofsee)", "value": "4c97342b249940826a58946bba3db12b91096de0631da7714d9cb98e2b1c7725", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652562, "uuid": "6c65cfac-6785-48d3-bed9-a86f349268a3", "comment": "Malware payload (Tofsee)", "value": "6298a082bb30b2f05ba0480a5b56a9f005f9c273", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652562, "uuid": "d93a0b4d-d1df-4f9a-9c08-71393abd4566", "comment": "Malware payload (Tofsee)", "value": "7da15c4758d0307bede41a7c823506a3fb21a5d89d8359d4b94bda11d71c598c776deb6c0234f93ae2303a5b058b0ee8", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652562, "uuid": "a02473d6-a5fc-46db-a2ce-1e6c50dbe931", "value": "T13AD60233B38E753EE06E4A365A72D210583B7A216D178D1AD7F4046CCF296A03E3B657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652562, "uuid": "65011959-5956-4bae-a42b-d447de980ba1", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652562, "uuid": "734798a1-34a7-4558-9bbd-3a0d41898bda", "value": "98304:KL8NcPWrjhnP5FJ9MPa8y0tCDo7CMEIhzaj3XaUiIWRzcwxMym:trnP5FJ9MPaoEIlhVajLxWRzTSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652562, "uuid": "a287e08e-34f8-48f9-9709-883fb57e5681", "value": 13704668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652562, "uuid": "f598d4bd-37c4-4ae8-b89d-c1d2e0bd522c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652562, "uuid": "a0eef725-3be6-4596-99ec-b86e22476326", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02073d4e-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653004, "uuid": "0e11a615-323f-4841-bf18-2824c4fc8fc5", "comment": "Malware payload (Mirai)", "value": "7daa14d02e1a85efc0d33fd2a0003643", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653004, "uuid": "cdaaa177-39de-483c-8775-f97a74ac8c88", "comment": "Malware payload (Mirai)", "value": "4e1aae017c0b7a56775aeef546630668aca1ec340dc0923a93e9d1cd15f052dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653004, "uuid": "15b2816f-3adb-420a-9e42-e65e529e0668", "comment": "Malware payload (Mirai)", "value": "daf76aba37d20ac116912e4d9bedcb43431049fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653004, "uuid": "cfd3260f-ee09-4b3b-a05d-6f2ab72ee731", "comment": "Malware payload (Mirai)", "value": "23e24cd90737bdc723f6d39f6cbb885519b41964d55688ae010d4e97093945ba40e5b72cd8615a0a471e4d18424b4d91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653004, "uuid": "d9738ff5-4c33-40c6-80c9-92ad28369129", "value": "T1954423226B1F1C0763C05835522AB2056DCD6AFF36D22E956A2E14B7CADD18D3CBE374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653004, "uuid": "6c2aafb7-f4c8-4967-a0b0-a48e981a4e29", "value": "6144:DbkbnWMG6VdhFCpTVuiaXfIN3H4giHn+o3HI8TIzo1/x:Dbia6HXCefINviHXTJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653004, "uuid": "071fac51-d919-4e6f-8bff-83e8f34a3220", "value": 257420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653004, "uuid": "b8ade02b-64cc-4c28-bccb-bdfa8a6897b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653004, "uuid": "0c3fcf51-80a0-4590-b74e-3d88b1fc218d", "value": "vaxbot.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e066c2b-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653078, "uuid": "5440c041-b177-4a7a-8930-b710fff6ac70", "comment": "Malware payload (Mirai)", "value": "ab6fc8f47e0716d7f46e959c03df940c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653078, "uuid": "7d57d1d6-570c-48cc-a9f0-e0bb60b02b64", "comment": "Malware payload (Mirai)", "value": "4e5d23cd9ccd8865a4ed0da8284382dcbdb9842e61b533319576629817f7b8a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653078, "uuid": "8eb43012-ead7-4b5f-abbc-cfe8cb1c9ccb", "comment": "Malware payload (Mirai)", "value": "48dd14eadfe2ffa44566d628e809363f42c74ac0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653078, "uuid": "15188ca0-efc6-4f97-8fbd-d7fd617a4e59", "comment": "Malware payload (Mirai)", "value": "a607c78bf7056e30691d2fae2817a193ba2cca973658cfbf71e0ba08162a362cb16d31a12212346d8334b66cf77c4da3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653078, "uuid": "1559133c-93f3-401d-8e19-115bb8a83cb8", "value": "T17CF34949F58BC5F1C90B89309066F7BF8B31B4294137D64EDF99AF36EA27581920B348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653078, "uuid": "02394308-e15e-4f4a-8a2c-42e17fa9d526", "value": "3072:pFQFvnEbXqig4QfJLrme3C+YgICZ8afdl3tzhIO4Az:WvnELqWSLrmol3ZhIO3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653078, "uuid": "4e0a4fcd-9633-45d1-94c5-89133148632e", "value": 166828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653078, "uuid": "4f7ea9e7-f941-410c-8603-549a35c2474b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653078, "uuid": "4c6198ea-ae0f-4870-966b-47285e73283b", "value": "vaxbot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6614e2-451f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777613749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777613749, "uuid": "c0116026-6974-4206-ad85-df4f9f1a1613", "comment": "Malware payload", "value": "8d987f9f9aea5c3df2d0e796b615fab8", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777613749, "uuid": "539a8300-05ed-4c75-bcaf-e4a9416e6d6b", "comment": "Malware payload", "value": "4e66ae8012fbe9a50b7276da529f6e23bdd484ed0c19a4b77ee3a6564634e0bd", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777613749, "uuid": "7f8bda83-3f17-4da5-9c15-77329be412ec", "comment": "Malware payload", "value": "f2811b208f625d92cd16f107ee3a8c06c369b5cd", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777613749, "uuid": "f5c43f5a-4296-413e-89a6-c2635bb6ed9e", "comment": "Malware payload", "value": "a35bcfb0a8bfefb05d1a63114a54bab72364372be4dac44ee84a93500e1e66c748f8598f2e971bff8fb7144148143e80", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777613749, "uuid": "14e436e8-761b-4833-8c87-97a19a0b8191", "value": "T180C57D4A7791547CC2DAB13356A5B260AB33B45C0F2067E31B52AB753D3BBE2093178B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777613749, "uuid": "768e8eaf-8516-4a4e-99b9-4de51bc15a41", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777613749, "uuid": "65b891fe-35c4-4399-b05a-44f395ef984a", "value": "49152:mTDoTeSs+S3mKpXjc5lXCM7VzASoodnnyi4E4s2FsOuBzKCAHkD+E7XlW8ovdJCh:UT+S3mKpXjc5lXC8VzASoodnnyi4E4sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777613749, "uuid": "715e9315-1237-4f3a-a255-7226ef543f69", "value": 2589864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777613749, "uuid": "b5c0b929-cafd-495f-a044-a8bab5b65f7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777613749, "uuid": "ae3e8900-fbda-4ec6-bccb-ab6fae8e152f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1574c543-4517-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777610087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777610087, "uuid": "8131db8c-40ca-49fe-a9e0-9282f192a8ed", "comment": "Malware payload", "value": "1d6577a80f1ec6ee40df87f8cb83c96d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777610087, "uuid": "399004f4-a6ce-4957-9b3f-3582883f9858", "comment": "Malware payload", "value": "4eee3d7e18de46f1b9c2edaab24af455b8778dbdd61a1244b830204178cc3239", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777610087, "uuid": "533e1e91-6cd8-4f11-bf73-08b594e7f69e", "comment": "Malware payload", "value": "a1ba988d14e915606870cdcdf642e156f6355f44", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777610087, "uuid": "67f5d00c-8d3a-48a7-bcc3-605e131e8f9e", "comment": "Malware payload", "value": "9216718d105f0bad97eaca6b335efe6f70e10aeaf0114af701851f93c9cb4b5971596b91ff7fa4d012b8d1022aca0536", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777610087, "uuid": "34fa44dc-694c-4461-aee1-d5f3e0c13b63", "value": "T108C0C0600001452C43126045CA708FC4437930A4B5128111FE705ECC82D03701600258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777610087, "uuid": "0691ec83-a3d0-40d3-9771-27233ad78d74", "value": "3:VSJJFILqt4ySF+XXxjBhPeM+nGfALtGTPh9JewMhHLNKwoxGKyOGYmKLAMH:s8Fy2GxjbP/+GMGzJ0RLNKwOrzyK0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777610087, "uuid": "2a31377d-5c55-46fd-ad62-b3c6403af1d0", "value": 167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777610087, "uuid": "d939bb93-327c-4d26-ba0d-2d54e82d6ac3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777610087, "uuid": "f30dd34a-dd1e-461b-bd97-a5e8f16ed747", "value": "a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f232feab-4549-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777631932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631932, "uuid": "91ca3571-6d43-47d7-9570-1f1f4b0d2535", "comment": "Malware payload (Phorpiex)", "value": "aac9242d6eb1ab6df7e5ec909e6d4e2a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631932, "uuid": "6d03be67-ca1c-4758-8240-52e8a890f527", "comment": "Malware payload (Phorpiex)", "value": "4ef867a958a45fa8a8f570d0c8dc8385198623c29289b09c3d37412e873c22f3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631932, "uuid": "d1dd9409-fb2e-4f2d-8679-fe285bca6947", "comment": "Malware payload (Phorpiex)", "value": "81eca799775e081a7fbf5e82eb3951165a617f33", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631932, "uuid": "20a96882-deed-4158-b922-81dac3b24223", "comment": "Malware payload (Phorpiex)", "value": "2079f8b48d8111dd51d3eed13a5cb3300e09f1b88de89dde4e2273c1b47e562dc7a50d493e852f95a6f387db64ee069d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631932, "uuid": "e54c9569-a600-4240-baf3-2a6cb9c2a7a9", "value": "T12B824B0FB946421AD0D100749636867BDAB998B637C814EBFBD08AED1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631932, "uuid": "26fb2deb-72ea-44c9-b7ce-de1236f057ef", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631932, "uuid": "bff984a4-5a50-4e04-bed9-9b0633985f0a", "value": "384:1I7MVGASM1KwLgSZb7u9NHu/gRhav8U9cU:eQgUb69Jha0UL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777631932, "uuid": "c7f7a74e-d857-4f79-8b86-c7c4b7a0c402", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777631932, "uuid": "cf18c786-44d9-491a-ac6b-13a1088361e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631932, "uuid": "1758eb10-1bfc-47e8-8644-35bca6414cdc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32414713-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653085, "uuid": "fcdb4d3c-c787-48bb-8d84-c3fc25aa9375", "comment": "Malware payload (Mirai)", "value": "7483723776e8ec096d3c9bd4fdc94a40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653085, "uuid": "d4f79e86-28ea-4f25-aee9-cd3baeafb6b3", "comment": "Malware payload (Mirai)", "value": "509c0abc3fda8965d7da9eb1adfa37570e4bed96b585bb3bd3c8dcdaa043dc68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653085, "uuid": "5447cc52-cb1f-40a1-894a-0330d09c4800", "comment": "Malware payload (Mirai)", "value": "e66cb2fa85f4ffe62d9d23daed508eb8354a4064", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653085, "uuid": "b7a0ec93-5801-4323-a6e9-b1c3d1b3af48", "comment": "Malware payload (Mirai)", "value": "e3489564ad01bd3bcdd28b2c17c2d603b399ad7da07ccbcaea805387c45c028b6f62cf70be07daedc2db22ef7686f8d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653085, "uuid": "b06b8349-b3cb-497b-a2a3-6adfb9f8955c", "value": "T13E44C80E6F228F7DF7A887345BB79E24975923D717E1D584D1ACC2101F2029E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653085, "uuid": "592a03fb-f02c-484f-8cf1-dc78c778e604", "value": "6144:f7JBe6+P/V2ZE1NeiPkd8Mf8qWtiP2UVgPKS4GvUNntFlIYrLDIPV37eHCWiQYdJ:jH6lL4CNJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653085, "uuid": "a688962f-b609-43c1-b39b-44edbe5f53af", "value": 257372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653085, "uuid": "382339e6-7c99-4d6d-a608-053d2cbf7250", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653085, "uuid": "bb66906d-eb16-4a42-893f-795eac6d5222", "value": "vaxbot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0d4e03-4561-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777641936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641936, "uuid": "247721d4-63e2-4eac-aa74-1cb9aa4e693c", "comment": "Malware payload (ValleyRAT)", "value": "a460d65bcdaaa7b408c92dfd1be21f92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641936, "uuid": "2927c964-3414-4d44-bba8-7272be0fbd8b", "comment": "Malware payload (ValleyRAT)", "value": "50e1bc3d59884046353c8ed3287336ea31a4be38c25e318de0b2065a05ee3212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641936, "uuid": "5ba1de21-57c8-4efa-a28e-0f37ce794458", "comment": "Malware payload (ValleyRAT)", "value": "31b1ec6441ac40a83377a2231876c3fafdd1bd88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641936, "uuid": "62838c88-27e6-4a41-a64c-c50f9f77c0d4", "comment": "Malware payload (ValleyRAT)", "value": "4ad7e966c3b1bb396eb4627c390add88929052fc8d3147ac665cc50dff23fa9a40f32bbba2aba933f9836e3719d2f33f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641936, "uuid": "d8f63126-6903-4669-844c-1847a8042085", "value": "T10736234DF79A48F8E86771704A625903E77A784D5B318ACF239C56863F332608D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641936, "uuid": "babaf461-6479-49c1-ae2c-b423a4551470", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641936, "uuid": "0f0d639d-9895-4fb5-b440-3f5de529896d", "value": "98304:XzacUeiPbZ2muV9S7owK5BoiQ0NbWiv2fjUidSRIBS5wphrO06S5wJv:XzacUeiPd4VTwcpQmbSIRI8KtO0HOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777641936, "uuid": "73b75eb6-1152-41ee-aa3f-5b5eb15a2caf", "value": 5261978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777641936, "uuid": "160a5419-29ca-4bdb-bac8-1b85af254a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641936, "uuid": "4dd51546-8a96-4c93-a225-b472c4726348", "value": "50e1bc3d59884046353c8ed3287336ea31a4be38c25e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2144ba01-459f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777668518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668518, "uuid": "70905b13-6b89-46e8-abc0-2c34e764a20b", "comment": "Malware payload", "value": "4a8628d6cbbd44e59ca874fa4c79ab54", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668518, "uuid": "c5b55fe8-6c5e-4c08-b842-0b15e6e434cb", "comment": "Malware payload", "value": "517b97394fdb1c1bdc8703d28e018f254f062abf63384800f864b3325db06fa4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668518, "uuid": "459e29c8-5041-4f18-b043-c27604134b84", "comment": "Malware payload", "value": "744e8a76a00f90531532c98840a57cb515b80bbe", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668518, "uuid": "a3412aff-7ce9-41bb-a525-c6f8ea08a32d", "comment": "Malware payload", "value": "10a2296e309571a5b560b74229b9e11b7795375448812578874a6442a32c9a5d34ac68ae5c150c1b1978c1d1ef8ec0ff", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777668518, "uuid": "ede4dddb-2584-415b-8795-07c5fac0b09e", "value": "T13F039D46B6409332CA464B305A9BC7D84BB69C19AF5325023A9BB35C1D7BBD425FBCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777668518, "uuid": "5a800fb2-4da4-4127-869e-913280b9a045", "value": "768:xt7EGrEYhGbAQGOBXm5ZfoV+zceWMbCpMxN/nq:0GrEYhGh0VfcobC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777668518, "uuid": "d396286d-77a5-4b56-8e78-8e93caf2b1d7", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777668518, "uuid": "45e9f7a2-fa1e-485a-9924-633813300b84", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777668518, "uuid": "d02fa792-f43d-4a28-9da6-22513cc1faf8", "value": "nssm.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f73db5-44fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777598001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777598001, "uuid": "1d9ee127-1157-4cda-b320-916e8aee1df7", "comment": "Malware payload", "value": "c1d25c19baaa4bedd3d1c8100a3f484b", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777598001, "uuid": "c1d17aba-c2c1-4653-a550-f86ee5e804c5", "comment": "Malware payload", "value": "528a7f00dfce09a6634bf41d8af083f8c8d2b35357d40f50325d4e8c46fcd3a8", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777598001, "uuid": "7071985a-70fe-4790-bfb8-c34e66a30e45", "comment": "Malware payload", "value": "b7336493574dae7f51bf3b8716d5b3ecf7d1956d", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777598001, "uuid": "7077620a-f55e-4cc4-acce-226bbec09573", "comment": "Malware payload", "value": "fbbf808f93fe778cc66101a7253a02e022642e11826e81a05f16de6fb109b9f396db4b15cb2e267e460e5a359a74bc51", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777598001, "uuid": "022b5ffe-9b39-46de-ae44-96010aab3c97", "value": "T1988501DC13B51E12C21E3BB4D8A26F6C773D67C15F2387AB51728BA85F00AE975221D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777598001, "uuid": "1c5b5eb1-e23e-4730-ba6d-0b08dda232d3", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777598001, "uuid": "2145a1cc-52b6-4910-ae54-d1d53b22e30b", "value": "49152:Uj7ARv6QGOYlDNfpomGbHkFqJUeHBz3eYfSwhk0ppm:y+v6GYlDFGQ0UehaSpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777598001, "uuid": "5bb0288c-c4fa-44c0-97bc-9558723facd0", "value": 1802240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777598001, "uuid": "4d8b3ef5-9ede-4c69-a751-d7092153ff02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777598001, "uuid": "3bb13ea4-cdd0-4d00-879d-574183b3926c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca84dd9-4587-11f1-a769-42010a9c0008", "comment": "Malware payload (LimeRAT)", "timestamp": 1777658337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658337, "uuid": "ee753825-d866-4a20-8705-e955d98ceb2a", "comment": "Malware payload (LimeRAT)", "value": "e1a4aca8b6ecdf050eda66ef23fbdba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658337, "uuid": "9129c011-1206-4d05-9382-7be5999600ef", "comment": "Malware payload (LimeRAT)", "value": "530c04796fc67bbc79c7685ab50bf7f3c26946952afcb83bb077814bc782f0ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658337, "uuid": "f5722d73-abb3-4959-b601-0e40629fbfb1", "comment": "Malware payload (LimeRAT)", "value": "cabb2dd1bd5fb4b7c6ab733588516cb80f6b661f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658337, "uuid": "bc1fb143-f4af-44e6-a726-ca4850fc3c96", "comment": "Malware payload (LimeRAT)", "value": "8a37b9fc2388036b7411fc6b2913b2355b06acac8e3085db17ba49b69f8b4aff8e319199afca30a7f488b33d20e70f2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658337, "uuid": "b3bbba0a-6fd6-4449-b042-182c24a9c81c", "value": "T13F846D2437D0F01EC68D59B28F86F0B816703D5A6E568A6639CCB3DF39BED904978361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658337, "uuid": "eaf6c836-46ff-4e4c-87ab-a4c076e191e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658337, "uuid": "4b8fca04-f066-4f1a-8bff-c7792e53c6af", "value": "768:JNbkpTizCQeM7B6Jzk5NrEx1WYSUugGwog1s3xg//L//////////y//////////K:JNCTizCQfwJY0uauxwo4uxg/uS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777658337, "uuid": "9f0a868d-670d-4583-9b03-3863ff481309", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777658337, "uuid": "5c76fdcb-8958-42c4-bf3f-1df6f5e369b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658337, "uuid": "7447dc60-9928-4bd6-b1f9-c4e835186787", "value": "cec.co.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54b26a9-456d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777647345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647345, "uuid": "5424dde7-e495-47a1-bc70-4430dbb359e8", "comment": "Malware payload", "value": "ff5bbde389b7b7fc1502a65c992c2f5c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647345, "uuid": "17fe811f-1080-48d5-96ed-2bfbf6dc81a5", "comment": "Malware payload", "value": "530d9ed2b62d1bfc5fdb39938e26d059cddfb65e0f7ae6df4ab971a15829e63c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647345, "uuid": "8b3bae89-000f-410a-ae82-c4d81ff70b20", "comment": "Malware payload", "value": "9e73761636b6d2a6ef2d194aa11956f776da052b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647345, "uuid": "430ae501-5384-469c-af8c-71f12b7ecc3b", "comment": "Malware payload", "value": "d8a2f2efcec4f525355a9c786da64876c5ca6dd19069f0051e8a27ec0d230b9d615157e02149510ff89e18dd59206cd0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777647345, "uuid": "aaff7129-5b6e-4690-997b-b5abb3f09177", "value": "T1192187D3161045312BA58E0EE0D57688E27A7D63D283FD3438DF6A105BEF86BE209276", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777647345, "uuid": "738116e1-cba8-4dfd-8e45-9740a8a99833", "value": "24:v1Svl4erIKk3yIFydWs+X3gv7ZTPpaWFZMu8OydO:tS9hIGWNngDZThRHMVOCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777647345, "uuid": "d899e27a-71e5-475d-93ff-629bce04c3d4", "value": 1138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777647345, "uuid": "56b62983-7e98-48c7-a621-13eb72d2897a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777647345, "uuid": "e9c8af49-3f4a-4747-bee1-d72f6ec8e342", "value": "kamru.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77337b2-45b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777679991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679991, "uuid": "b808c143-7d56-4796-8373-4f0066d823d8", "comment": "Malware payload (Mirai)", "value": "766209e1c32fc55d00a76b8aa6705320", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679991, "uuid": "524a5476-3e78-4f0d-93c2-4f96aa01b29e", "comment": "Malware payload (Mirai)", "value": "53652765bebe40940b95da18614076723d30be83ca27b1dda941b3e4de27b496", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679991, "uuid": "b18c4ed3-fe73-4a29-ba8e-4fc306e2b48c", "comment": "Malware payload (Mirai)", "value": "b1a14fe5c89fc75084373febdd9e318d257a0118", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679991, "uuid": "e7c92d43-2bf4-4ac5-afef-016b030b8b37", "comment": "Malware payload (Mirai)", "value": "e043fe5dacb39304dfe35cdb797ca36fa3f57e24790a90a05639f739a0cd93c24ad32b82c18746be0dc7ec8d6a92772a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679991, "uuid": "0ca4cac9-cc52-4ecf-b102-da67792a5e86", "value": "T1D5E34A17B5C184FDC4DAC1788BABB53BDD32B1AD1238B19B27C4AB221D4DE201F6D985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679991, "uuid": "b1ee5995-1d3f-417a-b5e7-02651680c86a", "value": "3072:YWDgeOBJrHxS7U5iL29DEYVyaRDtdhcN/YhnpBElrtHlZYQS:YWUeOBJrHxS7UfpZ+ga7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777679991, "uuid": "0216a973-5b9f-425e-accb-166d336e55fd", "value": 156184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777679991, "uuid": "213cb74c-8bda-42bc-9927-8fced8cb0067", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679991, "uuid": "0cca86e2-ac17-453b-b6db-fe94bf92ac70", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45469ae1-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653117, "uuid": "03699d34-ed55-4ab1-bcad-fc68fc44e18c", "comment": "Malware payload (Mirai)", "value": "8bc21aec995ff23d94c0a8b7e16b4448", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653117, "uuid": "3c698337-88ee-4cec-bfa1-d06945dc3aa2", "comment": "Malware payload (Mirai)", "value": "53a948efb36610386f2f9dbee91435d89348bae91dcd465a63fa7d4f9b74b078", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653117, "uuid": "553cec36-d603-4fc7-bda6-4c98f7fa22a2", "comment": "Malware payload (Mirai)", "value": "7cd808635a03b85a2cb8a7633a7c43a7e2c2e527", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653117, "uuid": "0a1ac0f0-ea84-47e1-9a71-842c78bedec6", "comment": "Malware payload (Mirai)", "value": "1bf5b10964238ace571b1e23f308a4eb8f1da8db519ec7b561fe4d1c629b9126dccd1824ca51a62c98bdbd9cfb5d26ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653117, "uuid": "89b4abe8-91fc-4a52-8d1a-5fc97f537025", "value": "T1F444E70AABA10EFBE8AFCD3706E9170524CC651722A87F367674C514F54B28F5AE3D24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653117, "uuid": "528bf8df-1ba7-485b-965d-a358bc03f0f3", "value": "6144:lvg3ibn7DdjroAvwr3BeUYo+GE+9wxTB:lvgsZi+U98T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653117, "uuid": "661ebaaf-57ad-4e93-bf9d-3900b2ae56b7", "value": 263068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653117, "uuid": "a74a5cac-2cb7-4f80-b115-940c0ebb04c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653117, "uuid": "cc289ec0-177d-4b0d-8016-d7cf1644e17a", "value": "vaxbot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509b31ee-4583-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777656572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656572, "uuid": "4c5f4479-90d4-4221-855f-50cb1565acaa", "comment": "Malware payload (Mirai)", "value": "675aa5ef1b8d5f4094a623b5ce915b85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656572, "uuid": "a5ce712c-5b30-4cad-84ec-f04870287a57", "comment": "Malware payload (Mirai)", "value": "54b62ca3b7fc78f10ae01d031384b13db1c063863068a8e14b4d28ec47e7d797", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656572, "uuid": "84094180-0273-4bad-a1d6-52b89b035380", "comment": "Malware payload (Mirai)", "value": "06ddeaee863a9c9251d7974b891955fde4992b17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656572, "uuid": "680aa421-92eb-46ce-a770-9d9dfd02aaed", "comment": "Malware payload (Mirai)", "value": "fbc7343eb1c6dec76b60fb4a1381172564f3c6c6c801552b38c6696f41ea24ff18b74e16e9142f07f33860fab8446316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656572, "uuid": "bca85714-d680-405f-a642-e051ab6beee3", "value": "T1DED3CF32E0086DA0DD2116B4347659BC0340DEB40BD59243EFBEE5AE28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656572, "uuid": "2872c8ba-5def-473d-80ce-9c7c51b647a8", "value": "3072:kNulV+GOAc3YSmDEjdX/VuHVv3WDRGGRhaUNZkP0Zsa:yulo2ubIVv3sXL5NZmOsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777656572, "uuid": "55d030d6-c754-4218-9db3-7388b6dc3ed6", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777656572, "uuid": "f399fb28-41b6-48ae-8f9d-d61a8290d612", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656572, "uuid": "4c154714-81fd-4585-b66a-88d8c5b98f7c", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9d25e4-458a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777659786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659786, "uuid": "d4705297-3017-45bc-a4df-6f7c59e19c8d", "comment": "Malware payload (Mirai)", "value": "87e19e55afffa13ac7bab49ec09b1608", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659786, "uuid": "59a728c8-7814-4dc7-acb0-389906d7eca4", "comment": "Malware payload (Mirai)", "value": "54c7010886e435f14b64ba9398aa54833f726c5b3b8100c12c6847bbaba97ee7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659786, "uuid": "ef8fe9ff-72c9-491e-8618-22702afa6cec", "comment": "Malware payload (Mirai)", "value": "fc08277a249050305cb6c21a6b7141fbf524b913", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659786, "uuid": "b02236c7-78bf-46ae-b53f-932ab35b1dbe", "comment": "Malware payload (Mirai)", "value": "3804c16101b3ba5e791bc5f00845e00cf2ea3e5fdf52635ecfaadbf1169a157e5f2e043d336cfefb61fca6bf54728348", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659786, "uuid": "4689abf0-a016-4dab-9e8e-1423962f9018", "value": "T1E204392F258192F0F6411B746BCBD3976C390BBF41A9909F6B416329B6E0B7BA02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659786, "uuid": "7bd78425-405a-4651-96e3-4f1159d2b006", "value": "3072:7mflblbBDfvNUZem/LVA7bGQU66gOVNLddnNgRdgJi55wtUX9:7IJ5k1DVA2nDXNgEJi5a+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777659786, "uuid": "2d826ba9-728a-4f41-a0bf-38c122163902", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777659786, "uuid": "ab22a799-3b85-4857-b4b5-a406ee7ec2a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659786, "uuid": "60f1b3de-0bbf-4d1a-b795-afe8bf554f07", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9454a8-45b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777676671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777676671, "uuid": "4fee2dd0-6c9c-4de2-afdf-8ce6c14496bc", "comment": "Malware payload", "value": "a6e12cbda351513ebe4683a3d5e0b087", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777676671, "uuid": "7606e6ee-d3fe-454a-a36e-a00d54e2a9ca", "comment": "Malware payload", "value": "582f0648d432415a9eda4be038a588dbbe4a74bdb805861105ee66f2b9a1d610", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777676671, "uuid": "5367ecb9-105f-4ce6-a639-49f2ecd18f3c", "comment": "Malware payload", "value": "a87d422b750705a20e9267bc97bb04c106ae5d34", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777676671, "uuid": "c5f0795f-4bfd-4db5-87e5-e4ce2049929f", "comment": "Malware payload", "value": "01c69b342a5433bb5da886015e2c80d0edbc57592ad6e93785dbcaa0e6c408bbaec6d2193e8a61923595fe2172ed4eeb", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777676671, "uuid": "3485e7d9-a346-49bf-bd23-ceab5cd18c78", "value": "T1A274F19B93A530F5E07B867885661A09DBB57C7207609FAF07E4624A1F33AD44D3EF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777676671, "uuid": "3929376c-185c-475d-9dd4-82a4d4a9f65d", "value": "52e22ea505f6969a3016234a59104c9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777676671, "uuid": "3b60d91e-0c95-4598-9901-7c9143de849f", "value": "6144:okk63mnDDW+7XNzydii/6LixYvDLageXNDAuhYSSGI8ilDkBjmDFq4:okktvW+bYV/64KLved32SS9lDkBiDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777676671, "uuid": "caf9b595-d8c8-4a74-b015-7a62df70b506", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777676671, "uuid": "0b1b7bd6-0d4c-479f-bd0a-05578d724f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777676671, "uuid": "b857f2c6-9642-4722-abc6-7ebe859afe1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e41a36-4557-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777637870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777637870, "uuid": "77100f50-28df-4193-ac97-b1657c284346", "comment": "Malware payload", "value": "bfc673eac7b64adcbff96e3540cf2e76", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777637870, "uuid": "11cf8d97-e836-44c6-9ab2-363d002119f3", "comment": "Malware payload", "value": "587248ce91e1596a000a46720e7326863f43680eab53c1a1aefc55e4be0c01d4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777637870, "uuid": "70e6ecfe-b7f3-4e5f-842c-5dba106bf452", "comment": "Malware payload", "value": "4b65790f4c502ebd9ac6e92634578bf33903ebad", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777637870, "uuid": "76a78116-f0e0-47b4-9de9-20a2fdc54aeb", "comment": "Malware payload", "value": "1db56ad11c6dae04773e260e9b690c89e7cebcb93804f1c1f74d731c78700ea0873bd576c773abb9c781e0a5fabbe687", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777637870, "uuid": "0485b7dc-659d-471a-8aea-a519e4a16bae", "value": "T156136D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C15A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777637870, "uuid": "b7324d65-045d-4b90-a52a-584fa3376439", "value": "768:bZs9NyXsZztCy9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bOHusZmcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777637870, "uuid": "3430f5e1-7cba-432f-a785-fbca4d975e39", "value": 45421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777637870, "uuid": "7beec6e6-21b2-49f4-84d0-634c925bbb36", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777637870, "uuid": "17af7103-4a68-4e3e-bac6-ff0f6f97bdd2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5667e19-4570-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777648688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648688, "uuid": "705830ae-83ef-4dbf-bac1-098b04d888b2", "comment": "Malware payload", "value": "786de86dbb199b7714c3fbba02de8299", "object_relation": "md5", "Tag": [ { "name": "comples-biz", "colour": "#201400", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648688, "uuid": "e741629e-96f2-4d91-b1ee-737b4ff5e828", "comment": "Malware payload", "value": "5a08dc997da87d4695bbe37f0047f80f4f9809c520c68d6620ec23d41a8d9a2d", "object_relation": "sha256", "Tag": [ { "name": "comples-biz", "colour": "#201400", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648688, "uuid": "82f11f62-172f-4151-a840-071909812bb3", "comment": "Malware payload", "value": "77f83569e6ee0ff62b6f2d0a3c8f383e996b680d", "object_relation": "sha1", "Tag": [ { "name": "comples-biz", "colour": "#201400", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648688, "uuid": "c948f559-9525-452a-b7b5-8f4577ad7e34", "comment": "Malware payload", "value": "2434436d2afd6be4242dec47f97427714bd779875fc9a5065b75ca1ad20743928423bb26f7d31e140ad4ef378e13f9e1", "object_relation": "sha3-384", "Tag": [ { "name": "comples-biz", "colour": "#201400", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648688, "uuid": "5d06383b-ef37-4f8f-8457-0e5f23a7ada2", "value": "T1ABB5494378A540B8D4D5F631E4F4B2A5AB21B44C573877E32B12AFF42D7A3C04A36B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648688, "uuid": "d09c6c74-f40e-4ed1-a492-e60980494729", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648688, "uuid": "f8433cbd-1727-4fe5-8d9a-b64bd4a39324", "value": "49152:6U5y4ilz4S2C03yMN3iaHzVHgmSjc54rGiBzwehSBbT98lOQV/geznOkSMEA32uI:6+Sx03/N3iaHBHgmSjc54rpBzwehSBb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777648688, "uuid": "8fc59fbc-1c9f-48ed-be4c-ebef0b8ca65b", "value": 2480808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777648688, "uuid": "a3fe5bc2-032c-4504-ae51-1c9e68c9c069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648688, "uuid": "f2028678-8c29-4476-bb1e-42569cf72fe6", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20db32a2-450a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777604522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604522, "uuid": "c020e3c5-7af4-4dab-ab22-bee290f22d76", "comment": "Malware payload (Mirai)", "value": "b72c32eeb770867dded50a109efca902", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604522, "uuid": "3a3af26d-3759-4f4e-9a75-89d2fa4384bb", "comment": "Malware payload (Mirai)", "value": "5aac352c27adaff57d00941b80eaf379a271f37102345f0574b945111d244697", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604522, "uuid": "c998869f-4444-4088-980c-0112eec3aa27", "comment": "Malware payload (Mirai)", "value": "ff383cf745ee688441958816f445949fdc5a90f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604522, "uuid": "279c6099-3ea2-4719-8ef7-1694a2aec76d", "comment": "Malware payload (Mirai)", "value": "5c9d0447e8b29a7ed6a961aed1e0d5769a7ccb3043942cee857e46c6507fa86458c0ca5f17f0d09f5f3c62ad0f931d3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604522, "uuid": "def86932-63a3-4673-8cac-4b3c062e3db7", "value": "T1F5336C42B31C0917D0935EB0343F1FD18BAEEED122E4F6856A9F8B56843AE731549E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604522, "uuid": "42f1109e-38f2-474a-9584-c1bb02cc144e", "value": "768:o2uRah459CZuFImqSxAI+nrZGemikfvx6JPIRbtnwbZ010U59C:sz9K0ImzIVmiasPIFtwb+10m9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777604522, "uuid": "074453d0-ce14-4a80-af12-3f102305b060", "value": 52640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777604522, "uuid": "b132d4be-7b20-499f-9120-0bfd7355a5f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604522, "uuid": "7b83c3e2-0841-42bb-8732-d4b1a633338c", "value": "botx.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264230a1-45b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777679264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679264, "uuid": "29db46d4-02cf-4b59-8fc6-777826e9053f", "comment": "Malware payload", "value": "4239c0ad11de47a01e533cd587af87f8", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679264, "uuid": "34f748fa-b3cf-4af8-8883-d972b498b58e", "comment": "Malware payload", "value": "5af4d0b73f3b43f8d1f91eb49eb27b85dbb9aab5fbf3e334e5268180d468ab1b", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679264, "uuid": "8084ac9d-4638-4dcf-a6e6-5a567eb4b893", "comment": "Malware payload", "value": "b8ee0b5afed4b1a0be0cf600a5144149d421d4d3", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679264, "uuid": "94948e56-5221-47a4-8320-db4e86828842", "comment": "Malware payload", "value": "498d2db31d82d53a1e709eb0dac84962ede7825c04577842d42683ff2a9cbb345a368f9d28d0ed2571db35621902afe2", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679264, "uuid": "459704ff-5248-4904-a73d-75cab3bed524", "value": "T152653A1BBCA409FAD0AA533288775191BBB2BC450F3117E73A60B3782F726D49E75784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679264, "uuid": "a1b29dce-a15d-457f-8c4f-a0caaf827e3e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679264, "uuid": "47eb5b47-d206-4be4-bc3e-92ed13ec540e", "value": "24576:RaV0vBthnksTAofdF05pF6Q/NBele5zK2I/LD6eIRI:RamJtFkCfQ5pRGnvIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777679264, "uuid": "34a31369-e521-462c-8377-00e97bd22dd9", "value": 1538560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777679264, "uuid": "fe3910ce-2d98-4ba2-b3b8-3425651a0bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679264, "uuid": "edd5a328-0896-4fd0-a8d6-d840981cb33f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218a4457-450a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777604523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604523, "uuid": "685e8ddd-1d6f-40de-9963-3aedc36d49d9", "comment": "Malware payload (Mirai)", "value": "c1efeb94beeed13ecf67b57d93ee9072", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604523, "uuid": "0d835d91-41f6-479d-8ceb-7a036cfdb267", "comment": "Malware payload (Mirai)", "value": "5b2a253021081fcde927c01ac027bf76948b953e7f4e29e05930e5e6d6961830", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604523, "uuid": "eb53e6d1-022d-48a8-a489-7cfa73d49ac1", "comment": "Malware payload (Mirai)", "value": "2fe46e3eb83b9140d0cf934ee375d7df36712fd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604523, "uuid": "a6bb0c0c-ce3b-4bca-825f-6dedc3bd1949", "comment": "Malware payload (Mirai)", "value": "e1862134edfacbac8ba63ab2639997e722137c012c753f37a2daf2ad786357eee4ae386effb7588833d29d40596a1c52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604523, "uuid": "c7da9a6e-9234-4964-a9b8-7fc1446483fd", "value": "T13C631856B8818F11C0D5027AF91E158E371357E8E3DFB2139E206F617B8B56B0E2BD1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604523, "uuid": "2e4654fa-b353-4bc1-89d0-86f573e082d5", "value": "1536:N/n2R02+ynw+Ge2BufEwWEl6AEC1CQl8Mpi9BPC35j8b+10mI:U0Nyw+6BgltsAgBPC35j8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777604523, "uuid": "4becc75f-9b2c-47a6-97b0-f9026b8356a4", "value": 68284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777604523, "uuid": "7af9e636-5ae8-4ae5-92c9-ab526ce0c398", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604523, "uuid": "407b5e00-da49-433c-a2ed-8fe13edb6f80", "value": "botx.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b55c1d9-4561-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777641933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641933, "uuid": "b93807a9-4e9d-4fab-9f82-23ccc0c9aefd", "comment": "Malware payload (ValleyRAT)", "value": "fecf265ab0f4616b703d4ad35907e42e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641933, "uuid": "cce5dfb6-17e8-4c1f-a762-2dec65cc3035", "comment": "Malware payload (ValleyRAT)", "value": "5b9566cacfb3098c4ee86e51f73716d7354907d7cac68d80531ad311e66fe823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641933, "uuid": "c3fa5849-55ee-41a3-b2d1-da3d557f4ab0", "comment": "Malware payload (ValleyRAT)", "value": "2990527c9da6f6507ed28e8f87c85adb0a6d567d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641933, "uuid": "af11134a-a06b-40d6-85f6-7e54f2ca8ccb", "comment": "Malware payload (ValleyRAT)", "value": "cd868d2222833c00295d5d7c8f80c1dde8aff576ebb98f4223ce2559a2d223144e9ac91813a3edd64cecb21c75b2706f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641933, "uuid": "18c0e920-2cab-4082-b706-f50d5be28eb5", "value": "T11C54F142B5D18032D866593409E4EAB18A7DFD700F659EDFB38416B65F303C09A3EDAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641933, "uuid": "8394c1a3-cd76-4bcc-9b4b-8243704f5afa", "value": "80e367041f1095fe8731317889b5dadc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641933, "uuid": "826203ab-5d40-4222-a233-c84cf67ba683", "value": "6144:59gXZ67dupUJ4siNc1BWRfqhVq4GDLkKXZYqmUqVJDVXN/Uvurz44JsQw9etZm:59YEuNGBWRfmq4mAkYqOVJtDULetZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777641933, "uuid": "579899bb-e852-4707-b37e-346985cfbb5b", "value": 282168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777641933, "uuid": "7f069cf2-b4cd-401d-a014-938d64cea329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641933, "uuid": "5de0987c-46d0-4253-b7ae-22f63db25fad", "value": "5b9566cacfb3098c4ee86e51f73716d7354907d7cac68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20201b97-450a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777604521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604521, "uuid": "55d3012d-9a81-4720-92e7-cf3cf5d9a9b3", "comment": "Malware payload (Mirai)", "value": "499eda0def35b8e62978eb1b5225f652", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604521, "uuid": "e8ef4524-9146-49e7-bc04-e213da7a4546", "comment": "Malware payload (Mirai)", "value": "5bbfa0a0962051d0646d6c29e8c8bf734f3a469c7a7ae28958a7bc9a69c3942e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604521, "uuid": "a6576f0c-5517-4ac8-8d6d-a6ead6c754cb", "comment": "Malware payload (Mirai)", "value": "e91fe358bd463ae9a97d58f6be7a10c184a4de9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604521, "uuid": "9979d50c-dd1b-4fae-acde-73deab9cd488", "comment": "Malware payload (Mirai)", "value": "36dd78b0e516a60ad918e3e9fe472ad60a2809645f1073a0f85333d0e6d99e9d9c721a14f71a5bd203e9076aa5a4e9b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604521, "uuid": "9e6c01f8-c242-4c60-87df-dd05772b00c3", "value": "T11863961D7D258FFDFA9C463447B78E11AA5823D527E1C6C5E1ACEA012E7024E241FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604521, "uuid": "968e0ad9-1f36-4b3d-b973-1675a94770b0", "value": "768:YaoWM3vZfsksfovVCVEMZFKpFjURHvgT8yFqRWahthGhAqhVhNqh5hXIr+O+8Chu:7aakQovOcFr+O+UWgezXYb+10Wb0GvyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777604521, "uuid": "18af4f8a-3092-4fe4-8d2b-c12d618f8096", "value": 69208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777604521, "uuid": "ee21a855-408b-4259-b0aa-751f6bda8de5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604521, "uuid": "d19defad-28aa-43a4-b9ad-30d0a28f66cb", "value": "botx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb1c684-454c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777632975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777632975, "uuid": "66802f6d-9e69-4401-87e0-c87e94d5414a", "comment": "Malware payload (Phorpiex)", "value": "8f5db591bbde73e897d3f0d869d9488f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777632975, "uuid": "9393e924-58b8-42bd-9f8c-ce8d1a487b0a", "comment": "Malware payload (Phorpiex)", "value": "5be536b32ed269b1b86be90ca55ca18128b1e101e5ce31c68fb353b5cdbbdffb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777632975, "uuid": "d8497612-e199-4aa1-acac-c890eb2cf9e5", "comment": "Malware payload (Phorpiex)", "value": "42f27100fa2bae066aedcb63ae2632102aa4731f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777632975, "uuid": "407c4ece-0beb-4cbe-a004-740bb12b28ee", "comment": "Malware payload (Phorpiex)", "value": "879606d21cc7a9a7ec9fba95602372d4118ecee05b24e97d4dbd48518a145efc7dabf01dda16c624f77b73ce33e9ba48", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777632975, "uuid": "00682692-eba3-4431-b8bb-b32ee2a29338", "value": "T1A3825B0FB946421AD0D100749636867BDAB998B637C814EBFBD08AED1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777632975, "uuid": "09131982-adf0-4352-ae94-c8bb74d3a4d2", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777632975, "uuid": "d7522df8-b915-4b0e-a399-b13969122b31", "value": "384:kI7MVGASM1KwLgSZb7u9NHu/gRhav8U9cn:FQgUb69Jha0Uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777632975, "uuid": "b9e597ac-4df2-4e50-aeef-1bda8f1041cf", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777632975, "uuid": "a2d69f48-b0d4-4af8-8e54-7f4cc25b5e57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777632975, "uuid": "45e66bf6-0922-45d1-99b8-65fe22d2752c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170ba083-4579-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777652180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652180, "uuid": "5c9f8c2f-0af0-4257-9e3c-3d76b739758c", "comment": "Malware payload", "value": "e2364a08464fd23fea666eb83b0ca78c", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652180, "uuid": "d88488ee-70c2-4e9f-addd-9152e58f2b0e", "comment": "Malware payload", "value": "5d9725449c194c9b812b113dc6016bd384c061a800a1819fb014f8d3af923316", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652180, "uuid": "e239441a-c589-4447-93ae-8138c47b50b9", "comment": "Malware payload", "value": "42409d91f0ba05d233e911db47c37fc6c24dd9a3", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652180, "uuid": "1282d5f0-54c0-4ad2-a1d6-19056413a8c8", "comment": "Malware payload", "value": "f6c7440552cd1052511f0c2b8dc53d64f22b5350061cbdd0d9def85d4bc61c3a5ac55510942aebfe0551e0ec48f2a961", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652180, "uuid": "a32e374a-af0b-447e-83d5-0224ec27a52e", "value": "T141539E24BB70C5C44DB27CE1907BA6F3005D59F288DAB7E9DB1F0BA52D00A8BB85257D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652180, "uuid": "e441cd16-b951-4ad7-adb1-eac944716ab3", "value": "1536:Taz5QjMrcXmPsYBgomlTB5phXgaFFyFxwaAByc5e:KUhcsCgo23pN+Frf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652180, "uuid": "d9be6626-bb66-48f7-b899-03f4462af769", "value": 63708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652180, "uuid": "281b9e82-1749-40e0-ba00-38208f96fa51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652180, "uuid": "569ba834-d950-48f6-a37f-827fa92632a3", "value": "evitu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa70c8a-4589-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1777659362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659362, "uuid": "d4bf3650-34e9-4528-963c-d8b45d692f05", "comment": "Malware payload (Prometei)", "value": "992d6f647e51c21e9a79b765f599c876", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659362, "uuid": "a29d20cf-6a65-44fa-92c6-ddc61f45d025", "comment": "Malware payload (Prometei)", "value": "5dc88962a90f24af59b5b9ea8c6b4184720b89b7e5792bd32e7e29aa89eb1cc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659362, "uuid": "2fd0de26-c43f-4e18-9475-66f2de5dc620", "comment": "Malware payload (Prometei)", "value": "511054764f4a96b89886686596c8cbc8f2d40ac5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659362, "uuid": "9eb2f5d3-fcde-4f29-a5a2-75982a9c0e39", "comment": "Malware payload (Prometei)", "value": "21ec5d52dfe89064b6450def3df3d27a1f10fe5e395b3a373f44596ddd3ce028bf5e351087da30ecf4d84d23962f342e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659362, "uuid": "92fc0473-b6da-45a0-a9e9-14d4e12f3ae6", "value": "T1BCA423B4F9219E8F6DD769B91B24835DE181C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659362, "uuid": "56579d47-1552-43cd-95f3-edf465afc75e", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdz:Fs6pyCC/Ya2hpi6T6N41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777659362, "uuid": "b1d567bd-80bc-4ceb-ab2f-550dd8676530", "value": 449061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777659362, "uuid": "aedd7b81-7e07-4061-90e8-70867c9b4542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659362, "uuid": "306754ff-57d3-4e61-b77a-f02315b9c38f", "value": "5dc88962a90f24af59b5b9ea8c6b4184720b89b7e5792bd32e7e29aa89eb1cc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085c024d-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777618655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618655, "uuid": "55cf41d5-73bc-4b7b-8f89-9b9de5d4399d", "comment": "Malware payload (Gafgyt)", "value": "7cc48dfd13eb46efb35e964d33018a79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618655, "uuid": "55d2e228-df6d-475e-a047-8edf39a306a2", "comment": "Malware payload (Gafgyt)", "value": "5e4e2d38025461329a42670f58697fd1c5b2e652861c3a3729e1167112a8ea75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618655, "uuid": "00e614b8-b0dd-4731-a5b8-329fd3e65420", "comment": "Malware payload (Gafgyt)", "value": "a09c2d037e71213687b4b33e89ab6be9e8d807ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618655, "uuid": "6646f334-2462-4847-9d8f-3e51d11e9562", "comment": "Malware payload (Gafgyt)", "value": "5b52772f86a17ff23faf106514b887b2a0d0247e5005a4eabefec2ec30490960c26dea36d280a9fc72878444f38560cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618655, "uuid": "d889ae5e-fe80-4136-ae64-ab464dec1441", "value": "T1B7A33A37BB220E23C0CA947111E71731BBB5D3DA29FA5243BAD16DAC6F165803962FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618655, "uuid": "ffd17444-862d-4568-8973-e8e0b56f29c3", "value": "1536:UqWHGtajNM5FtNxt6Xphaw1rKzOmF6OXj6ufeuTe:ZEjN8xxSphaw1rKzOmF6OXGufhTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618655, "uuid": "97c15272-2ad7-4f5c-bcfc-700217e82d89", "value": 100918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618655, "uuid": "e113d9dc-bacf-4e8a-8750-4a905518c385", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618655, "uuid": "9dd968bd-dac5-4fc5-b4ca-a866f3a1c73b", "value": "hidakibest.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf30b6d-4572-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777649291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649291, "uuid": "ca511c90-c144-4695-8395-4a830dfad23c", "comment": "Malware payload (Smoke Loader)", "value": "8c0b07374898e76cadd6d36e68959682", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "prodxk-lol", "colour": "#50272F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649291, "uuid": "731bf4e9-8fd0-4c32-a21e-4bd8eea97e66", "comment": "Malware payload (Smoke Loader)", "value": "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "prodxk-lol", "colour": "#50272F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649291, "uuid": "48b347e3-53fb-4bc0-8a0c-2273b1884e39", "comment": "Malware payload (Smoke Loader)", "value": "c23da96e2e71d8487c839b75bfaad1e7f8b7a3a8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "prodxk-lol", "colour": "#50272F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649291, "uuid": "5fe874c5-16ef-4f40-9320-d8de64690a5d", "comment": "Malware payload (Smoke Loader)", "value": "e438bf26ad5517fad2a03b13b862518356d5909ad3c7ba1a3b47c8e007a23244c9f9ebaac052c936b047882fd9228402", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "prodxk-lol", "colour": "#50272F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649291, "uuid": "dc45998b-610a-40be-9058-e90eaf3a0d53", "value": "T1D6F440EF6F2E78C9D9556BFC94B46D2197A0FCB075D1608A1342F75BCC189238E2A123", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649291, "uuid": "44da464a-c659-42f9-954c-31bd8112dbe8", "value": "6144:VJNtbWAce4u+jylPusfldaDEfrL19LEV46xwZAVqxSFUMlom4Gl1f1rcr7:NkO46lpkIjLt4+APiGXg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777649291, "uuid": "3dc05dfa-7af1-4ff3-bf75-d98d7337763c", "value": 757216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777649291, "uuid": "8f58e94b-477d-4226-aabd-915d4ec67733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649291, "uuid": "192c5bcb-2503-4387-be40-fe87543d879b", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf15f8b6-44f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777594480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594480, "uuid": "3208e14f-ff8c-4ba6-959c-28dc7b1557b8", "comment": "Malware payload (Gafgyt)", "value": "1898e8b022157514e5a4ab0b288696d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594480, "uuid": "458e3a6c-52da-474f-8d50-d4f4b9a3d5e7", "comment": "Malware payload (Gafgyt)", "value": "5f8f32bc5b5533799e86c39df856d9c6168ebfb16f2049530c615381a04ddf9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594480, "uuid": "29be22cc-aeb5-4b83-b262-426ca2e4b422", "comment": "Malware payload (Gafgyt)", "value": "560834ad3f55c49613dd8770ce2c44dd8db0c38c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594480, "uuid": "8d8d56ea-3181-4f48-b484-8cabc9852db3", "comment": "Malware payload (Gafgyt)", "value": "df78147e99d63022d37bd94fab5df7ab5f68cb88d1ffbc2a5ee18bc21a28e3f5ce79ec92815adc267530cbb4c22bab31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594480, "uuid": "30ff6e31-3389-4814-a294-9f0072f31631", "value": "T1EF933BDAFA42CEB3D06310F116BA6B218971F9FB1C23D682D7647DB09D111C19A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594480, "uuid": "ed42effc-1a3e-4cc2-9369-d26a47fc9247", "value": "1536:ODLHhBPQBM61XMar9wEeHo7mUvsEyabYB5bqNd2xOyQJ33+ZPEg:mVeZMar9eo7MEY/qbVJ3uZPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777594480, "uuid": "954113b9-55a0-4cad-8505-bf6dbe03cbc0", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777594480, "uuid": "1f6d966e-ab70-4e49-bbbe-7874eaf22fed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594480, "uuid": "7d543990-093e-4534-bb3b-4ae7fc160cee", "value": "FBI.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3316d75d-44f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777597251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597251, "uuid": "0d3788a4-de75-4531-8b61-6b3605aeaabf", "comment": "Malware payload", "value": "83a49b752ae4b54689c282d267b16c9f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597251, "uuid": "9f4154d1-d456-49df-8ac6-f38473c4000d", "comment": "Malware payload", "value": "5fe92f4ee0a26b700c39f3c3f63cd3f71346793065b50f0410f66117dea2beed", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597251, "uuid": "51c2cea2-f70b-4283-bff4-221f09df31cf", "comment": "Malware payload", "value": "caafa9502db54c822ab49afd75d4397f86e34ed1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597251, "uuid": "81890484-c7fc-4873-97ec-e568d0173f3f", "comment": "Malware payload", "value": "7f9beda4d600163b4572b60de60f81dfd17793328896ffea13834edfca08b98e08f7b88b9afd45767ba7ff08954df1d0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777597251, "uuid": "51e09cba-5e2e-4476-b33e-d2ef2053c364", "value": "T1090723B8DD9823CF0A06C5FBB38BECD9B06A63836D431A1702B543E931751A5EE47C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777597251, "uuid": "78b6a414-c515-4eb8-afc8-c31df4be16f4", "value": "49152:PZC32B+OrudMGLCBv0H8Calg73RYPommODFj+3/M0U7D1lEyO2FV93FnZX69cWTK:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777597251, "uuid": "1a8bf613-185c-4733-ab71-655e84caa350", "value": 18272772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777597251, "uuid": "74eeb63c-6dd2-4ada-b7a9-dcc64ac54f36", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777597251, "uuid": "0703538e-971a-42a3-933a-4dbf1717e175", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd9f776-456d-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1777647091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647091, "uuid": "b880def0-1ed0-48b8-a3aa-8eebaf449d58", "comment": "Malware payload (NetSupport)", "value": "8b1e350000175655e070c403eb03144b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647091, "uuid": "147e8c8c-2ccd-4e4d-be58-68103a36690e", "comment": "Malware payload (NetSupport)", "value": "60432d6eb939fc6d96684046071d237d0141480e7af43c623eabfa9e7ff33cac", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647091, "uuid": "964dcc27-2ad9-453f-a835-600c422e36d9", "comment": "Malware payload (NetSupport)", "value": "5f0239f50a2b9258e1fdc538c36227cc8c7b1633", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777647091, "uuid": "b2e178e1-0494-4c15-8952-8c79ba7023bf", "comment": "Malware payload (NetSupport)", "value": "5b08dbc4086b06db951c36d2db7e736a97cc6e24a9ad0a6af2796f65796405bc0943fb67df3478ee36be2e957da18cb2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777647091, "uuid": "f05f5dd4-6131-45b3-a3f7-fe7d921f3375", "value": "T1E9B533427D002D63C29A51F8158726C367CAEC47FFFA01416EC8B7671A76F322A2B65C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777647091, "uuid": "6e74748c-fb23-4d87-8247-e9fe25e2bdf7", "value": "49152:aFO6R0riyyn+/ko7GHZg8+A/GRnQkNflLkZMOgi8wQ9a68Pa:aF3QynSYHZF+A6QkNfloZb8wO8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777647091, "uuid": "f748698d-fc6d-4486-91ad-de78bbc5ebd0", "value": 2306048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777647091, "uuid": "1d87c10a-b6bd-49db-8aea-9d539c246b05", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777647091, "uuid": "cc03dcf2-429a-4e37-ba4f-4c5816b7ca0d", "value": "8b1e350000175655e070c403eb03144b.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff7920d-454e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777634102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777634102, "uuid": "8d9824b2-78ff-47bb-8df8-347e78bbcba7", "comment": "Malware payload (Mirai)", "value": "13d373050605a3ecd1d2e8b1b6ccdfc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777634102, "uuid": "6d4bd648-18d0-4a79-978e-6741009b9b6c", "comment": "Malware payload (Mirai)", "value": "60503f8608b8063b3589a25d7d4278fbdb98342bd8ceaf82db58c0376a3964ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777634102, "uuid": "57fab4d6-a7e8-46c2-b42a-418276929cd1", "comment": "Malware payload (Mirai)", "value": "bda5bc78b9a7c46d6c84bfa83149a2937ccf7ca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777634102, "uuid": "d31c0e68-8f78-4f03-bbd7-45828b4bafc2", "comment": "Malware payload (Mirai)", "value": "80e91c70103ed27429f4a576fba8e37579841b061bcb06f75a02687d5c237152a17f7d879a8d75981d4825dc34bc2985", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777634102, "uuid": "3755005d-94f1-4d9e-948f-47ad34369e66", "value": "T13313F782AC92865689D813BEF93D41CD331273B9D2DF7152CD015F18B6CA94F0DB7A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777634102, "uuid": "5c095fcf-9051-40aa-9e95-79e843595069", "value": "768:CMn1EjZA//+1vTRfRiOC7wYqT4JqsWA3B5d7I9ybMioW+j/LsYtXO0CX:CMn12A//SrRftY97WARbIcbboW+zLsYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777634102, "uuid": "9d851782-a795-40de-b606-0092d2b6e585", "value": 41640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777634102, "uuid": "d14ea63b-b8eb-49e5-8f74-0f7436d7175d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777634102, "uuid": "6bee066e-87d3-4c7a-8a09-47abc52d6441", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a5ed58-45b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777679511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679511, "uuid": "1a71f2fd-0778-43cb-a9d0-9c3c73c27174", "comment": "Malware payload (Mirai)", "value": "9ebd2a8c4cc846560e6652942a8bd2cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679511, "uuid": "2bd8881a-485d-4c7e-9301-14c576063a0c", "comment": "Malware payload (Mirai)", "value": "620f5f625e69ee340d8fed7ca8338553e85d1b1625828daa606ca2f9988aa747", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679511, "uuid": "d6d8783b-c866-4b43-93af-8c6564b13d29", "comment": "Malware payload (Mirai)", "value": "7d7bf76b9d54a605f2fc41d99972f2017ff7175b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679511, "uuid": "c342be99-422d-4652-9ee5-5c4d7d68ead3", "comment": "Malware payload (Mirai)", "value": "1d8ebbb748899e14ecb0c7514600de08d641f693d66273f367a0d687f6c0c1dc6d5f6e73eb07c0f9ae5c06b77b49faef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679511, "uuid": "49a21bd4-d2c2-483f-b21f-d1650ea0ca55", "value": "T151D4E64B6E328F5DF674C6318AB70925E76833D723E18685D1ACE5205E2068F941FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679511, "uuid": "c23694d9-de1f-454c-8e97-7b5eb3c774ae", "value": "6144:iXka8V6DJd9nhzqp9tgQxWLTo47B/cJcxpzb9Kc1YEdQMIpgz/H565hYsu6q+l2/:iUmQIPNRYEdhIa/YhFu6jlgrqn2o+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777679511, "uuid": "bf5e9bb1-edb7-4e8d-a965-a130a430ef59", "value": 615116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777679511, "uuid": "577cd10e-738b-4c5d-acdb-c3013cf9f84f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679511, "uuid": "9ca7e1c8-8362-4820-a594-94b65dcbd2ca", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4f0cd8-450a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777604516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604516, "uuid": "9564a38e-b23e-4d90-9396-2788579398f4", "comment": "Malware payload (Mirai)", "value": "638aa2ea1b435939cbc6d6d4429c99f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604516, "uuid": "7f918463-5e56-44db-a791-098f86938b78", "comment": "Malware payload (Mirai)", "value": "631b4b4316d9e8f01ba05b7c5c7a47c30083f46cee161fd05811d058c5651cab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604516, "uuid": "5e661519-43b7-43b4-abf3-47218ce9ecdb", "comment": "Malware payload (Mirai)", "value": "e2ec0457c3dedd51cd3e7b616de3f6b1994f5fcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604516, "uuid": "7aad5ab6-8b74-420e-970c-882626c950bf", "comment": "Malware payload (Mirai)", "value": "45a66c2c943dcab1d8e7a84056b6b93ef34ca45b01ea71693e78e911e481a0560a8d6d08835832421ab4da0d6c68d54e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604516, "uuid": "5b178ce2-b745-4677-b6bb-1c1ea4194080", "value": "T132C32A56FB804F13C0D61775BADF42463322E791A3DB73065A286FB43F8669E4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604516, "uuid": "cb3aef09-a4e0-4ebd-a2d6-966dd04671ad", "value": "3072:kb4OTu7NXQXkuIz1/gJ3UTaaVeNSnDYM/9rumywboflq:kb4OTutJuIz1/gJkT5gSnsM/9Kmywbo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777604516, "uuid": "d10ca465-e37d-485c-9293-d2e1b0f4e13a", "value": 128521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777604516, "uuid": "290bd936-6832-4725-9c53-0eb39aef505c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604516, "uuid": "82b840f9-36db-4d13-a337-48a4cfd7fef6", "value": "botx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2c0e18-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653103, "uuid": "634b0b38-dc57-4512-95cc-5c7a49c2e191", "comment": "Malware payload (Mirai)", "value": "9d1b2ac951a1016190ada7aac0bc44c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653103, "uuid": "11c58c57-b333-46e9-8b38-a3f0bf0455ae", "comment": "Malware payload (Mirai)", "value": "63c3750ef2a3985fe8e855db88264788f34a2d435ff3586d89efa480049e7bf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653103, "uuid": "6ca51ef7-1290-4443-bdf6-15c6fcdbc330", "comment": "Malware payload (Mirai)", "value": "0530dc19b40ef3da22af37ed133d77721eeed3cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653103, "uuid": "fa4fb339-22b9-4749-b83c-bc1985050bb1", "comment": "Malware payload (Mirai)", "value": "0098b0eb75934430fe84b853fa834764e39fa35b95cad1c1cca00991f243ae5750bed2f2db7583e8f42ce1d06d84ca99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653103, "uuid": "04c65794-972a-4e5a-832c-ecfb578e44d9", "value": "T196145C02731C4907E1532EF52A3F37E193EFD5A124E4BB44654FAB899271E72244AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653103, "uuid": "a4f860be-caa1-46c8-93d0-884ac36d9783", "value": "3072:jFpDizEiipHCFJITYRzd9xb8djJ8WSysMVkL:jFpDjHCFJ3d9xb8djJ/Sys8kL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653103, "uuid": "41a5845c-a2f6-4a25-bd0d-ea65f2fd3282", "value": 199512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653103, "uuid": "a07733ae-a51a-4790-aaca-5bfe7ec280fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653103, "uuid": "ba9722dc-9ee4-4b3c-8cb7-f74ce9749bc5", "value": "vaxbot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8764cd6f-452f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777620586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620586, "uuid": "eef06497-3cd3-477c-8252-df480babcb72", "comment": "Malware payload (Mirai)", "value": "d839800e7a1a610561b4d7855eb08225", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620586, "uuid": "06d1d366-666b-4503-b437-104d23c42649", "comment": "Malware payload (Mirai)", "value": "63e949b39b7f680d3b9fab4fa4b61b07ada8fc1ee1794fc7262253f64396582f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620586, "uuid": "9849beec-1702-4127-8acf-15920edc5e67", "comment": "Malware payload (Mirai)", "value": "a5eef01941bdaed8bd3abc1ca550ad1a9448d20f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620586, "uuid": "b55871dd-58fd-48da-8aa2-d80b8f967fb4", "comment": "Malware payload (Mirai)", "value": "6f6b9ebad8b5122a72f2849e63916e385e3d30f6bb413f85775e63f8ff2b6e5ad07b609356df96cce9d09233e6a17908", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777620586, "uuid": "c64c52f7-2ef9-48ff-aa4e-6f5edfd78087", "value": "T1A42302AA0AADCA10D0226A735F4D67A86F5B1D73E3BC03830FD1B12CF936441A6D58C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777620586, "uuid": "4ef26d69-335c-4c02-82f1-47196e0e6a07", "value": "768:AqPMJiJRSgnkSI3NZUg7LhurjhJ5EYuUJ25mNL+kCKRWSkNtidPdrJYOkEOM9uTH:AVzLnQ5EYuUNNNrWSkNtoPME0TRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777620586, "uuid": "c1f96021-2764-4ad8-8070-92a25862c2ab", "value": 48180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777620586, "uuid": "3d69d04a-bead-4fde-a034-700b5bde4a24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777620586, "uuid": "ea1d1395-cd44-4b42-8346-10f841fff99a", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6dff64-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618666, "uuid": "c8d9ecdc-341b-49aa-a574-b363c79b6552", "comment": "Malware payload (Mirai)", "value": "c7e2e260ff74f2dc7a8a8281cf085a39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618666, "uuid": "e996969a-a3a8-45ab-b0e7-985d5c6d9d0e", "comment": "Malware payload (Mirai)", "value": "64521013ccb942de1fddbead80a6692e251472113c904f60e09739982db875de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618666, "uuid": "05e81355-6742-424f-9f18-50a68ca2a2f9", "comment": "Malware payload (Mirai)", "value": "a0ca39552e716ffc4e4a20c33b35a3f55380b985", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618666, "uuid": "2eec2747-f97e-4ab9-a3bb-4fbe30037788", "comment": "Malware payload (Mirai)", "value": "f47bd112a1c787f08e340a3e19cdc80537eb8914d9d89205c7624e80c2aa6f039abe07f8265d1ccf8281ab5534bb623b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618666, "uuid": "87c8dbf0-1d45-4648-b857-def01b698b41", "value": "T10ED307C7F900DAF6F80AE3364853050AB130BBA249925B777257352FED3A1D90577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618666, "uuid": "b4a14d5b-99a4-45bc-88e1-05b9101e8497", "value": "3072:zqg6dD1EDeDYfoUOeJsCV9jbiuLdyahL++yjo7kI+:UdD1EDPDOeJtLdzhtyjFI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618666, "uuid": "3c774970-1f25-46b8-9ebc-71f85030f4f4", "value": 133988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618666, "uuid": "ac046ef2-d265-40e6-8fbd-c09914b857b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618666, "uuid": "8483c76d-0daf-4d46-8667-147982cd13de", "value": "rage.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26339550-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653064, "uuid": "5ea2b6d6-fdc1-4817-85a3-3458c237cd1f", "comment": "Malware payload (Mirai)", "value": "153fb98176eeda179a0caff5e2a6a8d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653064, "uuid": "a0af6666-8dfc-4292-961f-e4d2402cdc78", "comment": "Malware payload (Mirai)", "value": "6518dc8809e23c0c6f79982e99caf583ff6626785955e11d68b5bab41423ac95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653064, "uuid": "21cae660-87fc-42ee-8a35-049215342745", "comment": "Malware payload (Mirai)", "value": "5002514a792a0a53f269a0de6b491918d76827a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653064, "uuid": "67036828-4734-4de0-8c3f-bd65b5f5acd6", "comment": "Malware payload (Mirai)", "value": "1f847c63df47419b8d87331dc3ab11c2ad7de527b0dd1660938036e4a9d4dc08e1cd234dd044b16abd1b0be597092291", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653064, "uuid": "a6318dcb-e3ea-4ec7-8058-e8839eaec82a", "value": "T118A33C82BCC2596AC5D427BFA76E729D3361A3D0C2CB3113D8A74B25378615B1F27B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653064, "uuid": "e024dfbe-8cc2-4bc4-aede-c04ff32e7d03", "value": "3072:dI8MbK3mEzus3GsJ+Qr6Bv3TCO3DaCbSOL7g:hMbK3mEzuSGggZe+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653064, "uuid": "28eb8e41-8677-49bd-b21f-aa22d2f09413", "value": 101176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653064, "uuid": "a87fb1f2-3848-4346-a649-c2d132e2b42d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653064, "uuid": "9adf8b9d-6779-427d-b29d-d0f22feeb576", "value": "vaxbot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b41723-457a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777652988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652988, "uuid": "cfa0bc87-fdeb-4463-8450-03e7fcee1198", "comment": "Malware payload (Mirai)", "value": "3d92df2dd838655d31a10c5b1bf8e99c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652988, "uuid": "e61090c8-5c7a-49c6-9d4a-8962360ed0a9", "comment": "Malware payload (Mirai)", "value": "6653b817e3145a5525f5021734b045fdbb3b6ea00026073b642f1a0c46902650", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652988, "uuid": "d9547151-39ea-4fef-9201-09f344dde823", "comment": "Malware payload (Mirai)", "value": "d086a58cb3e3fb3138a7f650e8747d7c7553b769", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652988, "uuid": "b1eb04f7-2c99-4c68-bbcf-55789cca669c", "comment": "Malware payload (Mirai)", "value": "19d38a6f1077691eb6020adf0ea98481db5463389b33c8f848d309f22afda6e9aaacf8b4f01a400e624390e1240469bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652988, "uuid": "7b30bc52-7661-4ac0-89b0-3b52b6985c49", "value": "T1455302314535D388CB7D403A20CEBFCDD75A6269EA27C5F782AAA00F14A3F5915694CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652988, "uuid": "aa50c489-9dff-4645-8b13-88ab8853f410", "value": "1536:tiScuZ1WzuozwdJiGy2BBK7LR8zkqs+nouy8Gym:tdNS5zwd0lh7ebrouti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652988, "uuid": "4af8e42e-7a97-4158-995d-cc573cb34c31", "value": 61784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652988, "uuid": "98bcf6fe-95e4-40a4-92a6-5a85ab44e371", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652988, "uuid": "f32aadc9-c2f8-4f17-a53b-107a5e3b71bf", "value": "vaxbot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6456e7-458a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777659784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659784, "uuid": "932a927f-5ed3-4a1e-9b9b-13dca146c3ed", "comment": "Malware payload", "value": "3a304d46cf280b48dc4ce2b397cc8649", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659784, "uuid": "ed66aeb1-7781-4e51-9fe6-4622e4885e5b", "comment": "Malware payload", "value": "66d0bee1989d5b231f1d8f767061f4fe3ec9e951627c5810efc81bf9e47c4409", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659784, "uuid": "03b92aa1-2ff7-4815-9544-2d8de075776e", "comment": "Malware payload", "value": "41ed43ac2ecd2955af1911ed21f71728ddfc4f74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659784, "uuid": "4dcb0850-67eb-4e77-861e-11eab26925da", "comment": "Malware payload", "value": "e7121dfe044b81c1b585a957bc013854cfb659bb4e56ec75250d2528725939297f71015d771cb8b13b7af3589764eaf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659784, "uuid": "f685819b-10cc-4b7f-a847-ca1c1c6a1793", "value": "T19172F939FB530E27C49589B451EB432CB6B9825F98A94F3B3D620E88EE81D8895431F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659784, "uuid": "b47dd754-b708-4b47-9ee1-b0fbd1604568", "value": "192:QZ75gqQfFqrptjtLD1dQzFYjQux/lRRGl1jcivcINpIguZVUCyu4P0eB6kd+D2rX:lgjJcB4lWlqivcapIFU+Jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777659784, "uuid": "8d7a7c76-5cc4-48ee-8b94-92e101899bce", "value": 16636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777659784, "uuid": "c52aa8ea-d9a9-40cb-bbc7-f102549902e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659784, "uuid": "47c494f7-55a9-462a-9ae0-d90c0cc23ce6", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b98f6d-452a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618576, "uuid": "8f997432-b4ce-4f60-aaef-dc6cba0c747b", "comment": "Malware payload (Mirai)", "value": "a3e94f8b28563e11baa9c18748b9b33e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618576, "uuid": "0e786c8e-afe6-451a-8875-1ed4426f7bde", "comment": "Malware payload (Mirai)", "value": "6833cb4681ac69281474be2c626df06cd90bb05bec72ae697cf219a6603826c9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618576, "uuid": "08a069f4-7776-4401-8f2a-883e34f7f2d5", "comment": "Malware payload (Mirai)", "value": "554a3655b780d939a585ede02a2ea1749c2fa803", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618576, "uuid": "3a5dba65-1df0-4c18-86c0-e0f81616b6b3", "comment": "Malware payload (Mirai)", "value": "b06f55885fcfa97b11591abace1625257c557d7b1c11f774c1dd9bcaadcdbcc58938b5d1d9859c074411b471f6e3dcbe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618576, "uuid": "6be3f7db-6f85-46a1-b160-096c348a2854", "value": "T1B6D33A45B9519F12C5D722BAFE6E428933137BF9D3EA7102CC206F5437C6A9B0E76212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618576, "uuid": "b0d3f30f-7d3c-48d0-8574-aaf84f820f74", "value": "3072:wIc/1xBPSvx4rq4r9ltYrTZhxV0+m9Ax0eM6maprNdK+ofGdEsntzO9Uy2sI8Nqz:lc9HPSvx4ntYrTZDV07Ax0edmaprNdK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618576, "uuid": "d98e4b00-8c21-4095-ac0a-78c78a0bb466", "value": 137136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618576, "uuid": "e95429d0-1037-4ed0-9abc-df43ff04df84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618576, "uuid": "fbf44b0e-274a-4552-a1b5-2fd9d2120ba2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e386cca-453c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777626046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777626046, "uuid": "58804247-07a7-4c1e-a591-61e18bdfe05b", "comment": "Malware payload", "value": "17b395258a37f3f868eaaf2386348531", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777626046, "uuid": "958c120c-83b0-404a-b893-1a615cf32c57", "comment": "Malware payload", "value": "684e4d57a4b6cc37c7f87333e751c12edbbfc9cf685ebb36d563647ae6df0e17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777626046, "uuid": "c30cb75f-6c8d-4261-b289-e3e24dffdbff", "comment": "Malware payload", "value": "494d1b25c70557037a4b281715ebb5c75c88b0e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777626046, "uuid": "f0fb891f-68ee-43d8-b597-c264de660e00", "comment": "Malware payload", "value": "ddf6fb12540ec965fc4bb1b21cf6accc6d6c8e4bb0b5adb46f84c8219d6a8d757eea252152302d39bfe0c68a3bef9e56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777626046, "uuid": "2e59be14-4045-42d8-b38f-07597dc7746f", "value": "T119866C73945224D8E1ADC974D5141612BDB8388B573863CBBBC476F61BBABE48E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777626046, "uuid": "4d585362-b397-4adc-a38d-bd5f1a4e5473", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQU:cqYUQuVDt0TZEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777626046, "uuid": "70637d12-c40c-47c7-9226-6f10de5d0cb6", "value": 8192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777626046, "uuid": "6d557fc6-a583-44c9-a50d-6bdba775b8bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777626046, "uuid": "2573e3aa-1d39-446b-a853-a91b9b5abfce", "value": "684e4d57a4b6cc37c7f87333e751c12edbbfc9cf685ebb36d563647ae6df0e17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2be478d-4587-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777658427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658427, "uuid": "145734c7-653f-460e-a779-dcc1782291b2", "comment": "Malware payload", "value": "ef2ce7fa27ca144e74438aad4ba89bd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658427, "uuid": "05345160-b763-4e6d-9f24-476842da7c84", "comment": "Malware payload", "value": "6947450cbf6f065e4353d7df1f0dd8d969908ee0f6ccc12ba3549bdf5866a806", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658427, "uuid": "2d335b55-5aee-4a55-8bc4-86276f7f98c1", "comment": "Malware payload", "value": "54672c5f0b96757c33b767e43ef7742f14b9a019", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658427, "uuid": "f4d12009-79d5-4f48-b834-ce65e8e926a5", "comment": "Malware payload", "value": "5a1d7fd5eab8daaf54245001792710d437f08f4046a005a74ccfc0d18e97cfec94a92d7b7d76d625de1d85bc53f55b5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658427, "uuid": "8f3493f0-f263-4dca-87d3-24b6ef41af52", "value": "T198C15CB6C5808677D645D33736BE9CA955300C84DB0DCF8BF69BC9C17683069613993D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658427, "uuid": "efeb2391-7dc5-474c-9461-762df83e31b9", "value": "96:MCOqQ3uAWXD3vpUzqKHzTC1XF2iyoY7dX3/LfTcKHrYSy/1JpZ6vSReGAitBVW:MCOqQ3uAWrqGKTTCFsNb9v0qMlZ4SRVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777658427, "uuid": "28724af4-d871-4007-afd2-c785d3f77ecc", "value": 5860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777658427, "uuid": "54e4988c-6bd4-4cea-8401-4fe8c7615175", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658427, "uuid": "7e62ce9b-a276-4c20-a9fd-3da2f2368f24", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a425efa8-4586-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777658000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658000, "uuid": "f7dd1f02-84ae-430c-a168-17edfae7fc4b", "comment": "Malware payload", "value": "8d440d7fd71cf3756050aa0d19bc507f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658000, "uuid": "ea566ae7-3063-46b7-823b-e061b13b332c", "comment": "Malware payload", "value": "69587d77132c21f2ba7b3720b8747a7bb20f72a03a2127b4aba2e4c87e9263e8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658000, "uuid": "6dee449d-4011-4cb2-8332-a65790a29936", "comment": "Malware payload", "value": "efd13da7d63e7c4cf0bf30a97ce09954af10979b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658000, "uuid": "2440a888-1174-4a1e-aa7d-13b586da6de8", "comment": "Malware payload", "value": "7d5b059a8d18c11f6af346154fbbc65d73ea1e518731dfe271a397d18548465d13a4f146f800375fe2165daf767c5f7e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658000, "uuid": "bb565c60-bf24-46b0-8585-3679e248b52d", "value": "T188F030E9A0716AE28448AF00F87686989507EFC814951B5C69CD38BE97BCA207B31F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658000, "uuid": "b2ff591f-eeb6-4fe8-9e25-513459d253cf", "value": "6:kdihU9bbdihdLXgdih7Fa0LKi6bdih3kIOLOEdih3HWcEdihDanIDLQn:/U9K9X77c0LKQzOLylfRDsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777658000, "uuid": "8d2c9e49-9f1f-4b0f-b1e4-c405246f0b82", "value": 438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777658000, "uuid": "76bcc363-f178-4092-84ea-0a77f7569bb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658000, "uuid": "5ca18915-7fe3-43f4-82f6-442ed8c9bf5d", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6ddad1-458b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777660160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660160, "uuid": "76d9c2f5-a862-4f86-8f1d-f4ad3eee1c92", "comment": "Malware payload", "value": "182796eebd84c100874fb071fcdbd8ab", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660160, "uuid": "3d338dad-f142-4cdd-b95b-7120017e33ee", "comment": "Malware payload", "value": "6aa218e4f3f2258d94dc64a3c51e4a95d0c0ff7bf1efefeb1d2cb74e89477176", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660160, "uuid": "6bce3d98-8bdd-4d49-9c5d-568bc012c2c9", "comment": "Malware payload", "value": "ddb17ec4b2492e185dcf33f857df26cd59065cd5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660160, "uuid": "8b359d85-c95f-4595-8d00-ffb937a2c13d", "comment": "Malware payload", "value": "8acdaa4f7e910f043c32fb8b40d968b7b7119d140814390d055010466f2605b77a310f252a8e0bae701a9e795677a806", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660160, "uuid": "ecc52801-0cd9-4658-b9cf-ed6c77841d33", "value": "T12EC0C0025400F6FC1E534FC6C0567940C80F338A027041D066F243C4BE04C89C00C34B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660160, "uuid": "55649bed-b3ca-4ef5-af1f-7abea5ab6bb3", "value": "3:mKDDFRK3LJJFIf9oM3KbQqPJH0cVERnaetmAcLhzAK5DFBOWBzZYmP87A:h481R3KbQO0cPzD5P5TYZ7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777660160, "uuid": "9e289d49-07b0-44df-b217-ac78f1b591a3", "value": 172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777660160, "uuid": "95bad645-fcbd-4c5d-bf85-2eb521741040", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660160, "uuid": "62825049-7e76-470d-b93a-694433a6f12d", "value": "meu_script_gerado.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89cdb87f-4571-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777648937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648937, "uuid": "d7302f69-1b31-4b1c-8d0c-f2d8cecdf128", "comment": "Malware payload", "value": "4f1f28ca1e42fb451e0e073ad04a059c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gumdrop-lunaforce-cfd", "colour": "#BBB5A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648937, "uuid": "1dcdee7b-882d-4605-b989-33821cd39762", "comment": "Malware payload", "value": "6ab0a51adc1ba6c83d4178e5de92b3d61b57e2bcdf3f142a17087815548d5e59", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gumdrop-lunaforce-cfd", "colour": "#BBB5A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648937, "uuid": "f90b1a0b-f5e1-4305-9556-b2c0c9c57862", "comment": "Malware payload", "value": "e536d8ae1b42bc0cae9462c1ba441fb451cb20a1", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gumdrop-lunaforce-cfd", "colour": "#BBB5A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648937, "uuid": "2205bd4e-6872-4ed2-9b10-70c051648a46", "comment": "Malware payload", "value": "911909b05bde39958314ddfdf1821d3ea70004e7998f9d30dbbdc283f347ce9cb32c3f01b694a312b3feaa8a28634088", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gumdrop-lunaforce-cfd", "colour": "#BBB5A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648937, "uuid": "f472d0b8-902c-449b-9dbc-71044879749c", "value": "T12BC69D12B9A190B4F4A73231743D673D4D327EA29B3585CF86902CC45FB87D2A43A76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648937, "uuid": "0514eabc-0646-4e40-8e4a-d7598354c484", "value": "94d37a0d1c898f2b42bf782e2bf4bf1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648937, "uuid": "f49d3471-0b0b-441c-aa89-a4d2320e20ea", "value": "196608:960uogizwsYhU1ygeVyiLgBOA7pXaJ/BlW7mrAhS6qiT+xE3Bt7xMbZiWR6muraY:96ZuMBhU1ygeVyiLgBOApaJpYirAhS6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777648937, "uuid": "e80b3825-36d8-4d2a-92d7-a4fd34dd97b4", "value": 11954104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777648937, "uuid": "ebc046db-404e-40c1-a218-87dc03ed9633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648937, "uuid": "63438ad0-c137-410d-a2a1-bb9555c3041a", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a83f02-45b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777677547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777677547, "uuid": "7676ee77-3305-4116-a5a4-216c2f72eda4", "comment": "Malware payload", "value": "c7e96d500180e2742d3b353e97a60e1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777677547, "uuid": "9959a2f2-2a5a-4633-89c7-4ef7f4f2df61", "comment": "Malware payload", "value": "6b6c1bd77604a85b0abcd98103eb738ca94cc1fbf74043f62ed95ec5561e507f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777677547, "uuid": "a0768d49-c85a-4098-890b-feaf1a7fb402", "comment": "Malware payload", "value": "ab8182eb656c2db4ae3e6e1c0f4dfdf4cb34917a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777677547, "uuid": "2cbbedc9-9c4c-4ba7-b932-8c1b59a88a12", "comment": "Malware payload", "value": "3d63c1d7d52f3e98e5c89802164369f38a6f5d1ff5350c05f279ca7f5bc7e5d018ad86fd2cb547a6b0cab799de21d748", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777677547, "uuid": "b99d564f-bf9a-4afc-906c-591e5306ad47", "value": "T1A317BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777677547, "uuid": "88474fef-d2b2-442d-bb32-06e2e6629db8", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQC:cqYUQuVDt0TZEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777677547, "uuid": "0e3906dc-e36e-4396-991a-2fce6ec03750", "value": 19005440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777677547, "uuid": "855daa5a-97e6-44d1-a2f9-c86cb3f4e033", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777677547, "uuid": "e8b48776-0019-4491-bdc7-459339dc9587", "value": "6b6c1bd77604a85b0abcd98103eb738ca94cc1fbf74043f62ed95ec5561e507f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a03112c-4573-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777649581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649581, "uuid": "978c7622-5b32-420d-b7d4-6fed457118c0", "comment": "Malware payload", "value": "df44cc8834d2ad726febe1e73da4bb63", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "raving-cielora-cfd", "colour": "#6A9C9B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649581, "uuid": "2b0766fd-43b6-417f-8ff6-6422c19eb83d", "comment": "Malware payload", "value": "6bb5947e17dcae0aa404c1a52af0ea0cc1eaf72edf5bb3274bfaa57856d7eacc", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "raving-cielora-cfd", "colour": "#6A9C9B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649581, "uuid": "8aad9a4f-c17b-44e8-aa9d-aa27a30640c5", "comment": "Malware payload", "value": "4b0204fd6fccf765e1dfda8c13ab14e571bbd84d", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "raving-cielora-cfd", "colour": "#6A9C9B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649581, "uuid": "a132902c-5810-4a5a-a8fc-53b5cb92cb28", "comment": "Malware payload", "value": "e5f3b86f9d8f63108fb107bf2203f594c14a0d791330a52649305161981a4f3bf541c56d8d6ff38abbc3abc4700bb38a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "raving-cielora-cfd", "colour": "#6A9C9B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649581, "uuid": "8d7b800d-ef5b-4646-86ab-b4f5d4d20709", "value": "T1A5955C40B9D65C71D78065301966F2FB6B3754090F3DBB83CAA1BEAE7C7F6A10923258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649581, "uuid": "b9857beb-0618-4058-89c5-b161ecb97f6a", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649581, "uuid": "c974dd57-b78c-4fed-a118-bed8a25ed0b4", "value": "24576:ey6nDTU5tCcBYi2sxz3GJL3X9PTxvS8X9LaHUgVz4EdLg7PGvgec1/yPY5xTxYKt:2q3X8X9LhgVV8SE1aoxYK1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777649581, "uuid": "80e84a29-aaf0-4a26-b72b-4674909844cb", "value": 1941160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777649581, "uuid": "58612e6d-0b1e-4c3d-b33d-251601cd8a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649581, "uuid": "afd28ee5-16c0-47f2-bbb6-a9de4cb74332", "value": "WW26A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c835c21-4579-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777652189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652189, "uuid": "ebe9cc11-fbd7-432c-be6d-0295a4b175f9", "comment": "Malware payload", "value": "ca5bb3ee16c55cf2f5b7ae5af2f7f739", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652189, "uuid": "a5deb980-f81b-438b-8a64-d7fdb640dced", "comment": "Malware payload", "value": "6c24fd1d42848f3bc20f99e2416a7258acb5948a7b99530d5bd5a6fdaa5e915f", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652189, "uuid": "019ad814-52d0-4581-b659-fe2d9a3c5e40", "comment": "Malware payload", "value": "3c0711dd301f64761b23912a67809597df3e916c", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652189, "uuid": "38c7cb2e-5bb9-4c80-89c1-9f397f7fab05", "comment": "Malware payload", "value": "84e98430e24b1c6a501c27beb35b332c0f2dfafd0a384513bd227a713157ac3539c1ba403483493c5d78863f608eb022", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652189, "uuid": "345a6e0f-8113-4a60-a6c0-89761dcc6e6f", "value": "T1E4E28E44121184F903975739646A00D89FF83CEFB6A8E7CFBA1E39293E1892D747A974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652189, "uuid": "70b41d96-8711-4b14-b45b-0696d63f6b6a", "value": "768:uIsg5Vlv43ZE03ErqS1fRKuyKmGtdX8t9CkD1kjtmBJ2NlylWM1c5hOY:fvlv4pE03ErR7ZmWNC9CkDKjtHByc5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652189, "uuid": "fa7eb369-09f2-4292-979d-0ac601e3b745", "value": 33680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652189, "uuid": "ed85bfcd-0dd7-4e21-a755-d8a9ff9ce1c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652189, "uuid": "634d21e3-ca70-4d6c-9a23-8a7ee64a2d92", "value": "unihu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe18601-44f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777594985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594985, "uuid": "29282769-8eb9-4f78-87dc-53ee12a9b016", "comment": "Malware payload", "value": "94b39a5ca7cfdd28ad8a4c034d9003b3", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594985, "uuid": "602b9e34-c9ec-4378-b8b4-c5d010c30ca9", "comment": "Malware payload", "value": "6c63c5184c9b22fd08da7855099defdc321780fd9b97be572f7e70ad4410cc21", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594985, "uuid": "62fa5559-1b2c-4981-8ec1-d9ec51a46128", "comment": "Malware payload", "value": "4a836b4701ed09eb253785f7757d295c92ad3ba6", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594985, "uuid": "cdcc8e2d-29da-49c2-9eae-f77e423af745", "comment": "Malware payload", "value": "76fdb658abc19dc48bcacda51f42c125cfb34ec1277ee02a511b028babbcd6beeca671bda85b9948dd5602d3c4f1ef1c", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594985, "uuid": "6eada286-8b65-43ae-88ee-86b6b194524b", "value": "T1F2C61233B28A653EE06E5A395E729210553BBB116D138D5AD7F4085CCF291A03E3FB87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594985, "uuid": "87dda17b-5823-445b-9a2c-fdb9b6b0e788", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594985, "uuid": "529c8ae3-2a9f-428d-befa-b573dcdfc327", "value": "98304:PL8NcDJx286Gw5wiH6+/A95NJGzWKmVot68m/PsvxFzMfRpUUbSMK1C:GaSrwC6+/AJJGzWxVotQPspp0XbSMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777594985, "uuid": "d81775c9-1cc9-403e-a65f-6add663744fa", "value": 11779335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777594985, "uuid": "4439cc50-adf4-47e9-b764-aa73bafda52e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594985, "uuid": "988abbaf-eada-4c34-a5f8-f64673331de1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5917652-4561-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777642219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777642219, "uuid": "62cdc4d9-1f39-46ab-a02c-5f4c8086e5de", "comment": "Malware payload (AsyncRAT)", "value": "a734be30038f51efe28c1c019987a83e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777642219, "uuid": "3bff414f-4ddd-4092-81a5-33b3959ee01a", "comment": "Malware payload (AsyncRAT)", "value": "6d23eb561ad602dd178fd4c0fdc63d145df645ff0dd68d8ce123dc868ff29f65", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777642219, "uuid": "4bdd3de0-43cf-41e2-bbd0-fffb58b181fd", "comment": "Malware payload (AsyncRAT)", "value": "f76dc0b1b75371c66a5c6b7f72ecdb22ab3c536a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777642219, "uuid": "dff50647-87f3-4988-9d52-2bb5eeb0138a", "comment": "Malware payload (AsyncRAT)", "value": "4c0d5e4d6641ad91aedbe657f4bb16d700349553ec63fa7dc4a17395a4903f08158acbc27bdf52c997a83aa2c9032c06", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777642219, "uuid": "f7302685-8243-48e9-8c4a-471a359144d4", "value": "T16C342894AABEDDA7C78E4BBBD010E20253F44657A5D2E386D4109AF4AC8B351E703377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777642219, "uuid": "33dab1ca-f358-4bea-8d01-8f64229210f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777642219, "uuid": "d7aada89-a4dc-43fb-ba43-51b753c08505", "value": "6144:NE7ysO07pM/OoA0TQsPUBGralhvL4gUN:OzEO0RVaLzD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777642219, "uuid": "7db48266-b53f-4a48-a853-d01ca260c145", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777642219, "uuid": "dd2f1233-4929-405c-a796-bb7dce95bfb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777642219, "uuid": "d21c9645-b746-43ca-8227-b86f0676fd63", "value": "AsyncClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56e0d4c-45b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777679558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679558, "uuid": "a75df907-39c5-47b4-9e92-9c73766841e7", "comment": "Malware payload", "value": "2562fc1793bccd255016f2ed066485f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679558, "uuid": "dca233f6-81cb-45fa-a896-710587f5be57", "comment": "Malware payload", "value": "6e7560adfa5a7096912e137c47178c4baa92a1054916e6c20768b9b75f07d6f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679558, "uuid": "ae4479eb-62de-4b2b-b84d-e90e15a5b446", "comment": "Malware payload", "value": "352e732523dbd75bb8818e5dbc5d6dad1b4cf025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679558, "uuid": "b9245494-ec47-435c-803f-601c1b18eb33", "comment": "Malware payload", "value": "c55332544586112eeffb6ede8586d815556b899d618fad9ce23c40f179ef8833648a41aa7e7ca45da8ec53d603cd7cd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679558, "uuid": "af75fe76-e157-409e-94a4-873f49c98913", "value": "T1C6E59E0A7D9204F9C15AA73188EAB7447B76B8280B3923D72681B2743E377D05D7DB1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679558, "uuid": "ab00f9eb-e264-4a85-a36c-74fef4515bbc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679558, "uuid": "a811963d-0de7-4d46-b234-4bf2804d3cc9", "value": "49152:TTBsgGuADDM6Jj94SSaY9nxG+ahsfrm+Prb7q0dyMn:Tybvf/OgqTma7q0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777679558, "uuid": "a957f5e9-bac0-4e2c-bd47-34a3b319a7b2", "value": 3269336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777679558, "uuid": "d904d266-a824-4742-be83-25dee715c8b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679558, "uuid": "8748554c-2731-4416-88a2-3ac40cbf6a76", "value": "UncleTrain_w1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed39c824-4549-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777631924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631924, "uuid": "5cecd7ad-993f-4d85-8b92-04af180cbf70", "comment": "Malware payload (Phorpiex)", "value": "9f2ece357ee29ca0ca4fd372b9139653", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631924, "uuid": "69bef2b6-c1da-4b81-a1e3-b428d1a40c62", "comment": "Malware payload (Phorpiex)", "value": "6ee3905d8e71ee08d7cba90d3ef4d9ddb5aae1f977c272d2e0f0061e35319244", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631924, "uuid": "125aacf7-3b6d-44af-813c-1cf5706ce1fe", "comment": "Malware payload (Phorpiex)", "value": "7665fff9c45ea57ac1dde9dd696e339c0ee6daa8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631924, "uuid": "81070e0c-7ea5-4797-a9b5-daf1c3217558", "comment": "Malware payload (Phorpiex)", "value": "524ee6fd08bb7b9e26782ce2a4315806e1ecf925a9d0300165d92e9d668fcb5e8c283da6c516d7ab53a52cba4692b332", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631924, "uuid": "359dfdb1-d733-49f1-9dce-211534eeb425", "value": "T1AC823B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631924, "uuid": "8925cc9d-c16b-41bb-a5cf-3017e0039885", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631924, "uuid": "c8caac82-6852-4388-bcbe-02a2ec2c4b5f", "value": "384:JI78VGQic1Kwvw077u9NHu/gBhav8U9c5:SAE0769Zha0US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777631924, "uuid": "7a49b40d-17e3-4462-beee-4b54fc154f74", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777631924, "uuid": "606a0e69-2ab8-4e07-86fe-0eee0ded15f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631924, "uuid": "08a457fe-b38d-4b29-a8a5-bcd7abd9da81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c73780-4544-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777629599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629599, "uuid": "5e1f4bb8-4cf1-4442-a41e-7f9ac918499b", "comment": "Malware payload", "value": "3b085a6af36749d37ef869bdc23a3018", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629599, "uuid": "6e2d2de3-1774-4865-8f9b-0e2a695e3af0", "comment": "Malware payload", "value": "6f267fbd4ac2ec09001acf5f05bf771f2aec57a3b9fa446754dc88a9c13fb5d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629599, "uuid": "142276c6-2415-4783-9cdc-f3ffefab9d4f", "comment": "Malware payload", "value": "f44b46d977a4c8f4b1d22da31ad7798db65c7308", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629599, "uuid": "3c722ecb-2548-40fa-a9a7-04358d62305c", "comment": "Malware payload", "value": "e72b64682008aa25d61c1dadc50d88ee97008e60c54d64fb9f9662233018ec1de0e54a3449be3d628ffc63ce905db2e6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629599, "uuid": "a4207fc5-45ad-4507-ae55-8c6bd0ce8b41", "value": "T1F3736C78FC9DDCCCFC86C649C5BE341E5E6CB52B26DD348400690A25F102A95BBA36DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629599, "uuid": "81661ee8-f566-43d7-826d-154e2e73fd0e", "value": "1536:Ru4VZ/ptDQy1RYIMo3JwOXW0nUP7XGp2t1j9wvNkZuzl5bc0oFoTbs6Bb+x:Ru4VZ/zDQyyI4PipU9w0ujbc0oGbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777629599, "uuid": "01555870-3d0b-46f9-b639-1ba7c627ec7c", "value": 75321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777629599, "uuid": "3ab13428-0009-4d78-aefa-93cf60f907df", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629599, "uuid": "e1d2e697-4044-420c-800e-158b7b5f2d66", "value": "6f267fbd4ac2ec09001acf5f05bf771f2aec57a3b9fa446754dc88a9c13fb5d5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404c0068-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653108, "uuid": "9201249b-315b-4d39-86c0-b9c873f97855", "comment": "Malware payload (Mirai)", "value": "a47ec375fd1e778c7c4d66ba8aa83761", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653108, "uuid": "9e4815a6-3d78-4b9c-b06f-2bd5e7805a6b", "comment": "Malware payload (Mirai)", "value": "6f51c023fa41a2a24a4d95cb0660df2a40c7ce2974a2b8800afbfd0be930c043", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653108, "uuid": "395de7dd-2474-428e-99a1-e28bad1246e8", "comment": "Malware payload (Mirai)", "value": "c26f3dcf1d842ee671cd5707653e6d7759033997", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653108, "uuid": "0b7c0207-0bf2-4d0f-ac79-32004ec0e999", "comment": "Malware payload (Mirai)", "value": "88c2aa1a24fcab6b4db67307efb458873715bb04545f2697dbad5ca1ad23215d676d959f0be41dc40ceb849f1e9a6041", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653108, "uuid": "5c8f0d4c-39bf-434b-9a6f-08194999bbc8", "value": "T1B2241986F8C18F12C5D022BEFA1E128E33135778E1DE72129D255B61778A9AF0F7B605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653108, "uuid": "ecb3dde1-54b6-4a11-8a4b-e0f7dd888167", "value": "3072:pEOP59SVpu7zMpWq4ksA9zX2PU6fHrJXOR0nouadaUqXdGQnRXzPE9aoo:vPyVA7OdUPZjJXW0nfakfYQn1PE9aoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653108, "uuid": "e04c9305-9997-43e6-abb6-921dfbe68228", "value": 212444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653108, "uuid": "2422081d-c383-4599-9c7e-774d6ecd0d09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653108, "uuid": "74881940-399a-46b0-86c7-09630ed305de", "value": "vaxbot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa263035-4509-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777604323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604323, "uuid": "36c46a2f-3c48-4c3e-a5e5-f94dd4d4b614", "comment": "Malware payload (Mirai)", "value": "bf8ce07245dbda97d74e9f35992acab2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604323, "uuid": "a1befe3c-6901-4e06-911d-0714045d4932", "comment": "Malware payload (Mirai)", "value": "7097ac173c2b99772ed4080c0358b007b1c2349203dce4945cb615789d81af30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604323, "uuid": "4881fb66-2a71-4faf-81fa-282d147d25ba", "comment": "Malware payload (Mirai)", "value": "8330b1b5147a0d153d95d5c8a7d48a2b2c93be81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604323, "uuid": "00eb2768-53bb-4b22-991f-b7187c9eb212", "comment": "Malware payload (Mirai)", "value": "ed9b7df6d9dc4eea144881fd6d78431c759c6f21d64ad8adefddba372f1dcdc65582c5b9434a08d54df78c686a0955dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604323, "uuid": "c20f0bf1-3470-4d8d-82b2-a5a753552e4e", "value": "T13B234CC8F543DAB5D81205743076EF329F36E1FA1259EE97E3A89173AC93602E507A4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604323, "uuid": "4d12aa8b-1a2c-4ef9-86dc-e20863473df5", "value": "768:2y2Dj00VqhG3mucla9wMzh95yXqSuWaJCkj15Pwi+VJIWsvKQLDJNFv:2ywj00kAWLa9wQQuWawkj1hwiwJID3LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777604323, "uuid": "295dd13f-6f55-4b4a-85f4-8fca77758852", "value": 47828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777604323, "uuid": "997ce466-ae70-4e89-a69b-95d825e91c0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604323, "uuid": "2ae8884b-854a-4861-b742-a02e62fd3ed3", "value": "botx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e3a21e-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653113, "uuid": "251fa657-d086-4610-aeea-bb18885525d0", "comment": "Malware payload (Mirai)", "value": "902c6906abc97cfdf1f1c1d3be645590", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653113, "uuid": "16c3384a-cdb8-4ee8-a8cf-efaef15a190f", "comment": "Malware payload (Mirai)", "value": "739048dd6f5dcdbc9ab134bc4d1ce5d6e5b83a0e3021f9d5d0091b80a2936b7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653113, "uuid": "f940224e-0138-47ab-a3c1-a352236a59e2", "comment": "Malware payload (Mirai)", "value": "9ea83dddfdd4d0dc439df4050924ab0fdeedd368", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653113, "uuid": "7cbb3615-bdae-4c4d-b4ba-d7e9662a94f0", "comment": "Malware payload (Mirai)", "value": "fa2241cefc6c306126f0b4e1454dff60f6eb156cac8a3620fa9afd563e9cd2c7390e3993c098dd9549f7e469531fc8b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653113, "uuid": "53a45f2e-e2e8-45d7-9d05-147c8938f55a", "value": "T18B442A86AA818E13C4D627BEF69F424933339754D3E7720299296FB4378779E0F23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653113, "uuid": "9a23c21d-53c1-4906-84cf-11cac99e1c28", "value": "6144:jXNChblIydsu7QqHa34yNEgJfMftzYKr6cgNM/RlElyVv:jXNChZIy9QqHa34yNEgJElHTg2/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653113, "uuid": "ff769739-140e-42d9-9233-d9b38d39b1d1", "value": 259810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653113, "uuid": "14b8a11f-e5c9-4bc7-84dc-bb68e65829ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653113, "uuid": "a2dd9ceb-3570-4d88-820e-3f2e4e56b0bb", "value": "vaxbot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32188e7a-44f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777593814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777593814, "uuid": "d35640d2-9273-48ea-87b2-da77490d6e59", "comment": "Malware payload (Gafgyt)", "value": "7d07f3ee6df98a71264f9e30d22be62c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777593814, "uuid": "42973894-f97d-406c-a937-76de9aa60011", "comment": "Malware payload (Gafgyt)", "value": "73d91d3189619b1f1b3810e7e6ac7808033577c8762c5b066995688cc452103e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777593814, "uuid": "d039705d-4c36-40c9-b849-b9c15256da30", "comment": "Malware payload (Gafgyt)", "value": "b438661b936b2a75248108846ec89bea863fddd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777593814, "uuid": "ce829f55-660c-4da6-953c-a76b78cfabac", "comment": "Malware payload (Gafgyt)", "value": "74bfdce3e88f8da6a113e3b397aa769108ad18ca75e33d28f5647d21bf3b77f66db910ab017a22bc504f24483a6a1429", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777593814, "uuid": "cfd77c09-3055-4f6f-855c-af5f6092d20e", "value": "T119E3D706BF109EB7C81FDD3301F98B0124CCB49725A53B6B3674DA69BA5A58B05E3CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777593814, "uuid": "9d392a4c-ce66-4cfd-8e36-1f01cfbd5c64", "value": "1536:JVYAb4Bo+0NFgNShEyX2zJuoaZ8jCSRCt6+5Jx0XJwqo5hspJ6xD:dthEdzPasCB/eBo5hspJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777593814, "uuid": "f8429f18-4c71-4fb9-87db-038a58f5c89b", "value": 150112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777593814, "uuid": "89667df0-5a33-4100-8b89-84ea302d7951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777593814, "uuid": "61d1a0cc-0415-4551-8665-b80dd4390b81", "value": "FBI.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ade50f9-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777636000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636000, "uuid": "222c2503-4260-4809-8a11-760069b5cf97", "comment": "Malware payload (Mirai)", "value": "6aa3418968747a9ccd61ea33a10bf860", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636000, "uuid": "683ad085-78d3-4825-9f6a-89a64244ef53", "comment": "Malware payload (Mirai)", "value": "753d65190b191d54466c2d70c18b322780eaf3cbcb628646e6c4c416a4581844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636000, "uuid": "433a9e18-393c-478a-bb98-add991b68dce", "comment": "Malware payload (Mirai)", "value": "f5aae4478c6b2d8398e48040956f36133657b230", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636000, "uuid": "b70c5faa-c773-4c0d-98d3-d39075f59ab3", "comment": "Malware payload (Mirai)", "value": "806ff798a35bd2e4dddc208df96b937bfc561a5521500fe01386a625f61b474eda7d2f807d32792a6567445bfcf05839", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636000, "uuid": "cae9661d-a68a-4756-a79f-52ded74f78e0", "value": "T174C35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636000, "uuid": "ebd7885d-ef4a-4e46-a621-01e78a320f82", "value": "1536:UVAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK30:UmFmSmviqS1Bs0+Nd6lAqktNMxSNbm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777636000, "uuid": "a9ea20ca-e15b-4a62-9b81-f592176dce09", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777636000, "uuid": "552158ae-8e6c-4393-809c-b2e1af3c88cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636000, "uuid": "529ca598-99fd-4b9b-a68a-66681a55e50d", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c922c1c3-4549-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777631863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631863, "uuid": "6b9ccb97-29c6-434c-ae59-02f74783b74a", "comment": "Malware payload", "value": "561a006b683288bb79182c6ddc431a7e", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631863, "uuid": "a0c8397a-c764-4a05-83dc-3d344f21159d", "comment": "Malware payload", "value": "758769a19ce049454101441e8d9e29b02c13a62146a43fa7b5692cff09ddf302", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631863, "uuid": "6d03b001-1fd6-414a-a3dc-9a205adf4866", "comment": "Malware payload", "value": "e7cf1f4fe576c6ca6cfac6133868b38809433a56", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631863, "uuid": "04f99145-ee06-4169-8262-b459afbae829", "comment": "Malware payload", "value": "b3dc8628bba6192cc3fe0089fb6db31601eed5505d3ecbb9fd5ae74bd139238c064fcb40dace5ca9f3819a566f53193c", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631863, "uuid": "beac5ae7-890c-47cf-a414-0107f1b64a95", "value": "T1C165391BBCA409FAD0AA533288775191BBB2BC450F3117E73A60B3782F726D49E75784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631863, "uuid": "dca97fbd-8ba7-4d08-8b33-9223010c0bd1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631863, "uuid": "ebf96ba0-a172-48d2-9fbb-3f816c08a701", "value": "24576:DaV0vBthnksTAofdF05pF6Q/NBele5zK2I/LD6e6I:DamJtFkCfQ5pRGnvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777631863, "uuid": "d11e6d1c-de4a-4ec4-aca2-e4dc32253fcf", "value": 1538560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777631863, "uuid": "8f8fbd54-3872-49a3-aaa7-f12c4de755fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631863, "uuid": "8722b87b-0b90-4e63-a6af-4c0f01eb3628", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36d6948-4586-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777657999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657999, "uuid": "81297ec8-a1f6-4495-8f36-30f23b9f79e2", "comment": "Malware payload", "value": "3ab73d444fab602b7e7cb694dea9033f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657999, "uuid": "81071a33-7f42-4b3d-b11c-c83ea278b696", "comment": "Malware payload", "value": "77835178bde9d21b590451a97309ed7f1aaa8cf1ebf851999e4ea8082aba9ebf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657999, "uuid": "2abecd37-cb52-46fe-a689-8c75b6d3fe09", "comment": "Malware payload", "value": "81854f24e9887a1537f682e39eca33bb94d593bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657999, "uuid": "86676d9e-2595-4ce0-961d-71a43db209fb", "comment": "Malware payload", "value": "a65dd974808e99a6ee012c51ae7dfb7068742a10fd11b7873cec30264bd1ccd48afb8436a123db2763115cfd6f42a33c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657999, "uuid": "b736d026-c2e0-43a2-973c-c96f1ee9c0dc", "value": "T118C1B643F587CD32D2A1123CA447E3311A61D485BA6DEE17B3A8C1D6A893B5C621FB63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657999, "uuid": "dcee2a75-7574-429b-8112-91f2fa265f4f", "value": "96:fblHawPdYIvjuKHCzSkqRotlLtM/dYH6yyUkRvWRPa/vDJbeU+ZeYKwUdqgxQAqc:fBZPdtruKCz1b/JM/dy6yS50YvDJbeKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777657999, "uuid": "d7a74f25-a222-46e2-baae-4dcd66106fa9", "value": 6020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777657999, "uuid": "824e6b5a-a1d8-46b2-916b-6e4993156c58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657999, "uuid": "174318e4-9135-41af-bbe7-f06d1df5d9f0", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be64b575-44f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777594479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594479, "uuid": "d2cf2487-1568-46b6-982a-ff1ab9221397", "comment": "Malware payload (Gafgyt)", "value": "29464a65ebb8665af6b006de5580763f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594479, "uuid": "40c68498-3190-4b47-bd5c-41152bc49395", "comment": "Malware payload (Gafgyt)", "value": "7845623695b34d09b57e0aef1cfdf588ae2e8df334d35253e09492404aaa5e87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594479, "uuid": "44cd1d4d-6a46-4ac4-a03e-66df767d394f", "comment": "Malware payload (Gafgyt)", "value": "32d7cdae32858b024886850b93a5914b7fd0f0b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594479, "uuid": "5c5c5b6b-7185-475b-95d7-2e9ec00df512", "comment": "Malware payload (Gafgyt)", "value": "c9707dddb4918018d3c35e3a87b20d6df361f14775724dd63a460e9abb8ff8c98b0c8b022c907100614d3cab50ef9eef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594479, "uuid": "27012531-43bc-4cde-afb3-a28fbbc86e3f", "value": "T126B32A17B9528B12C1C215B5FB4E964976136BFCE3EF3212C9249F603B874EB0E2AD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594479, "uuid": "089dbb86-9789-4412-8d7d-25912829f02b", "value": "1536:KLnB+q4MiIGs88jUQh5sl+aranNTffIpP1MfirfA6RJZPHjRS5SY45h0pQBAr:mtJ8Er7GaNz6fA6RJZPHjwwN5h0pQCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777594479, "uuid": "004268fc-3a6f-4d52-a9f5-dfa42c541790", "value": 116124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777594479, "uuid": "165220df-baf3-4554-8dda-3d4402f9a142", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594479, "uuid": "9bd6b104-0f3d-41f0-ac32-703f24b14069", "value": "FBI.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e7005e-457a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777652987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652987, "uuid": "9ec1b696-256e-4d0d-b283-94c723dd341c", "comment": "Malware payload (Mirai)", "value": "8123c37532105983374a7ba1e684e38c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652987, "uuid": "fc9fdf9c-ed22-4265-b093-65c237c107ed", "comment": "Malware payload (Mirai)", "value": "7979f43fd46c9ac1551ededecca703d40df78ceb46aadaee6af916ef6c49a07c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652987, "uuid": "a779c1a9-00fa-41d2-af4e-c757b903023d", "comment": "Malware payload (Mirai)", "value": "6e412cb1ec602e53787e6c377b80ed53acfb1066", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652987, "uuid": "3e56ce95-c669-4703-beb2-acf9d7154062", "comment": "Malware payload (Mirai)", "value": "14275a12419fc14df086cab0a9b5bfc2d5621ca1e7465347a5fbde8c1e08b429c9b263ab3d446790b367398de75d2c06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652987, "uuid": "3ba0d057-9f5e-4fe6-bda1-e7ed409eb821", "value": "T10E03F28BF093B811E594007DFB6ED62321AA1BB495E5B924122101FAEFC1632F5F95B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652987, "uuid": "3cd45320-0c37-4b4b-bd89-b2998d8ef93b", "value": "768:6gaw6f01l1QX7VLtF+T5ZWbeeCFJWldoWYLKmgIMiWvMuMfs3UozL0v:jaw6fQsX3F+NADQWldCKmgniWv8Szu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652987, "uuid": "0f019b1c-617d-4e48-ac6a-ee9d43736402", "value": 39564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652987, "uuid": "d540c7ee-22b2-4edd-8684-8839c730cee1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652987, "uuid": "cce1acd9-e567-4244-976d-ff85c517ccfa", "value": "vaxbot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f605998-459e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777668112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668112, "uuid": "bb27b901-3aad-4a7d-a5fb-c7d911e9d77e", "comment": "Malware payload", "value": "edc0f6d90552807d7fa7a66badc21d4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668112, "uuid": "5ac208c6-af89-407f-a369-87304f563fe5", "comment": "Malware payload", "value": "79829515f86d7fa635c0344e891dd3139db8cf2154c3936b6edc6acf19d97451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668112, "uuid": "9f39da98-9b1c-4f93-a53e-7a14df190296", "comment": "Malware payload", "value": "41a057d20a2c3b38c91d2ff795f1db414d23a85d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668112, "uuid": "ae3e2426-1ce8-4a84-a506-96c295768269", "comment": "Malware payload", "value": "a401995b303efecc1fda71e987a990ba5ae74f346a80f079def80abe2782a35d9368303d9b6a3fde4d8e6b0886092906", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777668112, "uuid": "379525fe-d9e4-47aa-809a-00a023f86afb", "value": "T1ECE19E6E469A162BFD16CA310C12C4AA5E7B3C58BFC9E63B2D91D1C61A5601C4237B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777668112, "uuid": "e72a8e85-bbcb-4d5b-bf45-861fb704d6cc", "value": "192:GXFHByhcG9j4BDJC2fV7yjIcwse/FqcJ8:ahyf4Blbt1cbiFqcJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777668112, "uuid": "21e04c6c-2da2-4dad-be31-6b853d78e9e8", "value": 7200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777668112, "uuid": "19e27753-1afe-42e0-b12f-67d667aeecfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777668112, "uuid": "2bf6943d-902a-4bdb-a01b-c163c10cf0de", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3ecc74-4527-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777617077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617077, "uuid": "6e627d5f-fb21-44b3-bb60-ebf682328673", "comment": "Malware payload (Mirai)", "value": "46b8a2455488d252ef7dcfe08f95b665", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617077, "uuid": "1a124591-c2e2-4cf7-9ff6-4eb3e5c21530", "comment": "Malware payload (Mirai)", "value": "7b2fd5a35aac1591070f61e89e6b1d21fe6e09f5e8a8648c7557bfef86e1d3cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617077, "uuid": "a2174124-3274-4a1c-b825-2bb906a02b0e", "comment": "Malware payload (Mirai)", "value": "89a6b8654d17fee23b6ca5d89896425de3809cf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617077, "uuid": "7849abb6-249d-4c8d-8d7b-8ca749aa3d4a", "comment": "Malware payload (Mirai)", "value": "69cb66a5c7fc189e329fb57c04d7cb8462d0eeade124b2976e8db40d4080c87fb787e9b80c6903d247593dc5a80d0471", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617077, "uuid": "6bb830f0-a0b5-4a1e-af38-fd9fab7efdc8", "value": "T1CA233C49F793F1B0E94B4671105FB77E9B348E025024DE3EDB94FE62ED32A12641BA18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617077, "uuid": "85ec8a69-271a-4808-beab-3da8ed8cf258", "value": "768:qzDzNc5Sy74m9Nebof0vHyUswV6UQR318fzlLBFqRq4qDv9BFv3+Er:Wf6fwbosvJ6Uk318fzldFzNVhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617077, "uuid": "1a4b15a2-b866-44ec-a474-d0fc1c75432c", "value": 47056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617077, "uuid": "a2f23ca5-01ee-4f9a-ba82-9a109b31ed76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617077, "uuid": "b7b6d825-6f8b-4f58-ab22-3be7e4845be5", "value": "rage.x86_486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c13ec4f-4562-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1777642310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777642310, "uuid": "2ab2e385-ee3a-41ac-baba-493283732c54", "comment": "Malware payload (Joker)", "value": "a08a329fd013b47c1dd14b5ff368c1c8", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777642310, "uuid": "adaa1075-e423-4438-bd71-6db4513199c9", "comment": "Malware payload (Joker)", "value": "7be69737ab9db8b2383177dff697c1f6ac8b18ca40f0dc3b2b13f5310f51e9a2", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777642310, "uuid": "4e7e5ef8-5297-4f59-9374-c41d8afa7cce", "comment": "Malware payload (Joker)", "value": "064897118c3ed48100d284645c6ad7acc1121048", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777642310, "uuid": "05ab13d3-c8de-4833-807e-20956408a36e", "comment": "Malware payload (Joker)", "value": "029eb652971084775f0823cc5567ba156e414ba88dc358e84560ac420cb00c5063141255285f16cf7f31eb14f0ed6e0f", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777642310, "uuid": "f3428c69-30b8-4843-867b-d28b0260cd46", "value": "T117571209F70DAD1BD982B17CAE57436272226C8D5250C35B7D11B229BFF7AD8CE25B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777642310, "uuid": "766402ff-78f7-46d1-840e-da45febba163", "value": "786432:+LIYXFuQs1CEdKfqsf5FpvjVvvxzEkhzqNp3lHMm2:OuCEWq+FpvhxzEkRyD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777642310, "uuid": "9136160b-1ae1-4bdf-b20a-f9b4e7e223f3", "value": 28535669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777642310, "uuid": "06cb837d-a7e4-4667-91a3-5eea41dd93be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777642310, "uuid": "1296b264-6d47-4aca-b64a-3c6f8dfa0a1c", "value": "Box+Junk+Clean_100.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d247d16-4501-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777600731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600731, "uuid": "cd471389-ed31-40b4-9a3a-c84c865dd515", "comment": "Malware payload (AsyncRAT)", "value": "fc23bba5ef639e06cb745bf2ecb0290a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600731, "uuid": "435198a7-5b2a-4712-8e8b-f179effa8782", "comment": "Malware payload (AsyncRAT)", "value": "7d3c283a3c368ad2256972c42c36a439975e41421fc95ff3a568eb2eee7e2559", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600731, "uuid": "1028006f-b32a-4be2-b5e3-3d0e71d88e07", "comment": "Malware payload (AsyncRAT)", "value": "c54ff80a2521bf16368b8f671ee239e9c171e931", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600731, "uuid": "6d3e6ab5-9915-4d86-9cea-63811219ddcb", "comment": "Malware payload (AsyncRAT)", "value": "544b4df21bda1fb63fa8a161955c6e697dd9fb983cb5aad325456313702653816131423551dead1e71650239c5891902", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600731, "uuid": "8f68f5ce-07f7-47dd-9286-6e76708ee212", "value": "T112537B19BBF24125E1FF9FB518F12222CB35E6271D138B5F24C4019A2B17A8D8E916F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600731, "uuid": "6b42a9eb-727f-460f-b46f-0ee5f250ac30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600731, "uuid": "350ff292-a881-4956-8e63-99d27668a74e", "value": "1536:pxQZCT8uDB4wWCVxPTNNc0M9lkbIX+CPU5FGSOC9L:pxQg5DeQNRM9lkbIXNPmOCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777600731, "uuid": "0ed19c38-32a5-4c63-afa3-0a5b632fc6db", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777600731, "uuid": "5c980e80-c330-4598-81b2-72bb17efc9eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600731, "uuid": "50a8844b-3fdd-4b65-bec5-ad3519f950d0", "value": "program2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9f1083-458f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777661689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661689, "uuid": "b9e50daf-b726-4ce5-9dfd-a5ef94c9f548", "comment": "Malware payload (Mirai)", "value": "8a21e3c7affe5a56f26a851b65164246", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661689, "uuid": "755eac62-f819-4e67-bf20-12947d1c8b00", "comment": "Malware payload (Mirai)", "value": "7d40e30b8f450a071f07be874ef9537109f31f1f7012d031cf50a952cc7a3a23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661689, "uuid": "204225d9-819a-4a80-8423-d828f16560e8", "comment": "Malware payload (Mirai)", "value": "490e74a0c72df542b78453cb218cfcce756f0860", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661689, "uuid": "f76d9617-9f2f-4c90-b8d4-871d552fdb01", "comment": "Malware payload (Mirai)", "value": "d59c8f0742447785fb9bba9d4b8be331ca97ccaadd4c3a8d446e990049e69830c4f162823f28868f2cf9c4271705c0a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661689, "uuid": "884f16bf-ebec-4880-b9f9-ae6fbe0d7736", "value": "T19312CF5ADB274425CFD1A3FCA8684BE274364AE0925C4782B7C5ED2975E09245F04FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661689, "uuid": "bd8d66db-f726-459b-9e2e-76b4f33c3594", "value": "192:U95mWwjza5T/5UzqNErvMPLYN3CBCW9NQv6Tl:khwHaJ/6uavDCK6Tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777661689, "uuid": "9d93fd25-fca9-4761-aca3-ef28a42da743", "value": 9148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777661689, "uuid": "bfab96a6-b68b-4e02-a82d-be1fafa379f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661689, "uuid": "0173f40b-d535-405d-bdb0-b8826662793e", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961f0819-4544-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777629630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629630, "uuid": "3c05fe10-8b40-4b55-b9dc-353df390e22e", "comment": "Malware payload (Mirai)", "value": "8302915e466e0aba5cc7cfee5b88de5b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629630, "uuid": "032c60ba-dbe4-46bb-843e-931f00f23c34", "comment": "Malware payload (Mirai)", "value": "7d69ffa881ca2953defe4fb5320c7d007d81713ac22e1dbcf77221fdc4d2c67e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629630, "uuid": "626b338e-cc5d-40c8-b988-f8384364feed", "comment": "Malware payload (Mirai)", "value": "ccdd519871d19484362387e2ee47723920c0691c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629630, "uuid": "e9a68fea-f4d6-4c25-9f1f-5c33b15da911", "comment": "Malware payload (Mirai)", "value": "ba792434453724248b250a1327c18569ce18478248064019ab58abb34e0bb29300409c8fb4ce7ef84ac72eea93ca5bfe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629630, "uuid": "1b40fdb2-b2d4-4d00-8d7a-2190a5d58cb1", "value": "T121C33906B4C2D8FCD86CD2B46B6F6135C860B168213075AE3794BF563A9CA107F6FAD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629630, "uuid": "9fd56b61-94a2-4124-9503-32f7f392b5b9", "value": "3072:YCeMiZjqBSQ6xLycZYco/1U1stv8O0ypaTdg1j1FFFFFFFFFFFFFFFtFoFFFFFFx:YHPjphYV9KsDR/1FFFFFFFFFFFFFFFtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777629630, "uuid": "f8f0f1bf-3063-4952-a20f-632fdda7abbf", "value": 123672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777629630, "uuid": "16d493fd-7a9b-45b3-9889-69a59bbd2b51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629630, "uuid": "7d2c8116-154a-4f0f-9052-e7e08ef6ee95", "value": "7d69ffa881ca2953defe4fb5320c7d007d81713ac22e1dbcf77221fdc4d2c67e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f17e669-4584-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777656918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656918, "uuid": "f6a1283c-7a1c-46a2-a96d-54ea01f420da", "comment": "Malware payload (Gafgyt)", "value": "02f3ced48a6ad84600717021e92710d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656918, "uuid": "b48aa4e4-2b50-4d5d-b432-049b760fff1d", "comment": "Malware payload (Gafgyt)", "value": "7e3036c9dfdfa316f94a07acd0e02f11687f6290515fe100b95bc80955f2b78a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656918, "uuid": "4021d3ae-13bd-4fd6-8a69-43da31176288", "comment": "Malware payload (Gafgyt)", "value": "05b5f5f9b29f7ac8d487a369d6d598d3984e20d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656918, "uuid": "0f060504-1feb-4be6-95fe-ebee33f5b151", "comment": "Malware payload (Gafgyt)", "value": "74a758c632fb71e2a2a89931b4fe562242bd3aa21d8be68dec3a5f59b3a3da27f7a0252d2ea4871f53c5c81f94accf9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656918, "uuid": "d7ccf614-e23f-460d-9f3a-aa7ae80d0b19", "value": "T15C5301D100E9F469C622C3B5A1044F06628ACA927B05DDDC34CE13677D8FE9F5F956E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656918, "uuid": "e14b7a4e-bf1b-4ee7-a792-16da82560a23", "value": "1536:LznwRRM10ac1B010ZtaS4SV/zQUjsPwttl6oP6Lkg4azHo:XrREB5taUVLQlwtt01LGazHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777656918, "uuid": "6ee1fdb4-7245-4ecd-b98f-6dbebf24aeb3", "value": 60788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777656918, "uuid": "ba87b4a7-5d09-41f2-8c22-c64895994f72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656918, "uuid": "a531cdca-a259-4053-b56a-91b9d255897a", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f71892-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618652, "uuid": "83e17dec-47f0-419e-bd07-ae958ae8d829", "comment": "Malware payload (Mirai)", "value": "a6388f5e55b4a57ee6ead526b25a1ae9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618652, "uuid": "4ed53341-4c3a-4b39-a8bb-143cd6333190", "comment": "Malware payload (Mirai)", "value": "7f8b3150d010ecf159110a59cd0ecde84c5f7d98359d5fc97f526a7ce231bec6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618652, "uuid": "37d60346-69b2-44ef-ac69-bbf9eaf111fe", "comment": "Malware payload (Mirai)", "value": "56b6493627bb71847f4fabdd1eecf5b12aa183e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618652, "uuid": "4798612e-1dfb-4365-a58a-c9c5e6181159", "comment": "Malware payload (Mirai)", "value": "a3ff79def9bba2df7b79bc38ef1ebf42578442a00c616a384515e81e08d3d990c21784cc1bbe19a6971a4152d2ee9a9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618652, "uuid": "94fd5811-4697-4de1-8489-7ee333fd31f6", "value": "T1B0B33B06F5508753C1C3177AB69F561937232BB997CB33126A24BFB42FC17AA0E3A950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618652, "uuid": "4a9bdea3-62e2-42a9-8773-4938edfe1dbc", "value": "3072:udGs8aNAHiNPHS7fSir5hulKM7y1myjQUJ1UXpTn:2Gs8aNEiPir5hulKN1myjQUJ1apTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618652, "uuid": "81210741-9953-4a86-89ac-97eea8692006", "value": 115876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618652, "uuid": "2c8d43c1-aa26-4785-8c8a-d6d63c492f93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618652, "uuid": "3a988fdd-caea-4d6e-bee8-7d5ec3ed427a", "value": "hidakibest.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d4a67a-458f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777661810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661810, "uuid": "614d0831-46bb-4a61-8d68-d9f30deb569e", "comment": "Malware payload (Mirai)", "value": "50cbc94e4aa77b55f3bded7c21c10e65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661810, "uuid": "9974116a-de24-438d-9289-fe50d873bd75", "comment": "Malware payload (Mirai)", "value": "7f8b6b47382bcaf000addfd2d1dc342f30a57014f78c68e4f143eeebc6eeeb64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661810, "uuid": "34bc7c2a-f1dc-47f5-b036-d6fafe676d62", "comment": "Malware payload (Mirai)", "value": "9d12cbb364eb7230cb5b27faf4185e610f45403e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661810, "uuid": "4e3705c4-41d0-4c9d-87ea-ce021ab541fb", "comment": "Malware payload (Mirai)", "value": "5b1b0f324e21ff10a3697f4f91f50a742be3bbc6672f4d5f066a42d271fd9fb9605893f443b06d27a06b34c6bd60be2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661810, "uuid": "8e4dc03f-550a-4a33-91b8-ae07cbfe4bfd", "value": "T1186312EB9235BC5FDECC96389960137AB188D3D1F3B35900759BC18EA74A22FD408762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661810, "uuid": "dcd78e9c-b343-48e9-9c11-f57ccf12eda7", "value": "1536:9VUQ0TcrWCT3gcHB+cyepg1k/zJhw7nWAvnQGUgJViXZjbp47NNP:fp0T2WCbgc8bm/gCAv3Jwpjbp47NNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777661810, "uuid": "701fa70b-e2f0-4dc9-82be-5ebe87b27995", "value": 70436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777661810, "uuid": "249a9e03-0eae-4b02-80bc-e42d0ce6fc5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661810, "uuid": "8179988b-21fd-4948-a8e7-4484249f3ff0", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a34ccb9-4542-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777628590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777628590, "uuid": "2ee12502-7113-4e25-b8a5-d6254dc3ed77", "comment": "Malware payload (RustyStealer)", "value": "17d2c72a47841480ba25786e988709fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777628590, "uuid": "0018fe9a-a58b-43a9-971d-890f6af0b4a4", "comment": "Malware payload (RustyStealer)", "value": "8144f9755aa06cabec1685164efe0926ff53d5d429999225c26f3c88f964494f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777628590, "uuid": "b6ed8e09-b339-48a9-9b4c-78a210909ec3", "comment": "Malware payload (RustyStealer)", "value": "48083ce7470c57118ba5805a96ceace0d6d4d815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777628590, "uuid": "f5f70efd-5065-48a3-9e7c-80ca01056083", "comment": "Malware payload (RustyStealer)", "value": "b13c2342bcdaf9c140d1307748fb5c822dfd34dc87d69a51c73ee0db4757eceece0a3cabfc0b6e01519e3b78bae30c0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777628590, "uuid": "0a4c6b00-95f9-4b15-ae8d-268162747975", "value": "T1A46785AAC70DA5DCDF7E5241E662CFA7185AD32B58701A1D0A3C615C8A43E1318FF63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777628590, "uuid": "0b6fab85-0122-45fb-bebd-672aaa6a7ada", "value": "e4320db9e26ddbdd86d23d2ec1bc8428", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777628590, "uuid": "844bce7d-fe96-411c-adf3-4ffd51344789", "value": "393216:Q5oMjwxqruc6FTTpuTXp0pX0ymRYQRX/HxpVfALIVQdnbMONwIR+lF1r4tSAw+UI:Q59GqLP0TQTPRnfH+baIYl34Azmt2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777628590, "uuid": "de7e4ffa-a663-4028-b37c-ee7504c10b88", "value": 31140167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777628590, "uuid": "1988a5a6-711f-4a51-934e-84aa04635502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777628590, "uuid": "efc0cd39-3052-4fd7-9868-d453e30cc4a3", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f7df4f-4571-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777648873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648873, "uuid": "de57f0bb-b0eb-42eb-a636-6cd7ffeb8c02", "comment": "Malware payload", "value": "7a6a9d3b3500f46b6393be63e79016f7", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "turbine-grandauto-cfd", "colour": "#CBE61F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648873, "uuid": "25819d32-70da-4e33-aed4-4599dcc6f985", "comment": "Malware payload", "value": "82a3ba5caa5b2485aae01a593f7ab4a3068d6b7ca367743fff8c6f0e8e81ae69", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "turbine-grandauto-cfd", "colour": "#CBE61F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648873, "uuid": "c4059e0a-6fc3-404a-ab1a-6f87e8f64ecd", "comment": "Malware payload", "value": "abd5a35314b3cb85dc5518a0873f9df048f0aa2b", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "turbine-grandauto-cfd", "colour": "#CBE61F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648873, "uuid": "c8b922a9-3bf3-48aa-837d-174826c346fc", "comment": "Malware payload", "value": "f329ef001b9f179ec201f73121592b5bd9b37a2120d2c93b373b339c679839a5808b74207f00c93be19b341aaf885283", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "turbine-grandauto-cfd", "colour": "#CBE61F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648873, "uuid": "2aeab986-e6b3-4ee8-9e75-0660a7079570", "value": "T1D1C6338C34ACD432ED330BB62AB17AA8A67A62560B2F39DB3760457D4F354C5D530B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648873, "uuid": "ec72d133-4b2e-4f48-811a-ac33dbc2c124", "value": "f571ce9fba23794d1a3909f0c99bb208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648873, "uuid": "79d44c1a-69ff-4a44-8247-d63419efbbc9", "value": "196608:itVLHm4/hOEj58JZVkwvo9oHm4/hOEj58JZVkwvovoHm4/hOEj58JZVkwvo4:sVb5ZOEtUQO5ZOEtUQY5ZOEtUQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777648873, "uuid": "c28b7e4c-c5fe-4a48-92f9-4d3a79654b03", "value": 12270116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777648873, "uuid": "0149c178-3566-4943-9f32-80a118ab3b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648873, "uuid": "345dd713-d425-429b-b44b-86b39119bfca", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793247c9-4589-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777659217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659217, "uuid": "7b20b730-9807-42b6-a6ad-25afadd02407", "comment": "Malware payload", "value": "4a45fd496e313d2ed04155bec435b9f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659217, "uuid": "736fd79e-4836-41ae-9d39-a5d933d1d917", "comment": "Malware payload", "value": "830a23cfef8d43b49247e29b543d8c6214a7e549a017b7edc5259b09ed2e26ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659217, "uuid": "66ec0ab6-f92b-4dc4-8054-7bb4909a12b8", "comment": "Malware payload", "value": "69cbcf4417f1c1988d4eccf41c7b27e2809f6aa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659217, "uuid": "ede6f392-7bcb-4c26-ae68-876aaa688661", "comment": "Malware payload", "value": "992e006276531f954ef89bde3a3ce02efa020f9123e531dc396cdee36d446793ab6818f9333c3f56258e635bc0fffcbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659217, "uuid": "5127c184-231e-4c23-8b19-abda2544b55b", "value": "T14A12E96A8583D6BCCC6AC3BC4117BA39D132741D23ABB21637E8F62BCDAFC712509000", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659217, "uuid": "b24b9425-f182-48cf-a0c5-7e4b464d8118", "value": "192:GGXfG9ouw9QdG+yKh9JADhywPLDP2AxBjE:fXYMGdNy4AwGDxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777659217, "uuid": "7e14d804-c609-4e1e-a2c6-e7be9e9a82b9", "value": 9432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777659217, "uuid": "1e52f546-6a08-4a72-9ac3-a8ab35684ea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659217, "uuid": "561d9d31-2515-4bba-8eb1-7d86511dd02a", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5024f3-458a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777659789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659789, "uuid": "02e6f5b6-3ef8-419b-b4a6-4d20bf3f9b79", "comment": "Malware payload", "value": "e9e3f3ef0c9213703e6a7990dced425e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659789, "uuid": "87bcabf3-2ba0-47fa-b040-f7c891147cd9", "comment": "Malware payload", "value": "83127c8f0453347059fe2710ecc995f3eacb91f3258c56693b836c068891098a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659789, "uuid": "322d477c-3102-41bb-ac0a-48f9b93512e5", "comment": "Malware payload", "value": "1f772dc412ead91360942d35a49536a076bd8ed4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659789, "uuid": "22cfeb12-5a17-4424-ba03-cc0c7f0055b1", "comment": "Malware payload", "value": "ca399a805c889d256601f802f26f2b1ff8784e8e2b6c7c28c2bb4e4959d77339355ee09887edbaf19ff39426d3a1fb69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659789, "uuid": "efa6a71d-2fc8-4d68-ac13-3f3fee12161e", "value": "T1BE4294E2B556DD7DF80EF33E88064511B071F64A86821A7273B2392FED7B2841577E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659789, "uuid": "ce814aa9-ae44-4475-bfac-4aa4a7bbc4e3", "value": "192:+LGMAmoX0wAUA4h/kPp8vdAfOuoK3VBMb2amf1/A9N5nk5WYcVT:+LEAecWdAfOa+bU8/HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777659789, "uuid": "6b345bd2-c305-497f-9701-91cb494850a3", "value": 13048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777659789, "uuid": "c0e41c58-219f-4819-9043-a454600db99b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659789, "uuid": "17ce2815-759c-4158-90ad-15839b65d8a1", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78bde39-4528-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777617660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617660, "uuid": "216e4a04-1c91-489b-afed-6125db1ea3f0", "comment": "Malware payload (Mirai)", "value": "ec2e785d4a4c72a342e7b7c922ebfaa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617660, "uuid": "9c783646-9154-4174-8fc9-6889e9ef165d", "comment": "Malware payload (Mirai)", "value": "837b2fa36b28b405d9e9d6fce9c2167f766e21cff06aacd730c962a6e639e952", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617660, "uuid": "32692071-d623-40e4-b61c-87bdff3d5e9e", "comment": "Malware payload (Mirai)", "value": "62fead24a13419b3e64274a2d398bc04257b96ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617660, "uuid": "31c03d06-b7c9-4603-9640-0fc0a7a70d05", "comment": "Malware payload (Mirai)", "value": "9dff56a5fef754e4f508d17badeb9317b53ed2cde204eeb7bbf34eb9345a61a3f1f8451abdd6c02c8bbe40825d48c3f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617660, "uuid": "412a5f06-baec-4736-b0c6-88ca5c4c4f1c", "value": "T18AE2E094C53B8B68D0EEA07244FA7F1A8C95E62EE148C1E3F1BD14376C73B112CA8342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617660, "uuid": "87d8299a-f874-4747-b38c-348ca68513f9", "value": "768:N9mtE5MFe2Ia2bIGoZJOzewp1jRlrHXh5PfqnbcuyD7U9UcC6:N97BxIG9awnRNHbPfqnouy8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617660, "uuid": "142ff63a-8b78-48c8-af09-de69be9a3ef2", "value": 31228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617660, "uuid": "19e07440-0b57-4f6b-8263-47d2eb95fda1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617660, "uuid": "aa10446c-1c44-40ef-ba05-320b819a9550", "value": "rage.x86_686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fb78ff-45ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777674651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777674651, "uuid": "4cc084e7-b595-4fa5-a9ee-5cc9be165a4d", "comment": "Malware payload", "value": "c7d9ae5644d25ac79df9f7464eb66cd9", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777674651, "uuid": "78ca75e3-f044-44cc-b70f-35ee64133908", "comment": "Malware payload", "value": "86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777674651, "uuid": "a3d0728d-0a3b-4f02-8191-2cada470daa8", "comment": "Malware payload", "value": "4795df3aa81ac11c64deb8e2e6d307a9ac3e0007", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777674651, "uuid": "5ece1a70-16e3-44a0-9b11-66e387b2c8cf", "comment": "Malware payload", "value": "f67a9317cfbb8b0090bf607f30f4cb986db57eff9c35b7c1c08d82b091127d15db36909f7ba21b274415be427bc21627", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777674651, "uuid": "428b4f6f-326b-406e-980b-f2164238102f", "value": "T18FD57C07789104F8C09AF33194F67A95FB35B80847393BE72B525EB42E7A3C09A36756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777674651, "uuid": "66e6e1a6-d24a-4912-96d5-635bb4b04398", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777674651, "uuid": "24e0e928-2df0-4960-8f3b-b365777b5061", "value": "24576:Bq7sDotPqIB61kK+5k/pG1wHk5Us4S77gXBFDasx5zNlL6Fhele5n92jcZucYMXG:Bq7sMhqB1kKD/pGeE54SADBCOddd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777674651, "uuid": "759ce2f5-e908-4a6f-890a-f103023c4aed", "value": 2946776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777674651, "uuid": "7b0556f3-b8ab-4d06-9c5f-7ac8d8f50cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777674651, "uuid": "f7f5249e-6baf-4e8e-a8da-2f2277a313b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c65862-4527-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777617332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617332, "uuid": "34616ed0-745c-4c2a-83ab-b5d4408ede28", "comment": "Malware payload (Mirai)", "value": "fb5a3febaaabf572fb5c331e0bf4cf9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617332, "uuid": "a88a573f-898d-4042-990f-bb46c5abcb95", "comment": "Malware payload (Mirai)", "value": "876f48e36dc245dd3862bd27651f4db5ad470a52fe68990dfafcaa8f42448c33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617332, "uuid": "64745c9f-4ff7-485d-9c57-9f7075e8f09e", "comment": "Malware payload (Mirai)", "value": "1754e0ef2b6dee3def5799d9b4c0fe28665cceec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617332, "uuid": "4eda90ef-c257-432d-b398-d29ae3ea064c", "comment": "Malware payload (Mirai)", "value": "7dc996645ca682d5b80697f0dad5b0b759a7be7ac015efe33e09db30af87e3efd0d5619837ba880638aa7495f490018e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617332, "uuid": "61ef70a0-b783-4bd9-a47c-7a758466ed74", "value": "T1EB834C23BA710C3BC4D4A57A62E74335F2F7838624BC8A1B3DA10D9DAF6564032677E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617332, "uuid": "721304aa-4fe9-409a-be5a-ccb7d7e0c310", "value": "768:VHm2PzChe1br1t3t2MeO/3cO+N95VqEdEc5VHlW72gI/p4Mxt0XJfKfrgpgIQj:VHm2GhQbtZp/WN95tY2g0pdt0Xlpgfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617332, "uuid": "03d31a9d-fc21-433d-bbf8-73c8b8a58f49", "value": 83364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617332, "uuid": "8c3d0710-1d20-40a0-a6dd-e01329e97882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617332, "uuid": "6b9b61a1-fda7-4cd6-ba16-4cf329208928", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb0cf1a-45af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777675756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777675756, "uuid": "9d81bf68-b7be-4260-be95-5056c71762ea", "comment": "Malware payload", "value": "c3bc72794330e2996057d6c3a073b7fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777675756, "uuid": "bba0c116-ad6b-4a38-9bca-0825636d7c6f", "comment": "Malware payload", "value": "87fa7adbad1fe994d57d118c12dac691b0587db0c25e50cebbb8642bd53da08d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777675756, "uuid": "3b152e42-44e2-4194-8292-7467b0d07afa", "comment": "Malware payload", "value": "db83f744826ff6d12f0a81ef6a9a183e3a7040ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777675756, "uuid": "acf73b23-3a9f-4907-b7a2-aa9c84dc0353", "comment": "Malware payload", "value": "e80d2cd10091c0c60d4e0ec34f8871ff927c0a3dda62ec9bcb5779f7896e542534d56c52a49ae51424a44e08a8898041", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777675756, "uuid": "0e023ea5-757f-4c08-8104-bc21a7b1df3e", "value": "T13096337725A4C75DC03810F92B28226FA2C9D9C592CAD44F07379F13896BB1BCE91EB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777675756, "uuid": "4fe468c0-c1b5-4881-9ea1-3dffad2f2869", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777675756, "uuid": "60b3e98c-9ee4-482b-9c9b-37e76c3962db", "value": "196608:YQvfuOyB2lU6TjyXc3NywDjYVKyWHrh8UiKduQSMvUpBLQUG:YQv2DWfTmc9xDEKTH90KdurMvsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777675756, "uuid": "6f77bda0-4d6b-46f7-9f74-feb948511577", "value": 8999320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777675756, "uuid": "209b688b-c7d1-4457-a840-969903408feb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777675756, "uuid": "6d7df539-df08-4643-bf73-e04ada816d95", "value": "7dNTEKTsLz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39914686-4561-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777641930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641930, "uuid": "06993093-383e-48da-ae0b-fceed96f1ff6", "comment": "Malware payload (DCRat)", "value": "179eefd14eaabb2685243db53ad7f1f2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641930, "uuid": "85394425-dac1-439c-aca8-ccbe23cdf13c", "comment": "Malware payload (DCRat)", "value": "88bb1409142736abbcf6e6c28c1b6ede2fb286dcc2c9aadbace50f54a6c45d5b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641930, "uuid": "1cac3ade-e7d8-4cba-bc7c-00b91bdb142d", "comment": "Malware payload (DCRat)", "value": "bb03168382aeb4259a193189381ad15941bf4688", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641930, "uuid": "c3056263-b651-43f0-8b4b-f6cf0a9f3bab", "comment": "Malware payload (DCRat)", "value": "191b0576f372f499601cf0eb8023cfd30a22d87a06239b55cab6bb14ae42734a8160bda439d55e99abf4d5ba430dbabb", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641930, "uuid": "c0add367-1ce3-430c-b206-a0e5488882ad", "value": "T1E9859D01BE44CE11F0191633C2BF454847B4BC502AAAEB1B7EBA376E59123977C1DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641930, "uuid": "2acc3708-412b-4143-8de3-345451272461", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641930, "uuid": "2e98f549-c811-4d0f-9eae-6699998005c8", "value": "24576:U2G/nvxW3Ww0to7ElPhUCD6ygESkr21a5qx2m6yBOU5qfb6meVdQ1lV330lllbXK:UbA30o7El5OMWuJ7ykU5tO330lllTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777641930, "uuid": "7897a30b-71f8-482f-9282-29eba6c79104", "value": 1830567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777641930, "uuid": "a64d0d91-023f-4dd6-be7e-7027d57d0c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641930, "uuid": "63a4e973-ea95-4dfb-9e8b-43bd96931bd0", "value": "179eefd14eaabb2685243db53ad7f1f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b8e17f-44f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777594486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594486, "uuid": "71847f15-3bf8-432f-9b8a-671d5790f55a", "comment": "Malware payload (Gafgyt)", "value": "a0f55b1570d05e216ffc4410fca3a471", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594486, "uuid": "cdeb67e9-efad-4db2-a5ba-3877dd07dde5", "comment": "Malware payload (Gafgyt)", "value": "896602f75cdc169bd412cca75baa60e2ffeaf691c1b8bc411fc1557f2c94afe7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594486, "uuid": "88bf936d-0b62-4377-81f6-ffffc567066a", "comment": "Malware payload (Gafgyt)", "value": "34abf5e12272f1e92298adafe8dae529bcca65ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594486, "uuid": "9cba5c7a-b09e-4dda-9dab-11213df1c363", "comment": "Malware payload (Gafgyt)", "value": "a870f56e73b9ae441d7b78b8348227c5a66a3b0d03afae87be63eddcdbc1e17d2ab0fbcba416eab011297ec42223e6c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594486, "uuid": "32eaa6c2-b93d-4368-8505-94e8db7f91f7", "value": "T150934923ED125F0AD20B64F060F59F351F22B8FA89975AD9E065DAE46543CCAB015FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594486, "uuid": "fe25fa91-1961-4873-ba04-cfbe27d6bb18", "value": "1536:m2hGraniRXVZsKIdkS/ZD2iI4WCPG68Lze15hsZanmppm:5yaIXVZzIBD2iI4Wn6Z15hKampp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777594486, "uuid": "9519e872-e7e9-43c2-a872-c56c89216581", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777594486, "uuid": "555914ee-3243-43d6-ac96-5b3faf710b41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594486, "uuid": "c71b4df5-2616-4044-97cb-3e349018b082", "value": "FBI.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0f6c9a-457a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777652994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652994, "uuid": "bf885444-c364-42ec-98c3-ba5af59722cb", "comment": "Malware payload (Mirai)", "value": "06c17fd08a98a431053974919a457c2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652994, "uuid": "e10d4699-27ff-4348-8c31-aac3e2f71e68", "comment": "Malware payload (Mirai)", "value": "8afb1c5c00dd89a84b05dbe9b6fe51291c896cf2db15f74e254f2e0948ad89ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652994, "uuid": "5ffc51a1-c4a5-4603-b1d6-d9926e7ca2ee", "comment": "Malware payload (Mirai)", "value": "182573b61b554d083ee3742a224a057e991e7c7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652994, "uuid": "8165f290-a76d-418f-bd4f-237b327c13bb", "comment": "Malware payload (Mirai)", "value": "5907e6c2f6f3360a815d666ba7964fe86413845af84cf7270b434ad19d7d147a65cd552d5f6bff1a2b33ee08fb2f2048", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652994, "uuid": "70b59a75-d088-47ae-8f70-4017b02a43ee", "value": "T1BC7302491B4AC930C7B10C35E0796B49A04F9FF9B4F7620B2E8947143B57269E2BAF31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652994, "uuid": "2a5421a1-39ac-40c8-b081-50540d8a37f4", "value": "1536:ishe1fTe0iWuIgHR/QyGPbsRZbbo38vgnX55NAjqzp:i1reDIORRR1ROXzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652994, "uuid": "5b5917a7-d94b-447c-9983-4a2c040994ad", "value": 73800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652994, "uuid": "9b73d6b5-66a2-4ccf-816b-6f162c4f5523", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652994, "uuid": "387dbc25-ee74-4d3c-a168-e514d701e25c", "value": "vaxbot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e66d23-4540-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777627752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777627752, "uuid": "1f984e13-531f-4e8f-9ed2-28a997878bbb", "comment": "Malware payload (Smoke Loader)", "value": "1e09b422be8c0336142593bcdcdc5380", "object_relation": "md5", "Tag": [ { "name": "pw-2201", "colour": "#4EA58F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777627752, "uuid": "2737f4da-6a6c-46e8-92ce-cc24ad5fd852", "comment": "Malware payload (Smoke Loader)", "value": "8b389adf4f1e6574c22b114977e9aa74fedb951290d3a99e9da3a4bafe08e02c", "object_relation": "sha256", "Tag": [ { "name": "pw-2201", "colour": "#4EA58F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777627752, "uuid": "fd398e83-6178-459b-a60f-2c2ab18f3599", "comment": "Malware payload (Smoke Loader)", "value": "7d9544b859ce169e606f4df85ed1c5f8f3e67ad7", "object_relation": "sha1", "Tag": [ { "name": "pw-2201", "colour": "#4EA58F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777627752, "uuid": "2ea0ef7c-a56e-4e3a-9b02-8da517f35a7e", "comment": "Malware payload (Smoke Loader)", "value": "66792c5751cb443aed7b4cbdeac5af4789be7899c6a65d9fa5b5857e6a8b2f5d4a728182cc4340e6624269f297e4ca0e", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2201", "colour": "#4EA58F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777627752, "uuid": "54bf9ebf-03b6-4d7f-9fc6-005f96073c29", "value": "T139E633542171F374691A461C3F618ACE480F3DE7D92943612913F88C9FAFEEA6D90A1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777627752, "uuid": "218daf0f-d67f-4951-8028-c22e4181bdda", "value": "393216:hxzgf7n6NqEHoHuRPMH94RNWaIYW9SBZzOxq3ArEl+of:hxQ7n6NVIkPQ94RYzDOi1Iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777627752, "uuid": "6b645ceb-b186-46a6-bd2f-1e7642e542f1", "value": 14653230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777627752, "uuid": "59e7fa29-4ffa-4a14-a4ec-616697ed189d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777627752, "uuid": "499213df-daa5-449c-96f4-65f1fa3f94ea", "value": "WOT-Cheat-5.6.4-Win64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c3d68a-4584-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777657167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657167, "uuid": "5ecf7341-9c8f-47e4-a0b0-f20f9ae8c8ca", "comment": "Malware payload", "value": "0b504e6906348f67ae2b469fe90e401d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657167, "uuid": "bd7daed4-8917-43d1-873b-be1ae9680c08", "comment": "Malware payload", "value": "8cb030a1bd976a858a69b572fa0a5076a10350406e01ca1a2dd6bcf82cd48134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657167, "uuid": "c5d410b3-a531-4d26-9fe9-6812bbd7746f", "comment": "Malware payload", "value": "59916acd0e2aae3c11b5e78b91725c42eaf586f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657167, "uuid": "6c69de88-c2df-4d03-b2be-ee35bee78554", "comment": "Malware payload", "value": "ce20349de0c18d3dea382bd4ffd35401a0ed7c3d0cd84df2f28ea798f5e9524ca82560e93bb93cca32aa6f7d52d623bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657167, "uuid": "97e2093c-0dd7-4bbb-a061-b50b03ce73e6", "value": "T1A1E198C9B7579FE7CDE02176EA4F0B0933BA9648D2CA670795084E293F3A35D8D13981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657167, "uuid": "2b8a7901-56d9-43df-aa5a-a0767bd8281f", "value": "192:iu1xLo5tsD1UyY2SDUtdqstX+YMcwROpzTC:iMxLozy1XY+tdqQX+YM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777657167, "uuid": "afe15e12-f627-4a46-8e79-142147f43a82", "value": 7064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777657167, "uuid": "e6f95496-a491-4bc2-803c-4e8b68389e7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657167, "uuid": "2bb7b9db-223e-46cf-a217-cd9a080f39ef", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11c13d9-4573-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777649888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649888, "uuid": "3e642ade-cf79-41e2-9006-5f7806b379b5", "comment": "Malware payload", "value": "7d0f2db4451d63edbeaf738f9c24bc81", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "sp1-gstats-api-coni-co", "colour": "#7654C3", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649888, "uuid": "da814384-c591-467d-8995-a1d77e885337", "comment": "Malware payload", "value": "8d90cacacdd593d3459304943e9f05238588211f1747e13da3af5c69c60a49ee", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "sp1-gstats-api-coni-co", "colour": "#7654C3", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649888, "uuid": "0dda3fa0-31d1-4e3f-9e30-c8e8fe389f38", "comment": "Malware payload", "value": "961ab6059ce697c63f67598cbcf65f7efdb69f1f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "sp1-gstats-api-coni-co", "colour": "#7654C3", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649888, "uuid": "2a969a08-c8e2-4bdf-b4b7-88f760a85216", "comment": "Malware payload", "value": "bda4990986d8ec8d43d73d25bfd6a630674631dbe8841887627175f66c605d4ccf205c4bf10cf388259bf5c5e43ba55d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "sp1-gstats-api-coni-co", "colour": "#7654C3", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649888, "uuid": "c228f98e-5f93-430d-bc73-389bdd8c9f15", "value": "T150A633E0F5C4AFC1E126C53153F480B5EADE18A5B093DC76B8132B4E65936F3B6AE448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649888, "uuid": "dd80cccb-7d18-4528-9a9d-cec888d29184", "value": "196608:15+uWL63x+mb2ZYYLyIPVmzOcLqnDXBLmWUYQrpyhGpDHC0dzBGSc9CPZ86DPQZZ:mL63Mmb21+hOnn7FUNyhGprLz0wh8+mZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777649888, "uuid": "09ac5e65-568a-4020-a06d-b07558a78bbb", "value": 9550604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777649888, "uuid": "a76990a4-7f89-4467-8b4e-40f342ca2790", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649888, "uuid": "4cd0e917-7492-4cde-a967-4ea71948697e", "value": "was0do6si2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364da669-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653091, "uuid": "99f9f45f-302c-48bf-b019-832a88e3dcff", "comment": "Malware payload (Mirai)", "value": "13241a21eea99ddc385b46b39e72f485", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653091, "uuid": "5bc968fc-9bb2-4b48-9abe-cb5beaead2ff", "comment": "Malware payload (Mirai)", "value": "8e6daa19e0a785c34e76938c31b6be46dab14d3c589516307916c890605aea9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653091, "uuid": "95acbf3c-a865-4891-b8d6-016ebd3176f6", "comment": "Malware payload (Mirai)", "value": "3659a8769567244a1e6d28ca2691aef5a434c196", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653091, "uuid": "dbc1cbdb-d4f3-4d4a-a682-e80f5214cf82", "comment": "Malware payload (Mirai)", "value": "34db7fefc6d22bc6f801c42b14e408285225bbc5587be82e7c3c184a33018a43d1567a5f1c87aa707a4a53dfb4e010c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653091, "uuid": "b4ad8755-4445-41ac-ada2-fb17d0c464d7", "value": "T10A143A06B6CCC0FDC99AD13467ABB536D871BC5D023CB25B17C4AE222E4FEB05A2D645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653091, "uuid": "f893d3d8-34c7-4ac3-8ad9-08e66067b42f", "value": "3072:HZ/4xmqqGqDXdV2xuF9dqEXTPyiCziIIxE4NlzDIqPIuCQFJD/Wb4jU:HZ/4TqGqDXH28RaKZX3Cn0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653091, "uuid": "182f7cd2-28e6-40e3-bacf-8eb56387216d", "value": 206952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653091, "uuid": "9bbf14f7-232c-4842-a50c-13d5555ec77d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653091, "uuid": "3c70f3e4-8b92-43df-bb14-6e4574b0b64e", "value": "vaxbot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52738585-452a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618349, "uuid": "2cbdc2bf-523c-42f6-a5d0-a59d5827d9ee", "comment": "Malware payload (Mirai)", "value": "981f25ca1876461ebd1ce8dc77e6921f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618349, "uuid": "7176ac7e-febf-4ca9-aea9-83c1374fe90c", "comment": "Malware payload (Mirai)", "value": "8ed1f054eb14eecd3760bf9e00e60dc9e1588d6e3b1b11e96c8c6d7eef7ce374", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618349, "uuid": "4a1920c0-0426-4a89-8ef7-3baf809d143b", "comment": "Malware payload (Mirai)", "value": "632306627966ed1e25549126ff9e928a9a5d60b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618349, "uuid": "c9336cba-4a42-4ae2-9514-a6bd0ce7ba02", "comment": "Malware payload (Mirai)", "value": "a3da6bf834e580d3fa57e524ec2b768f95c8bdf5d8e9a0b041640863bbf56f35d9a62731c0229b0ef06dc72650c303ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618349, "uuid": "7f317797-d019-4b07-b96f-008965afe871", "value": "T1ED2302FFDE1030D7C9FE0E7C406402C2A68091B3A99B1F4C5B949D795762E1BB74E898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618349, "uuid": "c5c394af-cef6-4329-879a-1a6c1f56cfc9", "value": "768:m4JXd8hTQfsQochL9JawpLQNeuHzbJUI1L796Id/kPp871z/95u/TW+HAErV:m4Jto8ZohoLQQG91PVkPKR98/gEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618349, "uuid": "841cb31c-6c82-4573-bb49-4e9b158d063a", "value": 48348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618349, "uuid": "9330be52-b52a-4f7c-868a-b78b8c72d060", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618349, "uuid": "8a250e33-73f9-4dda-b48d-ddff59c93352", "value": "rage.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2158eff-4571-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777649004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649004, "uuid": "1d971256-9b0b-44bf-b2f3-94eaafeded74", "comment": "Malware payload", "value": "d89fdd2763232c1bd357ea5ca54505e6", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "turbine-grandauto-cfd", "colour": "#CBE61F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649004, "uuid": "f7ce46f8-ffc4-451f-941e-3ea5b9496d9b", "comment": "Malware payload", "value": "8f3ae43e01f5f8965cba7e02646757d0a4a746ebb8735b864d458f63bdd59f36", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "turbine-grandauto-cfd", "colour": "#CBE61F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649004, "uuid": "a80262d8-83f3-49ad-9268-3b434694d3cc", "comment": "Malware payload", "value": "12589b319f72d09610fdbd00cc3e3340055407f5", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "turbine-grandauto-cfd", "colour": "#CBE61F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649004, "uuid": "f48d6b5a-6089-4b66-bf99-da62bbb9e22a", "comment": "Malware payload", "value": "b6b16f0428d9269806bae551f249b15e5d7f2c87c1530039e89e92addbde56ed2e518ad4a979f1e8bd52fb605f9c9010", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "turbine-grandauto-cfd", "colour": "#CBE61F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649004, "uuid": "626f240c-e283-4762-ae70-4a4fc3161e9b", "value": "T1F79633D77BE008B0C6E304375F1A9AD4DB3A79621B1FE1A327D43E160FFA442465AB85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649004, "uuid": "39c7d294-c1a3-46da-892e-e68be5211243", "value": "e59d00b0d90522ee1a983f13d4ff7e50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649004, "uuid": "60a7c31d-1805-4a0d-adbd-df65350430a7", "value": "196608:crzYshhd8y+fazYshhd8y+dazYshhd8y+/:ezLhh0azLhheazLhh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777649004, "uuid": "feeb2614-392d-4ec6-b880-7aa009d5c7f1", "value": 9018768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777649004, "uuid": "0dc4d8b5-67d9-4b48-8026-6847294534f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649004, "uuid": "5a3cbbaa-9a44-4f1b-9667-1000d79dab4f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1ee6fe-458e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777661507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661507, "uuid": "2e753c61-5e76-424e-89ef-2f32e4313511", "comment": "Malware payload", "value": "8decbe8bade48de2efc5417a6818f830", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661507, "uuid": "ee09fbd1-77ec-4d37-8b87-e9a9dbfca49b", "comment": "Malware payload", "value": "8fa020bba87f1cfb0dc404178d8642a39dfbdf69fd176ce94c0f180abf772934", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661507, "uuid": "d9ca3a14-30ff-4584-a455-6afa4c7200b4", "comment": "Malware payload", "value": "377d1ccca0c1aacd8ad5cb656a4bf022f12a40f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661507, "uuid": "8b8f671e-d53a-4b2c-ba3f-91c6bae84e56", "comment": "Malware payload", "value": "05b393f58fc4c6a4d5d7b459a4b94f7814d8f1e6760abff307517757543a0d4c08c95a3ec3c8d0c25e3d64f55a8abe3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661507, "uuid": "859b2c3a-ef8e-4c41-9210-66ddbd37fda8", "value": "T15A42F8557EC28B22D4C04278EE0F62893B235B1CF2DB771337152B58B7479B50B6B81A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661507, "uuid": "468f953b-fc89-45b1-a394-788235fb2288", "value": "192:5cPncyjZDnkQ+WldczgNPtC4hjvgBVpjiM9GP5BzTLZhwXsgmEZx4eOP:5AncyakjvEpjiMabw8gXx4e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777661507, "uuid": "57693bf9-7063-4b32-984c-20b2b4c210f8", "value": 12576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777661507, "uuid": "8fd31cd4-adbf-4ca3-9cff-51af84d2128f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661507, "uuid": "6a0dfdd2-3ecc-40df-a764-e013a639b259", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd862eb-44f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777597001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597001, "uuid": "b85e0779-5a05-4661-85f8-23adbcc9bff4", "comment": "Malware payload", "value": "90ce40b12175c1209a5f4cb183a607b6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597001, "uuid": "13f00d03-e532-442f-b4c9-8d355ed60309", "comment": "Malware payload", "value": "91d1f997dea82e232e13100e186004c3a7ea4a6cdc6020be27fc55c599a1ac63", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597001, "uuid": "2ff4c5cc-347d-4826-9f94-a79376855778", "comment": "Malware payload", "value": "bce10fc9c1945b7f8f289cdb4a8b7b52c2df255a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597001, "uuid": "eb39c821-c2fd-4ade-a431-867481888c23", "comment": "Malware payload", "value": "7009b639e2cbdcc0dcd4794f64a8e9ab333ac70485add511d224397861bb95eb3ae8e96ec067d3bbe4c7beea5e544351", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777597001, "uuid": "189113f7-aa9a-43f6-bb9d-52b2866b2898", "value": "T199137D6566853C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777597001, "uuid": "cb95fb96-dbf3-4743-8854-b6bd1613a9c5", "value": "768:bkXRWNGxV/9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bYlxGcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777597001, "uuid": "626a723a-2898-42e2-947b-bd3d61cf668b", "value": 45425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777597001, "uuid": "7f8fc6ee-f6de-47ea-bd8b-bf3573e39b6e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777597001, "uuid": "303a43e6-90c0-441c-b277-14e0972da03f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbaeede-44f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777594478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594478, "uuid": "ca630738-a0ee-48f4-8f03-a83921592d23", "comment": "Malware payload (Gafgyt)", "value": "5dd443245f640c762e3845643d351eba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594478, "uuid": "77cb5019-526c-41fe-9c81-39a75e1eaf0e", "comment": "Malware payload (Gafgyt)", "value": "91f1e171506987af83b008cc4f1b9a9b451bce47dd2b92781b31b74cbb33fbfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594478, "uuid": "89b36343-3b0a-4748-8685-bdf0163be9c9", "comment": "Malware payload (Gafgyt)", "value": "a6abe432db2a2e54ca55068073227ab6a6cf6ae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594478, "uuid": "75e1fa45-d4dd-4354-a286-4f030635cebc", "comment": "Malware payload (Gafgyt)", "value": "215225ca78011f1f697f262ede04a2fa8cccf3aaf740be0e8446cffde04666a2e8dc615e88a3f426aac7b3767cb7f81c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594478, "uuid": "3638aa8b-108c-4722-a3fd-c2ce115ce997", "value": "T1D0E3871E7E21DF7EF559823047B38E30969836E636E18585F26CE6481E7138E241FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594478, "uuid": "2cfda128-a3bc-40f1-b5ba-8bc88e10f448", "value": "3072:f7ip4E6s1gSpuIgQiRxaAkCEAweIcqs8Ek32o4KqKf5hspYt:f7iV6s1gSpuIgQiRxa5OCZHBb7qi5h3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777594478, "uuid": "901e3569-765a-4d64-a2db-303d7f2e1e69", "value": 148064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777594478, "uuid": "7536fe77-a691-4d96-9e74-feebb21b20ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594478, "uuid": "ae19a5c6-352a-4bb9-85c5-fc43ef9f7bad", "value": "FBI.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc17375-4589-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777659169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659169, "uuid": "cc3bc8ef-7767-4316-b436-109fa62509eb", "comment": "Malware payload", "value": "ef7c7309b972f0d2fa7f54911b35b823", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659169, "uuid": "39d380d5-8a2c-451b-8d69-8b11ecd6af14", "comment": "Malware payload", "value": "925bc2c66a91a746962cf13f4d8f51bfc0297da9e20d878f2d064fe55c648306", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659169, "uuid": "0e706829-a010-4c9e-ac78-78aa661269d5", "comment": "Malware payload", "value": "e8164941b662af7a029dafd0514d1896918ffc7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659169, "uuid": "1454daf0-f2cc-4216-b465-d80a3f7fa0b2", "comment": "Malware payload", "value": "d4f84eccb9a0cb4b2225c8e8459eb6c0943150b11cebad0cad549407a5f0564ac4177c09ff1a1daf0f03e9e73475c284", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659169, "uuid": "cdf865fb-131b-4824-a2be-c46558ebe91f", "value": "T1BDE19E7E8774162AE595C8781C5360D94E66724DBFCFB52B2CE032D31B0A818A631EF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659169, "uuid": "0c3f5a28-5b52-4dd7-9b2a-4ed90f30f662", "value": "192:Gty3eC4Aam0mpqaOOZVfqucQse/FqcJsS:RufAarmpqJnuc7iFqcJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777659169, "uuid": "97e9358b-6209-41b7-a65d-65e6e68dfdba", "value": 7120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777659169, "uuid": "8c11d8b5-487c-4f69-a918-f3f7f1c25548", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659169, "uuid": "eb412f95-71b3-469a-8a87-87091a1f3976", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e4529b-4510-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777607376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777607376, "uuid": "5517bb2f-5fc2-4200-aa4a-ebd5099d88bc", "comment": "Malware payload", "value": "fcd7122a82026f24e3561f3bae55322f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777607376, "uuid": "093ccd9a-ef79-4404-9708-d8bb57106e70", "comment": "Malware payload", "value": "92a0ff90287175f30aa4e1836fd0ba50622df42c098e0e62e6a0cca7a1695057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777607376, "uuid": "ec11f032-9028-4e46-93fe-d7a2c9c0a031", "comment": "Malware payload", "value": "79a251e8187b2787d7de0acd03ce302be8606d0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777607376, "uuid": "fc95bc52-c549-4c40-8db4-3a5337c8a69a", "comment": "Malware payload", "value": "81263f221ce72b56f6c6b5a8604a0b3a965c73ceb6874035a1021f28adff2dd08275337506544626f24d34f85178f216", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777607376, "uuid": "4390af52-dcb8-4ff0-9cd1-56572860cd59", "value": "T156668C09A7D006E8D567DA34CA62C732DF71BC429232C24F16A5E64A1F336A18F6F735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777607376, "uuid": "42cf45b6-4730-4c23-8287-59908f5bbe43", "value": "4bca3404aa9eb40d8c3a810419dfe620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777607376, "uuid": "4ebfa0d0-415a-448b-87d1-e71bbe6a0d97", "value": "49152:Wql8k9CPspR7S1bJ/tgPNnjomGZXAe7x4sYQofLGtTDuUwUG3cj5MBZ02YgM7yEW:qkCPsqghQ47LGkXZ2DksmUL6o/hU0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777607376, "uuid": "27341343-6683-4328-b873-a96bba3d71f4", "value": 6855168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777607376, "uuid": "80c6fe77-42c0-48d6-bed0-edcb459136b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777607376, "uuid": "da718af3-cc8b-4f7f-b026-9245dae4f77f", "value": "79eb4631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002d13dd-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653001, "uuid": "6c8385b4-e762-488f-a275-394b9810224b", "comment": "Malware payload (Mirai)", "value": "ff1b61c1ea5da7dc4f02b7ab196fa762", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653001, "uuid": "8d00eff3-7c80-4036-8d67-c980ac3ea1de", "comment": "Malware payload (Mirai)", "value": "92ce6308a096b92406b02abe3768a29ef7cfee706675fdadc9a9ad00856d3624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653001, "uuid": "cfff3ba3-93f8-4367-8491-bbe8d1d98487", "comment": "Malware payload (Mirai)", "value": "f7c12629f53ded64cc2de0f33b63b82875e4b1cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653001, "uuid": "82f2da11-0fcf-41df-8303-fa04aec13c0e", "comment": "Malware payload (Mirai)", "value": "eec3fc7777a40f1700d9646cfb49a87a717d3d2060b7444fd82771be257a1753927ab39ca94e8aa10d0eb5ef4febd4b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653001, "uuid": "da146dc4-9e0a-4a08-bc5d-8b23d25e596d", "value": "T15B04BFA3B34F65D1C86206F80BCB679D252371025DA7DBD76C6E39395A371CE18123E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653001, "uuid": "3b3b42e0-a102-4bc3-9419-3de19420b65b", "value": "3072:pCzLj+y1ZFhRlXSrdWOCSXPJj021BNPaqSo7jg/ChWCCQ3SIqnq:pCT++cWOhJj91jBSSyCYY3Gnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653001, "uuid": "9ca05910-0690-4c86-84b6-553288c72882", "value": 190084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653001, "uuid": "9ade1b27-7127-4dec-8ca8-f8de619a2f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653001, "uuid": "f8898167-cb60-4609-8cc9-591ccd326716", "value": "vaxbot.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7324a2-44f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777594474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594474, "uuid": "78516601-930d-488b-90af-d98f7c0fa7ee", "comment": "Malware payload (Gafgyt)", "value": "bb63001419c20d470afd707197800be5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594474, "uuid": "832a0dfb-21f2-43ef-ba38-22d04b7f0fe9", "comment": "Malware payload (Gafgyt)", "value": "94f05e4d91aa1c4b91ccac2059421cd705aef50f67427e12adf85ae8cd180aec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594474, "uuid": "31753d62-0171-46a7-839e-9465a5dd072c", "comment": "Malware payload (Gafgyt)", "value": "9f60611d62d32c757d58289be020bfe047873006", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594474, "uuid": "b7cdb27e-e04c-438c-a910-727744f76037", "comment": "Malware payload (Gafgyt)", "value": "cee320fb81059c76827d66137b034da48d2ab611a04d89339701b4f8430281231611f534947e577360d4cd9ad8445c4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594474, "uuid": "b1034b83-e7eb-456c-be9e-bb5ff91c22aa", "value": "T1DFA32A26BD018F53C2C315F3BB9F47887B2667F9D2EF3203E925AFA027564D60926950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594474, "uuid": "daaa797f-5adb-4b54-8ee1-f01b9e75ce88", "value": "1536:LqusRr4Lj9YwrFapnidqFR9K91fCL8r/OQ/WeUyNj4qG739y5hdppNq:LqdK/99RYfY9e895d4XbM5hdppNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777594474, "uuid": "acd063c1-d4fc-4e02-b01a-c5811a70f59b", "value": 104272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777594474, "uuid": "32295f7e-cb88-4632-8e29-1cf26514f55e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594474, "uuid": "08370639-ce3e-4274-8a2d-1fa1648f62da", "value": "FBI.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fbb8e4-4525-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777616401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616401, "uuid": "c68dab4b-22ef-432b-a24b-3f5ac009d1a5", "comment": "Malware payload", "value": "e447d149220d8f4a4dd8c03acf9860e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616401, "uuid": "68f9d114-3f70-4da4-a123-c663a5dda298", "comment": "Malware payload", "value": "961fd561c79c389989842777ab2a33ff182d3f1df500c9d0bb045ed0966e360d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616401, "uuid": "fb68ab95-cc46-416f-b8c6-da5d1edf6956", "comment": "Malware payload", "value": "bb363557693726a077b80faa570ccf7bb619a1fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616401, "uuid": "ff1423a4-46ab-47f6-83b9-061465513252", "comment": "Malware payload", "value": "7140bc14af09382d8965e882cded8bb11c42164735d60f04f8e5698e128845888ef69de96e544d057ea07f8c9e003537", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777616401, "uuid": "291ccb73-b34a-45c2-b174-7599fdee18d7", "value": "T1D084238EBBFA79C5CDE13CA885A5CB9B8ECD071954BECA151CEB918C03A5013DD22F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777616401, "uuid": "ed958e36-b65a-4b77-82eb-37d8b910524b", "value": "6144:66oJxyKwdJ3uPSRfC1dO5NM2fM3YVdK9Z6Mhpx2ywxSJx14kpaB1NoWywoOetgWI:VoJw13Esa1dWMz3omHXwxWvDQB1F2ttU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777616401, "uuid": "4f464ab7-f10e-4f55-827c-8d6adb6e863a", "value": 390882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777616401, "uuid": "d919f24e-5779-4e82-b5a9-d264b51e78a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777616401, "uuid": "eed7529a-afb0-4619-8670-75ce28dc00ec", "value": "pty10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0d445b-4586-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777657770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657770, "uuid": "79de4e59-4d46-4054-a596-d6a5a8bd54a7", "comment": "Malware payload (Gafgyt)", "value": "0bdde31a26b697ccea061b632f6e059f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657770, "uuid": "ba963800-246f-4c41-93f8-53ed1a6c5b7a", "comment": "Malware payload (Gafgyt)", "value": "962a6ca8ab56937376974cbe6f028443d6f70b57c225be4da450c9dbf7d7afd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657770, "uuid": "c446497e-59aa-4844-8c27-8e4cc0fb4ef3", "comment": "Malware payload (Gafgyt)", "value": "d24de47a406984ed423199d2fbbe13da14d584e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657770, "uuid": "06527829-f0a6-4d2f-8815-fde088f440d0", "comment": "Malware payload (Gafgyt)", "value": "b8b2e12b994cb7df2b0f7a194614314560538f0d275bb30dd8e907eb56b7927c349113b6f5afc09e5d249d0185410dcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657770, "uuid": "4ecc803e-0d71-40ac-bd65-21caae0c57f4", "value": "T16453023B1565D02DC071CA375B1C8D61C7794268AB60865BE66DE9BF2E42E04F8A0E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657770, "uuid": "88b26e35-e601-4b88-9bc2-7ec5e6ba08cc", "value": "1536:zoZ/Yzn9l6maZh7RybbM6EwryUxNW78z77SshPVhSAQA:cSn9jaBybw6E4yUu707bhPVhFQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777657770, "uuid": "d3eb44d8-c039-4085-b661-25f95236be44", "value": 63912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777657770, "uuid": "4c289a82-40ca-4e44-bb3f-3a47f1a74125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657770, "uuid": "ecbf0d24-dcd1-40df-bdf9-afffb25750a8", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6602f1c3-4528-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777617523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617523, "uuid": "c1976726-4964-4332-b386-c61c1f80d63c", "comment": "Malware payload (Mirai)", "value": "06cb51dca21c1da31f8e4a253eccd8e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617523, "uuid": "fdf3f303-de66-4ec4-ba9d-ee833699277e", "comment": "Malware payload (Mirai)", "value": "977924f81294d406a1616ebb652b0e9b415cc0d295462037571986c46eddafdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617523, "uuid": "12c2ad73-8df1-445b-b615-ec373dc3827f", "comment": "Malware payload (Mirai)", "value": "f59528d0f006fb6b36fd3fbba800f4465f2374cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617523, "uuid": "e03d5fad-a6d7-4d70-bc15-8d114ee33ba8", "comment": "Malware payload (Mirai)", "value": "cd0f722a3139ab541654de1233d7bfd7c73bafa39c5d8d48adfbf5a7e40c40426bf0c49b1c576d44d5d3376e10818b7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617523, "uuid": "aad1deef-c264-4041-ae75-a1488ee32b0d", "value": "T17CC3F946F8819B11D5C151BAFE0E124E77131B3CE2DE7312AD24AB347B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617523, "uuid": "68ab4d4a-494b-4865-838a-82a7e53ccbee", "value": "3072:TLWiRDo0ZZubaF3VSCkCSW6i4FoH9HECH:TFDdrubaF3VfSQ39HECH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617523, "uuid": "9c9adb2f-84e0-46ed-afe2-3f905b0c3503", "value": 125628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617523, "uuid": "daa6e4dc-68ee-476c-a3c9-b2099b236736", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617523, "uuid": "1b55012e-84a0-4a86-86e1-d62bc5b0febf", "value": "rage.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ba1b8a-4571-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777649067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649067, "uuid": "d439392d-552f-4421-9aa6-9d184bbdabc9", "comment": "Malware payload", "value": "370d3343d5bea270173564389ded2343", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-8162", "colour": "#C7FEC1", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649067, "uuid": "813a8fa5-a3bc-4952-b024-04a337c66111", "comment": "Malware payload", "value": "987393482ddb1263ede9e861983be184be6a61776822588880f64d9a2cff17ab", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-8162", "colour": "#C7FEC1", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649067, "uuid": "4167d3e3-cb5e-4187-9b63-c33aeaad5241", "comment": "Malware payload", "value": "25ef98e2564970e7c08034b861058d28142e2486", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-8162", "colour": "#C7FEC1", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649067, "uuid": "3747cb2e-29ec-4568-b217-8ce761605309", "comment": "Malware payload", "value": "2db5ca43e461b94fb5707823e422d9e5e594a18793cf791c0a46320d89e5575ee350e5133c20131386a403cfda63993c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-8162", "colour": "#C7FEC1", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649067, "uuid": "80355cae-fa22-4f1e-aaa7-c968e365ec46", "value": "T1401633E807E3F28171F677F0F5C4A3296B144579DF9267E4A193A0B3065EA362287D0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649067, "uuid": "54006f2c-976d-445e-b94b-5b0ee3dd7c66", "value": "98304:LPrXxo/M/tkr04Lo8hI0h3pp4f51A+fJ+OnW7x4g2l:LP7Btu0MpngueJ+OW7Cg2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777649067, "uuid": "5ab0a3f0-c0b5-4f57-80df-897c7301e87b", "value": 4249075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777649067, "uuid": "9047c55e-d68f-4bec-b3e5-bfeb8c9be47f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649067, "uuid": "bd779f7f-d66d-4bf0-ac50-d7027c85a778", "value": "downloadlink.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fd065a-4549-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777631945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631945, "uuid": "082f7dd6-ef33-463b-afa9-f7c8ec805aec", "comment": "Malware payload (Phorpiex)", "value": "7e00215ec29c2d98dd1675f73ff8b611", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631945, "uuid": "3fdeb7a4-a393-4db7-b6e4-57306d10f0f4", "comment": "Malware payload (Phorpiex)", "value": "98af9f49fff912e959882946716b4cc9dd6ece9a57e836427ea4810d0cd3fb0e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631945, "uuid": "32f7bb59-0419-440b-bedb-0f829c4c2f5c", "comment": "Malware payload (Phorpiex)", "value": "2f6a08c701ccf32767285d430f1e3f926d912ade", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631945, "uuid": "dfe5c262-b6ad-4775-820b-0956b93ddb8f", "comment": "Malware payload (Phorpiex)", "value": "f9c259b4ff60bbb8747b13f52d02338339341a3d49f9ff0dd7c41696436d8aef5f3a1019900efad24b811b52cf9f2811", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631945, "uuid": "013458d5-e676-4c3c-b657-cb768e017202", "value": "T1BE824A0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1A686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631945, "uuid": "a88d9251-ba02-458a-b2ea-ce70d242f107", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631945, "uuid": "4efd93a1-afd6-49a7-bf49-2bdcc50108e4", "value": "384:/I78VGQic1Kwzw077u9NHu/gBhav8U9ct:cAo0769Zha0Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777631945, "uuid": "252be4b5-da03-44a8-a77c-e9437b844ae3", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777631945, "uuid": "6f3e8021-4826-4da5-bd03-93924e566a01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631945, "uuid": "8b95ee57-9ac1-4305-8124-6e871fbaf066", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d71579-458c-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777660635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660635, "uuid": "eae80ba6-f813-404a-9f9f-1666cee42669", "comment": "Malware payload (Gafgyt)", "value": "a5dd1bef2d672f5dae59e3535a395a81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660635, "uuid": "06393282-b628-4d50-a59c-87af0b96b6e8", "comment": "Malware payload (Gafgyt)", "value": "996a1f8b12625b22c404186d82221ebc97c6b1f9bed29ab4db966b309393f23f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660635, "uuid": "d202bf32-10ab-4d90-ae41-ef9284901769", "comment": "Malware payload (Gafgyt)", "value": "b8bfe49d4dd18518437397ad1d7cd0413b2a8a73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660635, "uuid": "894fce1a-a6ef-4bb0-9265-0d5e0b7609c6", "comment": "Malware payload (Gafgyt)", "value": "439ce7dbb5fedc83dfd425669df9338389020653433d69ed71172a3151ac30b7131f64e14206ad81dd4f02a40b5b05a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660635, "uuid": "ef6c93f1-5ef7-4ebd-b57a-ea351092e94e", "value": "T1A632C8A3D96E2E1DE209D170B4224F386363F516F6471FBB1622C6649043DCCFA5A3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660635, "uuid": "3e6f7ad3-da80-4fdd-85e1-1384399f8c16", "value": "192:UHhJneRiNMFy/gx1Ua7PHa710fGfhH1J5qu8uxDE1ydbHc+Y9DU/swEqBmSaFctb:U/neRQMFy/gxQh1YyWu/svqBpv4r+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777660635, "uuid": "0dcbd888-b880-422f-a24e-3c08861b770f", "value": 11092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777660635, "uuid": "dc376ae2-1b12-43c2-9616-ba02282a859c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660635, "uuid": "ddaf5d72-328c-4d60-af45-b14cc0e4c3f1", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d5d533-453b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777625794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777625794, "uuid": "2468ce30-6148-43fb-a9bc-920156d67488", "comment": "Malware payload", "value": "2004a17c7f9991e5568977205d7acb6c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777625794, "uuid": "064f4a5d-7bde-4f5c-9850-d4292073a63b", "comment": "Malware payload", "value": "998d3c37683ebc8b5b33d011ca4addb217057d5fbe38d5c937542d49604bc7aa", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777625794, "uuid": "56ec15aa-8e6c-4da1-95e9-2dee1cb80cd7", "comment": "Malware payload", "value": "e774e28618481630aa843ecaac0ffc2c20c73306", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777625794, "uuid": "798a4f5a-c6de-4d15-8f2b-1ccf3b9782b3", "comment": "Malware payload", "value": "b5568809f7ada75364a169b00bb0644f3428b801df23660330be0e6aacd4f94b0cfb39225be30b391df83201e90eab31", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777625794, "uuid": "d4c21c91-98e4-4840-9026-b9f325f6fffc", "value": "T1B0137D1A7951C033C41251B9047AD7D06B7FA9212BF195877BD816BE8F333C1AA3E39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777625794, "uuid": "4b8057ad-389c-48b0-a1a9-9f0f772bf10a", "value": "1211e6e3ae30e625838feb4345b1360c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777625794, "uuid": "bd4ae936-0002-4539-b468-7bd94c4a075c", "value": "768:5sqSCJ8ibHCIFNFt95zqF7NP0JKKtM6luZ95zR/:K+wS9NmBPM1Fy5zR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777625794, "uuid": "864e3184-3a9a-4cf5-b090-deea8ae44ded", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777625794, "uuid": "bc073925-b11e-4ca9-af2c-ffb2d7da7729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777625794, "uuid": "b86c5741-b652-4396-9e69-15977cc2277e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b893d69-45b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777679031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679031, "uuid": "fb79c717-f390-4ad6-8012-712b266eaef2", "comment": "Malware payload (Mirai)", "value": "0ce223d0e020a50842bc8884c0cc2321", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679031, "uuid": "dc43eca6-f726-46de-a4de-aec700315a86", "comment": "Malware payload (Mirai)", "value": "9a49713e7e7343eef596df171f49085809e037fd768acf00dcc1e40d8c74542b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679031, "uuid": "56ac27d1-577a-4297-9e0b-1c6851baa889", "comment": "Malware payload (Mirai)", "value": "39d73480b8c1943b1fd72e3b206a4458f740cf38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679031, "uuid": "09d8925b-12b6-4582-bdea-cb4ea3a9fd90", "comment": "Malware payload (Mirai)", "value": "b55a3598e22971dfc22f1e8d310d3b916c145b999518ed9bd10ba14682aadd743be5137cf9c312e4d222652d7fa0996d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679031, "uuid": "fc9305cb-b9b0-487c-a620-d452dfde37b1", "value": "T195F31B46F8818B12D5D112BAFE1E128E37231B7CE2DE72129D245F64778A97F0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679031, "uuid": "9131aa37-bbdf-48c2-b997-d75a6e32f181", "value": "3072:8DT7tdIZo2l1UwuMg+XvFLBLya2vEUXGZyOfT+Gc:8D12Z7vL0+XNLB2aYXOfiGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777679031, "uuid": "8dd6a051-e3df-4305-9aa3-1de840990cc1", "value": 161724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777679031, "uuid": "a160b9fc-f6ff-4db0-a3f5-bf79d9c74501", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679031, "uuid": "53c14107-e4c1-40dc-8add-46c9d0272d85", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7fde474-4549-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777631942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631942, "uuid": "370fe287-5185-428d-9bd4-e3b90aaabc1f", "comment": "Malware payload (Phorpiex)", "value": "457f7f4b01b60970d59be046aa404ec4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631942, "uuid": "68f0e869-af5b-40a0-a9e4-7bf08d4b5f4c", "comment": "Malware payload (Phorpiex)", "value": "9a71bf12bebafc0b33c3057a45323bd12a7e1450a6342360a7f426a30f9f7c5e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631942, "uuid": "906594c4-3fdf-483c-bd6f-67aac980a6c7", "comment": "Malware payload (Phorpiex)", "value": "c7637bbeadb349a2962c31bdde31b8eca10c7dee", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631942, "uuid": "e1d6e4d7-e173-4af9-9ed2-876574b4d038", "comment": "Malware payload (Phorpiex)", "value": "e9e23dc365623cde46997c194a0c18f59265305fd57be9c16ef23d36430cd91c92b5169c74be3201b836c49c01f6c6b3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631942, "uuid": "e86ceeb7-ddb6-40f7-88cb-8231ac62bf4e", "value": "T1E0825B0FB942421AD0D100749636867BDAB998B637C814EBFBD08AED1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631942, "uuid": "49c7faf1-4c02-4bec-9f08-5368aa64b759", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631942, "uuid": "399663e0-75aa-449f-a59f-492a1d0a3609", "value": "384:aI7MVGASM1KwngSZb7u9NHu/gRhav8U9cO:PQ8Ub69Jha0UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777631942, "uuid": "c209fd17-9a56-403d-ad8a-bb2265007fb7", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777631942, "uuid": "023fc9a4-3de7-4465-94bc-df1ba9ec4958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631942, "uuid": "59b098b0-c75f-4604-a301-f8df1d08652a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ee8a08-4541-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777628289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777628289, "uuid": "bcd0a3d3-90bb-48c3-b79e-2b8c91465178", "comment": "Malware payload (Smoke Loader)", "value": "010154357977657e7f6a637cea1b8466", "object_relation": "md5", "Tag": [ { "name": "pw-8837", "colour": "#06AFF1", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777628289, "uuid": "d3511c2e-d874-4212-87ba-6df2b8b30c2c", "comment": "Malware payload (Smoke Loader)", "value": "9a7a32ff6cffac76ad9a60f8657d7d6ab2d9195d3434165302fb83ca826f9e0a", "object_relation": "sha256", "Tag": [ { "name": "pw-8837", "colour": "#06AFF1", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777628289, "uuid": "f323373a-2768-498c-b891-ead25c64d14c", "comment": "Malware payload (Smoke Loader)", "value": "cfc79a87927c2971f510984230a07180f99a06e4", "object_relation": "sha1", "Tag": [ { "name": "pw-8837", "colour": "#06AFF1", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777628289, "uuid": "1f4319fe-cb06-41a7-bd1a-011d2ff8892f", "comment": "Malware payload (Smoke Loader)", "value": "3a6f7b643b03405ced433443ea44a609b3412870dc0b135a46aad1655c8dd65f3b01023b7f61af891b5cc81ba39f426b", "object_relation": "sha3-384", "Tag": [ { "name": "pw-8837", "colour": "#06AFF1", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777628289, "uuid": "761064a0-a6da-489a-8936-525d9b7a9b97", "value": "T105E6330FD544C56710AB66B4BC63D3C2FE1BB8456923722089A7FEB5BAC78768B1305C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777628289, "uuid": "6c9b2eae-2a33-47f8-a560-41868b898b8f", "value": "393216:MpAWcExXJEMddzYlqixvkUZ2F83N3oH+Fy:ijzFYHeH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777628289, "uuid": "5afda6b5-a955-42a7-9a55-1f71b1201aad", "value": 14583262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777628289, "uuid": "b83c9573-5e4a-4498-b925-60cf46c4b9d7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777628289, "uuid": "74b688b4-aeab-4aa9-84de-c8c6ff7d7fa3", "value": "99Nights-v1.4.2-win64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34afc902-4572-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1777649223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649223, "uuid": "902f3a95-1c1b-4da6-9aa1-2632dc52b301", "comment": "Malware payload (Efimer)", "value": "e7ecc36e8b79033637b88f298f353a13", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649223, "uuid": "fe97bf00-ee0f-43ce-88a3-12c44764687a", "comment": "Malware payload (Efimer)", "value": "9ae5b5d66d533ef678fa89628207baa0fbad90b852b31cb5dac9dcfc38476fa0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649223, "uuid": "8b2612d7-4724-4880-bde0-18b97d81ef72", "comment": "Malware payload (Efimer)", "value": "05fcf1a8a5e927030a70ddd384e5e55c2c651f34", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649223, "uuid": "e3e9c5b6-19f3-4381-8bc2-c32ceb9509e1", "comment": "Malware payload (Efimer)", "value": "b2cb8a0a9ebeef2a2d3f8a41d6c1790971842b8568fc47ef56bdf78836f487abf485c8f4497a0d7accf205c767eb6dd3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649223, "uuid": "aed419d8-debf-4fb5-a9e4-a68e4ea5b5d5", "value": "T16ED63316A6D1A1DCC6B3C030EEF226F0B4BCF4A497718D274E2CD6B5AC22565ED6D01B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649223, "uuid": "7710d18d-e5ae-49e8-9b48-be2f0403302d", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649223, "uuid": "4f5452fb-436b-4d81-b328-c383467fac5e", "value": "393216:SVEogvDfeI67OxHBD12XMCHWUjXEcuI3/PGTAI:SdId1b2XMb8XRH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777649223, "uuid": "79d9b1aa-79a0-4b4e-8a9e-31a2387ea84f", "value": 12622331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777649223, "uuid": "cd2e7a26-ee26-4a31-bd4a-484fe8474abd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649223, "uuid": "5cabb0f5-20d9-4812-82e2-bd3e14dc44e2", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd135f3-458f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777661751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661751, "uuid": "e904b91c-cb44-4cf6-b6b7-975e000a409f", "comment": "Malware payload (Mirai)", "value": "5047d2d2c23df154326f878bfcc1c9c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661751, "uuid": "3b908c14-41d2-4d6f-a25d-89d67ec1a33e", "comment": "Malware payload (Mirai)", "value": "9c3b4491b3304dc9e210c3a89756e302e283e32de3682cbe012f5e951f20e310", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661751, "uuid": "e0832524-0fa7-45fc-b1db-18302d35d93b", "comment": "Malware payload (Mirai)", "value": "0302cc32c36f0ccb052c437d2d532b5a9cd39cd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661751, "uuid": "eacff943-8a07-4800-8633-2d421133c0a7", "comment": "Malware payload (Mirai)", "value": "d6326e386884e255d238b4c984fd46cdb80031b2cacdbe96fc9372d473d7c97d18fdf7cf4621f37036cc44b34b6bb341", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661751, "uuid": "658fd96d-00fc-4d07-9d7b-14072d8b729f", "value": "T1FB144911FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661751, "uuid": "8519e61b-105f-4fb3-b4cd-c151e442e145", "value": "3072:ty5+GoCEggi4NerYqltSwJpH6+cYstk+Uat:o5H5BT48rYq1wjY2kY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777661751, "uuid": "6a1adf47-5eb9-47c2-a7dd-f8f11daca199", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777661751, "uuid": "636d0d7b-de3b-4ed9-9867-7856ba306f37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661751, "uuid": "cd97a910-b9ef-43be-85fc-fd6c059cb5a4", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184b4125-4586-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777657766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657766, "uuid": "e3892cf9-f7cd-486d-b25c-b7ed52e0d0b5", "comment": "Malware payload", "value": "24d2d4c217ee42a4a34c048e045ceca6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657766, "uuid": "872a35bf-21b5-45bb-bd98-0440959febe9", "comment": "Malware payload", "value": "9c87d54f556642a57393a054a46608accf9a560ee5ab7fbfa22520e001794b2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657766, "uuid": "4de0fec7-db5b-41a3-878a-c2de3bd1903a", "comment": "Malware payload", "value": "78e9f50a7680a7afa55dbc33bbcca750b7a7ac9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657766, "uuid": "4a24ec83-f03e-4ed5-80b4-1d39044b5db0", "comment": "Malware payload", "value": "b9f64c5d0cb9b7f62e03aaf1453c0c4fe9abe02e862a14d59822883da7a9a39669c9e283fa24f5dd5400649fb422eff8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657766, "uuid": "d8eda95b-8e42-4cdc-931a-285d662a68b3", "value": "T1AFE1F803B32D0D0BEDA12F34B8AF1381438EDEC454A8950FE94D728661B5B605C797CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657766, "uuid": "6761390f-4f44-4fa1-a483-05112696069c", "value": "96:DSCOHLYYIff573lvk3GOsJJnWSaNDy9Ebry9HH78IWgqy2HBD3lcElSws5gyxHTm:sHctXBR8sJJnWSJ6Kpsg+IHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777657766, "uuid": "42d4ba9b-22d8-4207-a2a2-1e13157468e7", "value": 6880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777657766, "uuid": "ac6b7959-283c-47eb-9464-613359504d57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657766, "uuid": "af3cb640-4e2d-46ad-a309-2a76725e6836", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecf399f-4553-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777636114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636114, "uuid": "b8c574d9-f9bc-4ef2-a9bc-a8cc76ea3f1e", "comment": "Malware payload", "value": "8ff56c6bdac610e62276253b11443b6f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636114, "uuid": "01dc0127-8b5a-4346-aec1-b022810040d5", "comment": "Malware payload", "value": "9dfbd4ad0dde7ed7833f3120992f7c40b60aa48ab27041a600ace20e0c316aaf", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636114, "uuid": "bbdc2163-c4f1-4559-9b53-b1212af4bf3f", "comment": "Malware payload", "value": "04d87ae1202c71ce0403aa23778c481ff20a00ba", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636114, "uuid": "7b968566-3d89-4fc5-8045-7c47d566eb42", "comment": "Malware payload", "value": "06bda8f7e36360dc4c0bc2d0d1135a47c36fb5c4baba3d9f82fc24fc382eb4414e8da842aad039134db4c96ac629c3ec", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636114, "uuid": "a18e67c6-f86c-4c08-a9ab-3b87eb90785e", "value": "T1F8B41392EDC741F1F82716B459A8E6BF8172E90380F4EC7BD295409CBE17E94592E20F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636114, "uuid": "f88d2c23-d5bc-48a6-80e0-d3eb91e252d0", "value": "8d6437251651b04d67c41efc0bb1245d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636114, "uuid": "a9436ff5-476f-4d67-9753-4e21a23a49b3", "value": "12288:1drqxQeq4CH95wIEuHjXlUOfJBNxE1fx7mwwq:1drwNqNH95wIE6jX5YfJmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777636114, "uuid": "f3d4b6f0-05b7-4067-9ea1-adca7cd57ed5", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777636114, "uuid": "df345673-e73d-4735-a443-547ebabafe32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636114, "uuid": "1c896de7-d2c7-49c9-ad39-8f990208a094", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c54c60d-4557-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777637774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777637774, "uuid": "8ea98a9c-9f09-4eb5-bd9f-3b9744ae6594", "comment": "Malware payload (Smoke Loader)", "value": "2a593cdb6a02fa727ab73aa91fd45e10", "object_relation": "md5", "Tag": [ { "name": "pw-7744", "colour": "#361E9E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777637774, "uuid": "fbda72cf-23ae-4f4a-82cd-fcf8c54cf2f6", "comment": "Malware payload (Smoke Loader)", "value": "9ed1688cd7416f7e7572574efa225a7011d9700e9eb8923f12f203542bf0a678", "object_relation": "sha256", "Tag": [ { "name": "pw-7744", "colour": "#361E9E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777637774, "uuid": "f0314add-bfaa-4284-a4eb-76aea60196c4", "comment": "Malware payload (Smoke Loader)", "value": "22226818ce545fb8cdcbc1f7190da301d9eec38f", "object_relation": "sha1", "Tag": [ { "name": "pw-7744", "colour": "#361E9E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777637774, "uuid": "86d2ef9c-b26b-4ea6-897c-f027fb694db8", "comment": "Malware payload (Smoke Loader)", "value": "185230b283e9f056874554dc16f655b3b31aaa3bc90888469b53ceddaa9c6c3b29971fb19d3048b00e6a4bb769f459fc", "object_relation": "sha3-384", "Tag": [ { "name": "pw-7744", "colour": "#361E9E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777637774, "uuid": "af6157ae-1beb-4435-adb2-9e9f4f1b083e", "value": "T134E633FACED2430648DE9BF8CC59DCFF5B6CA47F101965C29E86388852070E469A17ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777637774, "uuid": "d617a732-7be0-4354-ade3-2189a762bbf3", "value": "393216:sZkzzKLSvoB7kWFf8RFqbSv/n6Dprahqiy4Yxj0t7lJ:4kzzKQo6Kk/qW3n6DpOrq87/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777637774, "uuid": "f37b14aa-dbe8-4f63-b498-0ab2fa27968e", "value": 15134910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777637774, "uuid": "1931ebf1-33b5-4586-af15-7576c5189aab", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777637774, "uuid": "d615902a-1701-4308-948c-51b1f21a1eae", "value": "WallpaperEngine-7.6.1-win64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e9a908-4520-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777613948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777613948, "uuid": "60ce001d-3199-40b7-9fe5-684a29a97662", "comment": "Malware payload (MassLogger)", "value": "a0efc27b38eeb3a1d20bc03d4c39abc0", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777613948, "uuid": "3885fb3f-3adc-485d-8763-68699fb4a148", "comment": "Malware payload (MassLogger)", "value": "9feb9be42aa71275e2018333ebffeebb4cf01d07998cbf3b702bae571222fa9b", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777613948, "uuid": "28aa6fe3-8282-4d4a-b73b-8c9d022e8bc6", "comment": "Malware payload (MassLogger)", "value": "9ef2778541227452530db174832288e283103bca", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777613948, "uuid": "f9dd0cf9-9bbe-4c83-99a9-afb76fa2e558", "comment": "Malware payload (MassLogger)", "value": "f47492cedddc40c16219d0ae6f28d729e07d26e68e8a9fc6c0cabfe4cb6f27dfa26f644deecf944b4e3f230759a8a5eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777613948, "uuid": "05ab9d4c-ec97-4e0b-bb68-70c6e3eb5a90", "value": "T1C2B56C17C66F9B4D180A3B51106A5D9AFE89CAFCEF726BC4E0CF90B514EE1110B856B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777613948, "uuid": "a7054e37-72fa-41eb-bd3b-d67e99bcf959", "value": "49152:WNmPG8SYo+SemWlXWIjPYsN0Ydgw8ZWpGsoY6j2l+pgGZgVS3:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777613948, "uuid": "b5c48944-a9dd-40fd-b02f-30583dcba1d7", "value": 2359360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777613948, "uuid": "3d822fd6-1761-4157-afba-6754e72bb094", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777613948, "uuid": "791cdd93-57f2-45db-8d0f-8e5d89a73261", "value": "file31.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f67a187-450a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777604520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604520, "uuid": "16a9e8c3-d6f6-484e-8e8d-420519550d66", "comment": "Malware payload (Mirai)", "value": "3c69389fa40f36e573f7afcef480445d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604520, "uuid": "1f2723ca-9b73-4f01-9a1a-591aaea395d1", "comment": "Malware payload (Mirai)", "value": "a01bec987b32813ebf9d0889d52a2fec65ac91e2889542fdf3dd27c66a0a5c21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604520, "uuid": "3023474b-8934-4cf5-a565-501b245da264", "comment": "Malware payload (Mirai)", "value": "a1d880d100cbf6718fcd7904ec80931f2a035aec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604520, "uuid": "6f36973e-45df-405c-953b-bcf2a2f29f8f", "comment": "Malware payload (Mirai)", "value": "7ba7f78a9a76d95ee276100688317eae784dbe8f3403f28606b28c20bf9c736e8fa0926fb08e2c866eb9f0077cb2cd46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604520, "uuid": "a53090ce-1861-4974-a750-ac36b0dac7f9", "value": "T15A433B95B8818A13C5D1127BFA6E958D3B2553E8D2DF7303AD312F603ACB82B1E67D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604520, "uuid": "7742a763-3a40-4e15-a0d5-ca8fd122e10f", "value": "768:tggXcF+VOMTe5EIf2Gqh/FOy0MLggUKMwPz+X43RAAJIKH4ZGNOIxC+6JrhuwbZP:PXwMTBnOy0tgUKMYzBmWwUw1b+10mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777604520, "uuid": "fe1b084c-3218-4ccf-8cfa-716b7f900856", "value": 55688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777604520, "uuid": "08a0ce5b-ad50-4ad9-8846-1ae46d3cf534", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604520, "uuid": "0fd0bbc1-ea1d-4824-853d-52539978d395", "value": "botx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c881c6-452e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777620100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620100, "uuid": "7237d1f0-5574-4747-bb02-caf0a2a52282", "comment": "Malware payload", "value": "b08e70e39fb6a390b01db402afe74098", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620100, "uuid": "6cc81bb8-7d54-4bb8-8744-46e76e660152", "comment": "Malware payload", "value": "a1f7dc1c403ebdcbf8be75445a3cd78399f56caf5a4429a9a7278a567981f3cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620100, "uuid": "6212afa3-8617-4145-834e-5b79c6592119", "comment": "Malware payload", "value": "497e692dd4f41a1a713e4f0dcbdb0c8d2b3a5792", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620100, "uuid": "07d78ed7-38e2-4708-b961-1c3fcecbe429", "comment": "Malware payload", "value": "22bfcd3bc0b0819c63975e784192bbda96bbbba560c8af7d39bfb97a6aee0800c8ff2a8e2a86285c669a8c666b780e75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777620100, "uuid": "826791de-56ed-4ff9-b810-ff072f686c72", "value": "T170B3E945BD018F13C5C361F7FBDE429C3A266F6DD6FA32029925BFA0378A4D6093A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777620100, "uuid": "5d3432ae-cf11-4bab-bfb1-08695b6ebb4f", "value": "1536:stT/lCERy2LHQ+4VyM3zTVaOXtjklOaWPlH4wywHOXjyKEa7q7PyOtX9fxDvRIjL:s9lRyd+4HjBaO2lXc7/RIjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777620100, "uuid": "2a187e75-cec0-449b-9b13-313fd0486d6b", "value": 117656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777620100, "uuid": "5094917b-5b66-4388-a67a-d51daf16d8a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777620100, "uuid": "de52cf22-4572-4ba2-b796-6b47de0c7268", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a308ca00-451e-11f1-a769-42010a9c0008", "comment": "Malware payload (Moobot)", "timestamp": 1777613331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777613331, "uuid": "c57cc676-b08c-4b4d-bb07-38ff4cc8c019", "comment": "Malware payload (Moobot)", "value": "fe8cef0d7926b0af7cbfb6298f805e10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777613331, "uuid": "2ef1c2cb-a4ff-45fc-aa5c-19c2e0dfaab2", "comment": "Malware payload (Moobot)", "value": "a23e2caa4d9d208c263c5e7a6cd6bfb5d2faecbcacd584ba6a95e4647de2d4fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777613331, "uuid": "103062ba-7be3-4764-8ffa-5570b08a0d92", "comment": "Malware payload (Moobot)", "value": "11b633ff6c997aaa4d63c5a1e2ef361734672e05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777613331, "uuid": "8d94bf97-64bd-472c-83cd-c7edfdb37744", "comment": "Malware payload (Moobot)", "value": "ef0a2d104c85651cfe7d344919baa7a6c958e17cdc70af9ee968f43edf48cbf5cbe82cff4f6dbbc3f168b8cee9e1ce5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777613331, "uuid": "99a530d0-1523-4c8d-82b8-40dbd66b73f8", "value": "T1B033FA85BD829916CAD84377FA1E42CD331173C8E2ED7223DD257F51B6CA52B0EAB061", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777613331, "uuid": "b86a2d2e-b810-4570-893e-22143f0f60a2", "value": "1536:0nMyIwJNhjLxWuAwjOstfpsUi9BwbZnD:PyIwJHLxjpastSxBwbZnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777613331, "uuid": "2f1bc13e-9c9b-4693-90ef-db2b49b8d476", "value": 51608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777613331, "uuid": "547c470c-1b2e-4573-9e60-e7f2befec53f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777613331, "uuid": "994ab72b-b465-47ff-88c0-beac164732c8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1843c0f3-458b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777659913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659913, "uuid": "5183fbe2-9811-4be3-894a-b02d7c3e6f88", "comment": "Malware payload (Mirai)", "value": "2d70e93db858b3a3f4e63ec6b7d980c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659913, "uuid": "4276cbc7-8923-492b-a132-ffc41440bda5", "comment": "Malware payload (Mirai)", "value": "a29e5e73ebfe7cd581f4b69d79c0aed4443be1b26fc5ca92be02f88cb779c6c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659913, "uuid": "9e636c48-0e6e-433d-8284-4158e08caaa8", "comment": "Malware payload (Mirai)", "value": "2fb8348eed000c022192ac026704562b72e93593", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777659913, "uuid": "8083889b-3915-4be4-bc34-9576ba7be6ae", "comment": "Malware payload (Mirai)", "value": "8c82d25e500070e106d3876c9ff197f0668b1666b61fe81a207b0da58399aad50b17a4bb1843c068702a3af308af312c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659913, "uuid": "5aea3201-998b-4320-aef2-f9cdccea3ef9", "value": "T108C3F185FB636991D0A342FDA4C00AC387912E318BA217480699F774387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659913, "uuid": "942625ce-b133-40a8-8b91-159402a3ca69", "value": "3072:SBdQK+TG2nIjnRdZaUXUSgkLCCVwHWiEiBtbMMTn8:eMQRtXU9kLCP8ifbxTn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777659913, "uuid": "f27d4944-6917-45b9-afb7-695b01506101", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777659913, "uuid": "28ca0145-ac61-4c7f-824b-5b7a348f26b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777659913, "uuid": "f419bbad-8b6c-4cdb-b830-254be38a4197", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80872f1c-4575-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777650639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777650639, "uuid": "e8112537-4d42-4fab-a5c6-fae77513aa45", "comment": "Malware payload", "value": "2081c91d1bc001ffdaf1d1a83cdd72ed", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "cloudservbr-com", "colour": "#A77250", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infra-telemetry-com", "colour": "#E9E6E6", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777650639, "uuid": "71da58e8-2dbe-43da-97df-d014e1c5b5e2", "comment": "Malware payload", "value": "a2d9d1ad3d8a618ca7c0125a3cd8e1afe36759f9ccfb4965aa48358408e9d051", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "cloudservbr-com", "colour": "#A77250", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infra-telemetry-com", "colour": "#E9E6E6", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777650639, "uuid": "cf2cedd2-1f0d-4f45-be54-0dcb30b9e95d", "comment": "Malware payload", "value": "43f29bd0e3e33a0e81166aac92bb4d80c789e580", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "cloudservbr-com", "colour": "#A77250", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infra-telemetry-com", "colour": "#E9E6E6", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777650639, "uuid": "1c0f8836-a805-48f4-a6f1-ca34c6ec1b0b", "comment": "Malware payload", "value": "63387ed8f2f3f020fd5a9946dac15bc6d3caca5282da9ded394311dd72d965b9b1597cd80c0cb0b765942c0e7316c834", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "cloudservbr-com", "colour": "#A77250", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infra-telemetry-com", "colour": "#E9E6E6", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777650639, "uuid": "ab228ab6-2f91-4e26-a10c-17b55deca835", "value": "T17534F913F28254F9C45AE6704ADBE273FA31FC4D6234B71D9EA44B652E13F909A1E708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777650639, "uuid": "4dfc96a6-e3c9-43ec-90c6-fe78b51fb5c2", "value": "0bad7cadb368b06877b973d66e5fa7da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777650639, "uuid": "149b56b6-ff64-4a24-877a-df4ef259c2f0", "value": "3072:uM6F2N2XWLPY29W8uiyF3QVyhw8A/CpFSYjgFaqmWOqCj:uM6kkmL7BP38ActgXmWYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777650639, "uuid": "f0d1db96-0db2-41c6-befc-362a8954802b", "value": 247456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777650639, "uuid": "a99ee134-20ee-416c-aeac-0db76071c9c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777650639, "uuid": "534ad16c-ef35-4fa5-a9ce-15ae528e9092", "value": "a2d9d1ad3d8a618ca7c0125a3cd8e1afe36759f9ccfb4965aa48358408e9d051", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e821027-458d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777660970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660970, "uuid": "2140d40e-b676-45c5-97ff-d2d44273fd3f", "comment": "Malware payload", "value": "6080a41b5ca19b7e6de48c0a4d4526b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660970, "uuid": "0444ee9a-4d73-48f2-9285-0dbd0677596c", "comment": "Malware payload", "value": "a5f10fa20347d09f880812bb6a3f6dddbe97f8593873d516b1b18061e91d4577", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660970, "uuid": "2c7daac3-6b70-4786-872e-13d18f020d39", "comment": "Malware payload", "value": "46dfc4578a75f357168e1a7939f6b30c0810b350", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660970, "uuid": "06e5dda2-5a98-4b4a-bd5c-c7321e3f2fbe", "comment": "Malware payload", "value": "865cb93ab745edf5f20a99cd700a5285348b9a1c5bb9831acdf1b8b83d74a26541bfde246f1749aa8e4eb098d881da2c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660970, "uuid": "704eb5a3-c475-4ba8-a0ce-716e0a916575", "value": "T1C9E04FE8A07127839510AF00F867C2599503EAD814E11A24A5A5346DC7BC2003D6025E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660970, "uuid": "a2022ac3-b21d-4ebe-af3d-26af5275afce", "value": "6:3J3DdihdLVqpDdih7Fa0LKiSGSDdih3kI8Ddih3HWXL7DdihDanIHn:3J3u90pu7c0LKWSuz8u6uRHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777660970, "uuid": "5334bcc4-a308-4c39-adc4-7ad1e4980cb4", "value": 325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777660970, "uuid": "5d982fb3-e556-4e93-abd8-38c7630e5f37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660970, "uuid": "0c4609f2-ada2-4d45-bfe4-0b01fdca82f6", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1a53f4-458d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777660864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660864, "uuid": "ab6e0354-714c-4103-8a52-d488502ee795", "comment": "Malware payload (Mirai)", "value": "3cda0203d13da8f91d8813f09f9d556b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660864, "uuid": "a81800a7-cd58-4713-b038-0bea16510681", "comment": "Malware payload (Mirai)", "value": "a6e24b6addec8b3c2a3a7aaf972dc1e3e87967c595ed2672274b6fac4d21a513", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660864, "uuid": "591f0cd0-60ce-4b4b-b2cc-76c602a95a16", "comment": "Malware payload (Mirai)", "value": "1513ae92746bbe903981b426a671a89929bccfab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660864, "uuid": "e9a03e71-55bc-4273-be30-3d822e6e5225", "comment": "Malware payload (Mirai)", "value": "e4ae916fc015f849f99f486a93915f1791b99555f11fced37ce6001ac366b0bd1bd5f9598e385ddebee3182c984efdf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660864, "uuid": "91f4072a-bd8e-4e64-895b-c966cd7863f4", "value": "T16C146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660864, "uuid": "74395494-fdc9-4891-864e-e50e210b187b", "value": "6144:zNROm5155gL6mTX7zRR1Lwt8Al7IKTtd:XgLnLzt0ll7Ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777660864, "uuid": "b7518b65-c2f4-418c-ae74-b58dd804eebe", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777660864, "uuid": "27cb2a0e-8be8-4fd9-8491-927c5e19aedf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660864, "uuid": "878d1659-2424-4665-8032-a27ac5bdcb39", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae44e68-458e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777661447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661447, "uuid": "21e3d3c2-b21d-4fe6-9a80-6c7ce6b8c366", "comment": "Malware payload", "value": "bd4ec7d62ea2707a26156d399e6483c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661447, "uuid": "00bda5e2-6a0b-41cb-941f-095d39dfe8ad", "comment": "Malware payload", "value": "a6f771fcd479e5430a76853790e420fbd81b3786de306f5e78ba4ca613811b40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661447, "uuid": "7c424dcf-cd23-4481-84ff-67989421bf94", "comment": "Malware payload", "value": "48d084e5d33cbe32cf7c9dabf0060d702eb527a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661447, "uuid": "762928b9-df08-4fe4-9293-914a83cf60ea", "comment": "Malware payload", "value": "bb9e1824f13026f62b0ea85864ac666898cbeefc02d14059e19e94f806ee1e4b01238089ee302f7d00298061f30d6871", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661447, "uuid": "a1c51a96-5606-460f-a34c-7bb04ac1db61", "value": "T14502AF623B42CB15E6A506B2139D0CCB7942115D34BB953FEB486B91397B1860E1EDE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661447, "uuid": "6f33039b-5928-4bfd-921c-a0a1c1f57e05", "value": "192:z1gIbGAAnM/HCqLpgbIYEdUsV7Vg+YohTpWOltZZEaBHKERe:z1gIHU7b6HVJ7BhTp/ftBNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777661447, "uuid": "081396a3-43f5-4d8c-9f98-1003e2797601", "value": 8628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777661447, "uuid": "2e6fab55-1c5b-498a-bbb3-9e1abf6b805e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661447, "uuid": "e36b9fe3-3224-455a-b354-3139f51a540f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf33fe4-450a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777604514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604514, "uuid": "d052a5c9-ca74-46fa-9c2f-b64bcc6189f3", "comment": "Malware payload (Mirai)", "value": "8e03f56adee485786e92f2ffc8db95e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604514, "uuid": "a54b59b5-fe75-4a0a-934b-598012002a35", "comment": "Malware payload (Mirai)", "value": "a7c7f15c41564b3910927926739978173707e707140092e2dea608370f18de75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604514, "uuid": "278915a9-6231-4571-bde2-9b6a0ea4cbb6", "comment": "Malware payload (Mirai)", "value": "b44c27eb4425d928f805f134bfa6f00d128a1d6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604514, "uuid": "33d0c584-17a0-4783-93e2-64063c2591e8", "comment": "Malware payload (Mirai)", "value": "3dcf828a7d72e4417e07bf45e49ac847bfdac30b532206a2c3b41f5543f5ee14fa0ddd79d21d142f5660887a29faa8ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604514, "uuid": "47a8ed01-4de7-4159-ba96-46c8df6b0700", "value": "T12E435B31FA762E27C0E1A07921F74B15B5A553CE22A4C61E7DB20E8EBF205806953EF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604514, "uuid": "ec43f5e5-0c92-44db-bd83-2ccd5d1dbb5c", "value": "768:wvoTARgKV+Uyzo4DZGb+917UZLuePdW9MXQpgO+T9koywmJh+0V0U8YXIyLK:wvQAmY+UUZdGyD79cQQJNmfjV04XIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777604514, "uuid": "85a0b1c9-43c4-4489-8b75-20dd19028bed", "value": 56704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777604514, "uuid": "c124fa78-3508-4d37-867f-123312285202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604514, "uuid": "51dea714-9147-4649-a225-fb722f920f60", "value": "botx.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a25e78-452a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618575, "uuid": "f829b336-9fc2-42e7-8649-afa97a4f453a", "comment": "Malware payload (Mirai)", "value": "3c440dc44fce5b291087d175d6dcb39e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618575, "uuid": "ced88287-4bb3-452b-ac88-213e9d9b3151", "comment": "Malware payload (Mirai)", "value": "a87aa7995ee9996952edb323d703875812f71d08237756ab44367f10e6197c7e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618575, "uuid": "fba9a560-3b05-41f1-9e31-3b376c319150", "comment": "Malware payload (Mirai)", "value": "ab1bb03206e85d7a9314031bdf54c3a85fb0b7e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618575, "uuid": "080ca5c3-6788-4e3d-833c-342d48acc8fd", "comment": "Malware payload (Mirai)", "value": "49378030ed4475f9755814bc737bb1d1eae408c2fe6f0e298544c971d94727f05887678ae3000939cc6bde9a6c829f04", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618575, "uuid": "eed43545-7abd-413d-af66-33bb6d29120d", "value": "T14DD32949B9919F12C5D722BAFA6E428933137BF9D3EA7102CC205F5437CA59B0E77212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618575, "uuid": "ee63e2ef-f8c7-43d7-ba5a-623ce4e1ca0a", "value": "3072:/Oi7ZcxGL7rzrzSsMdDOoLCLK+tTB9tPrgNaAmBydR/E199P2+nTmpIm+L:J7eQL7rzK1DOoWLKiB9tP0NaAmBydRcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618575, "uuid": "1b64ac42-bebc-439e-97e2-9591fdb8d27f", "value": 140316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618575, "uuid": "4494619d-1e26-4132-ae3c-b6330c06fb62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618575, "uuid": "fefad3c5-6c38-4ff3-a115-00d43e483333", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8afa7d-4527-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777616942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616942, "uuid": "d59a63b0-9da1-43eb-b0ff-f86b102f0c43", "comment": "Malware payload", "value": "a7b54d4f5ed59eb26e875ac7b444459a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616942, "uuid": "889608cd-1d09-4fc7-b9ba-67422f850f2b", "comment": "Malware payload", "value": "a8dd11a9ba8878556ed85552cbecdb5cf1dd9826b1e90bf997a2aa89962adaa7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616942, "uuid": "5c9e663d-400b-4c22-b368-f6612ffafd4b", "comment": "Malware payload", "value": "d3d07a26a02b61e46f1d2f9fe6ef36f467452bd1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777616942, "uuid": "c37e389b-a7a5-4337-8f14-2a978e3ce103", "comment": "Malware payload", "value": "e376a84185d943af7cd88d25d137f7da1ac497108551b0e4f8d8ac0b0a82a643c8df05adf39d8b84d7cc1e53729385b0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777616942, "uuid": "d76e99be-e94f-4e15-840a-a09fa9d806ce", "value": "T1AC3533DD294D89DCFC629A3C12EB6F1356EBA9148D1EF37669D3791883C2500D7A8E30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777616942, "uuid": "34f768e9-94b9-4e89-a645-47399725cd59", "value": "24576:GIy2wb8bxYkKwN36O+L46az23hMmPwG5CwswrfLN6i2XK2mOO:GB2wbKxYfwYOLz23pw053SKEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777616942, "uuid": "49f16278-53aa-49c5-9bf1-05130e7335ff", "value": 1113912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777616942, "uuid": "d16b2c40-a166-4b96-aab8-f43dc505d5d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777616942, "uuid": "7e58bd8e-bbf4-4401-92ed-b9dd7f092e1f", "value": "RecallGroundsWindows.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6c132e-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777636190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636190, "uuid": "4d2630ca-0901-404c-8a94-20332cd95c90", "comment": "Malware payload (Mirai)", "value": "8ae5e4a4c875e45975faf989dbf83214", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636190, "uuid": "3fc0bcb2-24c1-4f50-b6b2-ced678c0aa45", "comment": "Malware payload (Mirai)", "value": "aa06874309e93840641f018e25d822db99b1ac398e27af5854dd305a0b1685e7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636190, "uuid": "d0b0beab-2e64-486d-ab46-59b1ccc470e7", "comment": "Malware payload (Mirai)", "value": "fc4b5d084f481c2ac0a66056ac5398ec0666df99", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636190, "uuid": "c50cf5e6-38f4-4aa9-8c18-94da805ac114", "comment": "Malware payload (Mirai)", "value": "68fa3d7c1ad34e0445e59edc6a2bb528a6817d3dfec665294ba1fe3f817d100ef2950ab88b2865a0faf9a8bdc3309a18", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636190, "uuid": "aa992efe-69dc-4180-b4d8-b015b51a8fcf", "value": "T168B1A78A511187B2DE0DDFFA7A6B4C8C34C092E15899FF1CC8FA5D96E59EE447006E32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636190, "uuid": "6bdb26cd-82f5-44e2-b09a-0e3952cc608f", "value": "24:Iv6rxMfU6ruEFKPR6rXlhsDG6r8kYJ6r+ZYU6rG1b6rwxSWMr6rdww6r+lFZ6rmg:ryuSXlm/Nbfwx/6UG7sBbMqTb39mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777636190, "uuid": "7febbc08-2557-4b58-89d8-707bfc007fd9", "value": 5314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777636190, "uuid": "867828fd-bec4-497d-a8f8-e2b3b2dc5933", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636190, "uuid": "7ae02a7c-05e9-4871-ba26-249688417f69", "value": "lol.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb67db2-450a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777604519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604519, "uuid": "b73b468b-ece9-41f5-8aa1-d35d267472da", "comment": "Malware payload (Mirai)", "value": "a6fdd6c18d3eae7ec764bdc9919d944e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604519, "uuid": "6a072570-e8d2-4886-977a-78399c27326e", "comment": "Malware payload (Mirai)", "value": "aa0c84c8015e8d0e777350a1076efd796dcdd5f5bb2679064bd1548fd6edc714", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604519, "uuid": "95ee982e-4dd5-4dde-a4ba-b114b887c28e", "comment": "Malware payload (Mirai)", "value": "e189d417bffb4ef4a8c50cb95950f28e12eefc7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604519, "uuid": "d05b5fb0-61bc-48b2-9304-a56d83f02b99", "comment": "Malware payload (Mirai)", "value": "46eca6cc5870b7b3eca2969b24c177e00e5f7cc5e2f683e5e1db5ab09f620fa06c1402a1a6ee7d7a106725808599c97c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604519, "uuid": "6aea7cc9-7625-40dd-ae27-c25fe9ff05ac", "value": "T11F130996F8814F26C5D11279FA6EA95D3760A3E8C3CF7303CD606760BA9601F1EA7E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604519, "uuid": "bcbc4fbe-7a6a-42c4-853e-2abf42161339", "value": "768:nOzWPR27VBj19Pnvik2w12Cso0cHMog+UMMwPCXxkzTRGctihw1axNGwbZ010U5g:nN2rJ1nvikecsN+UMMYAXpnb+10mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777604519, "uuid": "38c2c338-2c17-4af8-b301-717e2475f883", "value": 43644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777604519, "uuid": "bd3d340b-0ae3-4a62-8080-0e756c395caf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604519, "uuid": "98a62e79-a627-47c9-a918-2f9ee3a445f2", "value": "botx.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4869e8-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618663, "uuid": "7cd7d577-6073-4951-b46b-8f8ff6154af2", "comment": "Malware payload (Mirai)", "value": "0fedab0dc0ce3a215a7656a4e6356158", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618663, "uuid": "34981246-f08b-4ec2-a750-b28f07536062", "comment": "Malware payload (Mirai)", "value": "aa212c928de03bd732c2001cf763f8dce852562bcdc12c62a9ee4881826da1b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618663, "uuid": "b6c7f5f5-2629-40bc-801c-5567082ba282", "comment": "Malware payload (Mirai)", "value": "05b05f3424b90db74352897a591a20bb6f453222", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618663, "uuid": "09e38c67-19b8-4efe-81bf-4a51ea217332", "comment": "Malware payload (Mirai)", "value": "fc0d30133f596c56b2f9658053a9630ac937f770404ccdf963312e39324efc77f02e10674103c8efa18fd658a871ca6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618663, "uuid": "232e69cc-48bf-46d5-8690-d0018e7896bb", "value": "T173A43A51BC419B26C7D06ABBFFAD828C331317B8D2EE7112DD154B3136DB95A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618663, "uuid": "1de4034f-796a-4004-bced-8ba98906a58e", "value": "12288:s1Rd4tNW3RFOaASG1AiQvifcqEr1NiAfZTGZ8uWmR4Xy7pEMJFuTA7HMpthC1cEb:ggdEfnpO1fM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618663, "uuid": "2f0455de-e2a7-43cd-b9f1-1b7befc5e201", "value": 471156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618663, "uuid": "5cfb46cb-bfbc-410a-9a1a-c3c3c62d8b23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618663, "uuid": "a7c1e259-306d-4cb7-92ec-6e0f64edc048", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c12cee9-4571-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777648779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648779, "uuid": "43e47101-cbce-463a-a34a-528184d83962", "comment": "Malware payload", "value": "e0c5ffb761254c069b77dc411ce8e827", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-8942", "colour": "#44D092", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648779, "uuid": "aabe32c1-0297-4396-8539-b82c04637429", "comment": "Malware payload", "value": "aa7e63558116cccf1a3ea2afa2b6e0fd3f5cb97cd042b21c5e12de8b5832a401", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-8942", "colour": "#44D092", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648779, "uuid": "e7b66f80-3c8f-4e2d-9fcc-3da229cddf53", "comment": "Malware payload", "value": "d714968bef7e563b21484e3fed79a33c8284e9df", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-8942", "colour": "#44D092", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777648779, "uuid": "48af5fa9-2e72-4beb-9d91-d6e2ba4d3f1a", "comment": "Malware payload", "value": "9ab1602667fa991d354b90a6ea2db95ff63e49a13c5d19e0838d53d2dade1a95610936130d0d71b34cc9612eec435f1a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-8942", "colour": "#44D092", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648779, "uuid": "832cae02-c6fd-44d9-a366-4281be4bd519", "value": "T1170733386A7342482AB8CEB07AFB439C4B1FA6D24510C4F45E4895FE0DE27116D5FEA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648779, "uuid": "6c576d17-0231-4634-bbc6-d025b498330e", "value": "393216:p1Hh5UilG8tkJLBBkEQ94w1bCFIoJMbHyErylDcd:p1Hhj8skJsEjwLjKVcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777648779, "uuid": "8de8d114-5c43-4635-9587-9b2887d5361b", "value": 17390643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777648779, "uuid": "2be78cb5-7e3f-4b58-a5ef-b853abdfb302", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777648779, "uuid": "fc382504-a6ba-4106-b32b-adf740a38588", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b2adb6-4574-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777650027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777650027, "uuid": "6fccdbb4-3721-427b-b514-4ada83d37406", "comment": "Malware payload", "value": "d31ed1be7915f01877b1cab73ad92b4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777650027, "uuid": "ad8c3c95-c02c-4c58-80a9-1e62ef189a1c", "comment": "Malware payload", "value": "ac0177d49f4ac2c1025021b8f375a4677139ae60fa584cea07c2a6553bbf7703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777650027, "uuid": "352ff2ba-79ae-4457-914d-63c8fab92304", "comment": "Malware payload", "value": "e5dbc9c8afc93b7a1b2ff81efe36e97192820b63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777650027, "uuid": "00e519ea-a3d3-45d9-b169-3a12b55d551b", "comment": "Malware payload", "value": "136e3ae5f755baadb742ad51d81293fdbaf46ce83c83e771f8bcf6bee88b130f932430e37b2904938cd6e0f8d1ab92c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777650027, "uuid": "3a0d43b5-5b94-40bf-84f7-bac7e3823a32", "value": "T1DA468E17BCBA5859C09AA13884736706FE657C455F2227C71AB0F63C2F3A7E05BB9B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777650027, "uuid": "2a0ace14-dc2a-4117-8ebd-5bf4894863da", "value": "fea505d19c8cfb70ace7e7db23a7d58b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777650027, "uuid": "c59bfaa4-a2df-4bef-b80a-61f8d28e5b5f", "value": "49152:rQdiF2970pAs/yXdTmYw5FLFeOorZDe3kAYoQQB8HbUIUjftljGRU0WAXek:rlDy6o9pZ08kKReA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777650027, "uuid": "b8981ccc-33df-40d1-9586-0f73485f46ef", "value": 5413888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777650027, "uuid": "8b1e816d-6e71-4ab0-8220-1bc1daf4f3f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777650027, "uuid": "3e1be8bb-70e1-4728-b835-97cca780b844", "value": "SecuriteInfo.com.Win64.MalwareX-gen.59228395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b334f74a-4553-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777636121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636121, "uuid": "6cf4b706-021a-4a12-8d52-3c6e3c9cfd93", "comment": "Malware payload", "value": "7cd53faae6f802dfc0f7282e6bdb4789", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636121, "uuid": "c7303e6b-df96-48ab-92c7-8a1a9d0daf98", "comment": "Malware payload", "value": "acd9d233aea92fb8c10968d7230e5c8374c76f78386a742c61ccf7a000191227", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636121, "uuid": "0f18dac9-9d9d-422f-a894-b9b6c513920c", "comment": "Malware payload", "value": "ef36cf10e616ff94aeed15331284722f7880960d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777636121, "uuid": "d3900778-597f-4639-adfa-e007093471a9", "comment": "Malware payload", "value": "47848f5c61b4c0f6f3ccda7f64eaa2d5cd301a9724379142635e4ec1bc047a58f70bf6d3f0845185613f9a89d5f50fd1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636121, "uuid": "87b60fd6-8ae3-4b34-a792-903dc5c8dcd3", "value": "T15DD36212616153FFE07B80F8D2977112B9707AD4832EA7E3961346064A23FEA7A7B714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636121, "uuid": "21af52d2-f829-48c7-9311-85cd2cdc2bd5", "value": "4a5ed7fde316be628a63f68be3787288", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636121, "uuid": "15eaee63-add4-4343-bfad-9ce32056e905", "value": "1536:eWeXIFkeuP+T9+9DVfd9IUBVzHxRy/CBu+OBCeiAdArW3jPxU:CmQRBXRy6BVUtiAdyW3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777636121, "uuid": "0c1aef70-43c0-433d-b834-ec6ac0d701b5", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777636121, "uuid": "6f91191d-64b6-4da2-8dc1-3e3856945886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777636121, "uuid": "8abd05cb-e789-4299-b6bc-801b06646362", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a10daa-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777635961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635961, "uuid": "fd5e455c-5f21-4939-852f-da2a3ed01552", "comment": "Malware payload (Mirai)", "value": "8481db423575eb02cf4639e57a2e3c26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635961, "uuid": "b48a6923-e40f-44fe-914b-4330dc7d44ec", "comment": "Malware payload (Mirai)", "value": "ad3c56147eb28ac0a8a1a7cf9013078544a01392440f9fd40c33120b73255435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635961, "uuid": "69f35656-8a32-40cc-ac14-c64f11ea7e6e", "comment": "Malware payload (Mirai)", "value": "5f35d4aa80aec7956b482fb42d9e7da0532feb1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635961, "uuid": "5c24a3fa-7753-4999-b220-c8e88066c8f5", "comment": "Malware payload (Mirai)", "value": "08dc93d941a004a1467da585c9bb9c4af31c55e2778703493d18ae429933eaf8391eb4c0c7e07a255e34e08f15e98040", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635961, "uuid": "42df18fd-1aec-4ce2-a928-878427571f75", "value": "T154333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE66AE32A02711B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635961, "uuid": "72545e9d-733a-437f-9cdf-bd093a0bcb76", "value": "768:TwzbCo1eCZWUJ2SSpRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV980N+s:Twdt3SpOzwLMU431ANA0BLBC4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777635961, "uuid": "4091521d-a2c0-4ca9-bea4-db91837940fc", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777635961, "uuid": "b0d97243-9b58-45f4-a308-0b2218450fb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635961, "uuid": "e69905d3-54f6-4054-8ba2-38de1ea44c7c", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18afdb6d-4517-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777610092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777610092, "uuid": "f44506b6-3e76-429a-af9a-a3d5629ed2db", "comment": "Malware payload", "value": "1af62005da112e58ee7bc7eb8523937d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777610092, "uuid": "89f13b9d-b1fa-440a-8d13-9addc264ba70", "comment": "Malware payload", "value": "ad72e6bd79a8f54d4de8327a75e575c08a8681914bdfcbe52c74df895780bbd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777610092, "uuid": "e3b9ee0e-8a96-4f54-a3b3-805d78460350", "comment": "Malware payload", "value": "4d84444ee2247e5b877f568e88d48b9777a8d893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777610092, "uuid": "a7746505-4301-4b8a-a7f4-f51082da327a", "comment": "Malware payload", "value": "89b71226ff6adb16250fbbe561555551870d60f35afbf6a6e579e0b9d499410e4825370bcd70fe759b74dd0995814f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777610092, "uuid": "615fba9b-f312-4881-8680-7b3a34ea0885", "value": "T117E1E916D7E84732ED770A30BDF1A311173AF611AD678FAE2585600F2D2A7550922F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777610092, "uuid": "ed4cf741-a852-4305-a6e8-0a04cb2b4fbf", "value": "96:CwVJcMyjEomPDo9USVgISmo/ilzvTH715FZPpjivh2fu/dB6k+Y9ozNt:C8JcMeEom7Nbt6pb1P6vh+u/+k19q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777610092, "uuid": "69f15f52-13ab-4bfd-a78d-797161b29cd6", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777610092, "uuid": "25be8cfb-5323-48ab-9227-8b7148a1f1a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777610092, "uuid": "6ffd5bd8-307c-41d5-b4a7-73265fa7c0e3", "value": "svch0st.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f7f86a-458e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777661570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661570, "uuid": "d54c0224-2aa9-4d4a-9262-92f9aced0167", "comment": "Malware payload (Mirai)", "value": "546fe53640c8f23d8a7c0e4f8ca958ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661570, "uuid": "14676da1-29cc-4ff0-9c92-ba7feb717bcc", "comment": "Malware payload (Mirai)", "value": "ae89a5caf41e33ca88de6da86789f8ec5d8827ec156a2cb98ab3671254380a35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661570, "uuid": "7fee6f69-1816-40a3-a9bf-ac23c6b2d12a", "comment": "Malware payload (Mirai)", "value": "43e27c403212341bc8a3ada0408da1e2286e8efd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661570, "uuid": "e5621de7-24f2-47ac-8192-4eee8a1956a6", "comment": "Malware payload (Mirai)", "value": "9e6c206fba48b8b87491f1742fbb132b4280ecfc21df8fbce4800f193332dea5a84dd923935e7f545e0589fd3e524a7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661570, "uuid": "209e996a-abb7-4856-9796-5e69aac9ff7c", "value": "T193B3D085B210AE55C02272FCB1870A90D3B16E7B4B9A150B44B3F5B46DBCCD47E1BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661570, "uuid": "68157bcc-3f60-4db6-b491-82a8fa334877", "value": "3072:X5Apzl9NOvXoVLAE375lhYy5SkOXNwuw:aevXCLr59hmNwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777661570, "uuid": "fbf381d6-7bc9-4932-a5a2-2babb19b6c99", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777661570, "uuid": "9f7adae3-642b-4de3-85aa-0a0c3a28d73e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661570, "uuid": "89e37e48-4df5-4ddf-af46-660ee9f0d51a", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b76966-4580-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1777655164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777655164, "uuid": "6cfcd1b7-67fb-4e72-9699-59b23fa2f561", "comment": "Malware payload (SalatStealer)", "value": "12d0beb9db8e9216961a61181a65302e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777655164, "uuid": "1a0887e7-792d-4830-bde2-020f41473c4c", "comment": "Malware payload (SalatStealer)", "value": "af033ce62081ede3b38f18654b729c2c56eaf4d941c43c0e0d9157aa7dea4652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777655164, "uuid": "9367fd46-34ef-4775-987a-4fd0dfdeacc5", "comment": "Malware payload (SalatStealer)", "value": "af5066c2a1d163d5ecbea3a041ded25633c177de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777655164, "uuid": "d72e6750-148c-48fb-91e2-b45e3bb7ce3e", "comment": "Malware payload (SalatStealer)", "value": "b0c831c3d6ce9d30e6fad7c30fa450e3cf02cf9ac25b200c872c7590e7a353332e377244bff7de1fc8a3440c9f09b93c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777655164, "uuid": "58cb60e8-7417-4a98-b2d8-57acc993dc11", "value": "T1F2F5336882877DC5E2378234A05A3FE7C6B85BCDAC24DAC9148A943D89EF351B6D7074", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777655164, "uuid": "bbec81a5-4f47-48d1-8614-4370579f6925", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777655164, "uuid": "72a71b66-4b1d-4c04-bf5c-68c94b5ebcbf", "value": "98304:vSgBbU/X0Z5muxQSoI9e1s3y0JvdCo6n4rb6u5:vSMEXE5msQS21sC0JvdCoKED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777655164, "uuid": "9f6c7058-9f94-4037-a9fb-fa208bbeb26b", "value": 3594752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777655164, "uuid": "06b8b34b-10b5-4764-af2c-fbef7464b336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777655164, "uuid": "93e6f34a-4b8d-4223-b5fd-dd8c6ee1b2aa", "value": "docconv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941af6e7-4584-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777657114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657114, "uuid": "c6a19dc3-34cd-4a60-b690-425ce5ce9b99", "comment": "Malware payload", "value": "d59387fa8822efebdb7ac78233daf2dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657114, "uuid": "2564a654-f565-4c18-bef4-45e7bdb20afd", "comment": "Malware payload", "value": "b0cac3094143afdc8518d75a71f87cd0719df82d81c7455b011729ec69dd3f63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657114, "uuid": "3cac865c-8cba-4d3e-a236-db13eb63d62a", "comment": "Malware payload", "value": "c29f527683248da7c25ed71bfde5c0ea5c214774", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657114, "uuid": "780895b8-a566-4590-b0b9-ea4cf066713b", "comment": "Malware payload", "value": "cb90e15eedbef248f5e4e8a23f5837b7e11b3afe4d83e2fc5e304f6176024c990b4dfea27aa1c81eeaabf3e6bde7db77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657114, "uuid": "9d15a07a-81ee-4091-a9d2-d9b4db5fe83f", "value": "T18BD17C44A251990AEF68077B428E5AD375A3322C14EDCB3B1A440E137E7F186A91F5D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657114, "uuid": "fc9687b3-1a85-4459-943f-9fa9441464a9", "value": "192:INFE5Pp9Kkvn0kArhTpWOltZZEaBHKEeuu:fN7KkskGhTp/ftBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777657114, "uuid": "f4545a5b-4100-4fb0-94c2-18aedef1c6eb", "value": 6384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777657114, "uuid": "4b5a2c1d-4365-4451-9028-70bb89c13bd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657114, "uuid": "ad1fb554-a044-4065-aebf-f259ef632888", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6325cd-44f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777594475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594475, "uuid": "997fda40-ff10-4001-93d6-5841dc43f280", "comment": "Malware payload (Gafgyt)", "value": "84f4ab7f856e894edfb19715ac940fe8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594475, "uuid": "261e8a9e-afa9-4e1f-92eb-b237a47d6600", "comment": "Malware payload (Gafgyt)", "value": "b0e39994c827b4f3788bc46b2b6957274ae7963f5f202abf9987d79dfa1323e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594475, "uuid": "1935bd60-d3c9-4f8a-856d-f7a9d5f37e01", "comment": "Malware payload (Gafgyt)", "value": "c093fbf82f66f3f057af2fdcb7065c352f2b74ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594475, "uuid": "4a51d97b-c2a5-48e4-8cfe-517432f3d739", "comment": "Malware payload (Gafgyt)", "value": "869c7e5dfb21e8709ba695db58dd87edab074820b3171d00af83465fc62795c4394cff2af789439b53b760e75985e9b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594475, "uuid": "adc71ba7-ab79-467e-a9b0-11056e66231e", "value": "T179B30923BA260E27C0D264B612F74731F9B5ABDA18F885077D625DCCAF641C13627FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594475, "uuid": "28cee25d-a0b0-4a05-a38d-cf41c73464c9", "value": "1536:AmyyLwJkwTNdsBJsuaS6Ao95VkBt/tM14phaKJlsx:AmycwBdsb4S6AoPOBM4phaKJl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777594475, "uuid": "1ed17b5c-3517-459a-ae90-7d4ba88ac00b", "value": 112284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777594475, "uuid": "0ebc9a86-55d1-4bd9-b788-d84c6e160f76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594475, "uuid": "4494c8d1-69b2-4de2-855c-15c4437f1e21", "value": "FBI.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41cde6e0-453b-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777625623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777625623, "uuid": "1cfe35fb-9627-48d4-8d5f-bc1079fecf10", "comment": "Malware payload (Phorpiex)", "value": "171b6ffe9bf05d4d629663631856dbab", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777625623, "uuid": "5eb28f60-9b09-4fe0-b707-4f0c32dac65b", "comment": "Malware payload (Phorpiex)", "value": "b22113958712c8f1fecce2048cefde54c1b2dd3630cfef878b009af4b3c6842f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777625623, "uuid": "9036df1d-8619-406a-b266-a6ebc7f36a38", "comment": "Malware payload (Phorpiex)", "value": "f307494a41dd24938de8dcbfb04c74daf8197c2a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777625623, "uuid": "58b27ae1-1a6c-49ce-a6a4-3f2ee8e1ebc4", "comment": "Malware payload (Phorpiex)", "value": "a6b475b53f29db6e8010301e9e3d5c2028a903fd751e6ec160c5d83f33153b4dc8b148ec87b7ddc3b2d146ab7e3eff13", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777625623, "uuid": "fb477f5a-b371-4ae4-aa7f-aca0e9711704", "value": "T10CB24B2F7101411DC0E204B096315BBB9EBD99B23F8899DBF3904499497CED9F839A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777625623, "uuid": "58bd7b85-182c-415e-b95a-3e70d51e6dd5", "value": "fed4efab6ea2c30baa97b9a0d7a02abd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777625623, "uuid": "52d5ea32-2b24-4406-b3c4-0ac3aa870fd8", "value": "384:akx9GvgsDe4dszlj0IPnUznyuMVH+/1s90tcpHB9z:a7OVzSIPnYzM+c1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777625623, "uuid": "e60d00a0-ba2a-4a6b-83d2-23f154cfab51", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777625623, "uuid": "c015ba08-70e3-4686-a559-c85e3a8f8558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777625623, "uuid": "d49b83ea-e956-49d9-b76b-beabb413b899", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd6ad89-44f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777595441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777595441, "uuid": "5a1477f5-7519-432f-badb-27e88496d16a", "comment": "Malware payload (Gafgyt)", "value": "5d3d806304c3933af5d92709e48d7251", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777595441, "uuid": "831f0fa0-34cf-448a-af5e-94992c4571b6", "comment": "Malware payload (Gafgyt)", "value": "b252614916982ec07d6efad1618333c35ffcb5b487257be09d320f451a0f490f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777595441, "uuid": "b754d71b-dbfe-41ba-8009-861e1a34fdc1", "comment": "Malware payload (Gafgyt)", "value": "844d41fdcac35531401fe32626807092c70cc268", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777595441, "uuid": "c5492364-233c-491b-8232-9ed504f7eb23", "comment": "Malware payload (Gafgyt)", "value": "397166d8cc278f8108f429a78346ff3a620ecb712b73fe93309dbb0e3e288d53d0afdaf57d04a91e1803f69dc60c63a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777595441, "uuid": "066b3a20-2efc-497e-a69e-24d50b4b46b4", "value": "T110156A237B21CF64E325D27009F3CA646AD525A20AE25089B27CD31C7E6176D2D5FEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777595441, "uuid": "4b12a218-6014-43d6-b7e3-e8d9f141a4ea", "value": "12288:gcZi4wes3y+4SexayXt9x/+pVdgsAc/6Pd9Uot5uK8p/KNZkOyymjc:/i4wes3y+4Sud+p3grc/U7Uot5PNZzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777595441, "uuid": "c271b6bf-6df0-4175-9366-1d7b3ab1e8d7", "value": 893940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777595441, "uuid": "5a76cb77-b073-4e56-b867-2d1fd7008176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777595441, "uuid": "7be41b08-14b2-4946-84b2-6dbdaa7a0397", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60fb1b1-45b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777678190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777678190, "uuid": "8a0d42a1-4b16-49d2-87a8-a357cecf2798", "comment": "Malware payload (Mirai)", "value": "08561a0a3fa7ab49c5da8ff29c7c939f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777678190, "uuid": "0e311537-ac3f-43a9-bde4-0d11d3843cdc", "comment": "Malware payload (Mirai)", "value": "b294bfdab63c80be35138d672dc0085635af58b861dcde8eea08f7a5c4813181", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777678190, "uuid": "fd3e5223-1b15-42de-8501-17bf9bafb25f", "comment": "Malware payload (Mirai)", "value": "00da21a31609f47ee05c25abd1d41b6c767e09a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777678190, "uuid": "cb747974-c6b6-45bc-83c8-192168b062a9", "comment": "Malware payload (Mirai)", "value": "a122f7e133cf0dc5fe80077b3e87ec7ca9c6d6edbb52cd210c4c48c3a980b741f590ada67d20fdcf3ed662f4c2ce27f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777678190, "uuid": "605efaf5-ffef-4c8b-be0c-4f9de223ff6f", "value": "T195F34AC7F801DEBEF80BE73B48530809B530BBD150925B376257796BED3A1990867E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777678190, "uuid": "5dafb612-f20f-4826-9555-30451445bc3a", "value": "3072:zGdjD6c5hzXe+jl2iZzKOY0m5NOIVmjbiWLOJ2yaCzCC:zGx6cxZ2iZzPYvNOFL3yaUCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777678190, "uuid": "95eeeff8-d43e-4882-9f1b-931906eaabee", "value": 166016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777678190, "uuid": "f40d1f33-bdbc-4241-afcb-62d6110ad4f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777678190, "uuid": "5a8c11fb-ea3d-4e33-8c3c-323552d8eb16", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9337bd0c-4584-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777657113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657113, "uuid": "d8d1d8a0-2a2a-4127-9b8c-b4127dc4b9e9", "comment": "Malware payload", "value": "3b9b0e1b552ede64cbd6870e668768e0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657113, "uuid": "e40e55da-1d38-4858-8144-95ddac81d51f", "comment": "Malware payload", "value": "b2dd3b00458f5c38a9050f16a8cbb663f027b0f2e54f3ec1ee1ef505084b8f15", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657113, "uuid": "f9bb68a2-c3db-49ab-8d28-fe67bd2a1c84", "comment": "Malware payload", "value": "8c745bc16ece637b6c95b16645c955fefa6c09fd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657113, "uuid": "d695a9ac-17ce-4e55-9232-324f807d3a19", "comment": "Malware payload", "value": "28de23763c46d1f864b9ded539647b133d4e5a760712d9f894891c9abd68ed13f2e23c333fa98ced24ef90e30ab11a68", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657113, "uuid": "3d8b771c-dff2-4933-aff4-d0c3013086ad", "value": "T1B0137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C4979CE219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657113, "uuid": "6fb3ad79-a513-4741-a804-891f702fe993", "value": "768:bF+Z9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bF+ycy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777657113, "uuid": "e8f622fc-a0ec-48e8-ab38-8f8ab502dd65", "value": 45425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777657113, "uuid": "ae0cdc0e-6bd8-4c06-af79-a2bb18d9b998", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657113, "uuid": "329bd2ea-3656-44eb-81c9-bee3de7d2f91", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb410850-457a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777652992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652992, "uuid": "d3430230-e566-41dc-a5c2-d77d2f0896df", "comment": "Malware payload (Mirai)", "value": "3b92e7819a2233d7cc3f0c3fbc4f5f08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652992, "uuid": "17bbff54-5076-4dad-9e5b-430fff30e8a8", "comment": "Malware payload (Mirai)", "value": "b3c223f9849d93d0482eee793b7bf4e610ff52571a5fd1d8d77459259a95a71d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652992, "uuid": "45763ac9-0816-4891-841a-9f5d0aa69fed", "comment": "Malware payload (Mirai)", "value": "11ae5845ce956352442174562af4d105c3513794", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652992, "uuid": "251790c5-b6e0-48a0-bdcf-ab2a8a9040e7", "comment": "Malware payload (Mirai)", "value": "3e455097468ceace4b26f581ef805d2d83c99fbb18ba4c2ccebc85e0313becb525eb6948a84bae0ef602de934c79351e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652992, "uuid": "f24f140d-bf52-4605-b029-1f3660cdfc0a", "value": "T1AE7312E351186BF9DE406B719BB2BD95FB33AE3D331007EF50B914BB8451B802A91790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652992, "uuid": "345a417a-881f-4095-832a-a01a1be1fdcc", "value": "1536:fU+WorMm01sOx+zcCVoXHmB7IjGiQMsGBv36SHWfrEu5/wB:fX/rE1sO7MBB7bzMtzGEuKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652992, "uuid": "042cdf55-d8f6-4fd5-9e76-47ff3348a89f", "value": 75728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652992, "uuid": "ae1338bd-3731-4e69-a662-297f0876770b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652992, "uuid": "315b2466-b513-4e12-b19e-a3c08b5d64ac", "value": "vaxbot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f6101e-45b4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777677832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777677832, "uuid": "c4b50968-6c83-411e-9671-5d1278cc70ee", "comment": "Malware payload (Mirai)", "value": "d21977ff84c09fe60800a6eb7c811be2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777677832, "uuid": "6d90c286-37d7-4896-b6ad-b3f460e12f7b", "comment": "Malware payload (Mirai)", "value": "b4a3e54db1c6a2ae7746a81f54df17ecc4dff53809197eb5fe91936871b378df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777677832, "uuid": "931dc153-9de6-43a7-931e-799e0f1267a5", "comment": "Malware payload (Mirai)", "value": "3491187bdcbe0990db821f4eed2f161db199ea01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777677832, "uuid": "2c4bd68b-1310-4c12-bc7d-13ada7f2c5fa", "comment": "Malware payload (Mirai)", "value": "2002097cdc4e7b12ca0408ce51a626046b330a6e443a7d32980cd93e41a5e0a87f20cd1a8e7cfd8381996b6e17a0fc53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777677832, "uuid": "0e057359-3c54-475a-9698-00cdcc3cdaf4", "value": "T1BDA42A51BD419B66C7D06BBBFFAD828C331327B8D2EE7112DD054B2136DB85A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777677832, "uuid": "5faa41f7-229e-44e4-b785-405a0992b612", "value": "12288:uPRHB8roN+GSFyY/89kJMelizqlN60EL1LVcPUB3wgGukzB+QjmZUbUEnTasE2oD:wwb5mfv6G5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777677832, "uuid": "621feaa7-d706-4f35-855d-982acd9c941f", "value": 471156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777677832, "uuid": "7ba3d3f5-aa93-4337-b919-49a21699a514", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777677832, "uuid": "53d3d917-4c17-44d2-b7e5-00c19da05ad7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a2efee-4595-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777664526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664526, "uuid": "0d29d846-1c38-4858-b40d-3aa130016916", "comment": "Malware payload (Gafgyt)", "value": "fc09120994d38cdce4ce6764905fdb4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664526, "uuid": "38f75076-4014-43c2-9180-aa5299665204", "comment": "Malware payload (Gafgyt)", "value": "b4d564c76fda674c3dcc01802d72c37d6176f0c382407e2428e7d05ab734ff5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664526, "uuid": "abb1cb41-20f3-452d-aa06-b82a5a21af7e", "comment": "Malware payload (Gafgyt)", "value": "7d130a5b58ff9ab810232e00fdffded6669281ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664526, "uuid": "3417e982-9cf2-4f4c-9c87-9252cdb8e27c", "comment": "Malware payload (Gafgyt)", "value": "9305d2eab12bdd513278963e6d46879dd9d576b027fd1de6074ee5a907eb69ad901d99165753e847537c4b3f2222e085", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664526, "uuid": "544bfa62-402f-4321-a32b-ec2312995337", "value": "T18D63E693FD01EFBBF40BE3BA449308057530FFAA49924A72736779A799360E41462F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664526, "uuid": "7a1e0fb1-4798-4d7a-806d-1a6cc04dcb41", "value": "1536:m3WFb26I1keOf9w8FZlz/rEKTQzAvhXvpV3p8RLX:mm86G7Of9tl9ToAJdALX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777664526, "uuid": "a98f0fa4-10ca-45f9-8520-9ef2d0a79be6", "value": 67976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777664526, "uuid": "96ba6880-51b7-43a0-8f8a-59aa0547e68b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664526, "uuid": "b47c9992-ceff-4613-98cd-e4e378ccd3f0", "value": "MK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c9ffaa-4544-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777629663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629663, "uuid": "c6814b1b-5533-41b4-96e4-3628f823a9c7", "comment": "Malware payload", "value": "ea119f974d35fa6f016901274b9c4548", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629663, "uuid": "b30db168-de5f-494d-aa67-3d1c91a4d387", "comment": "Malware payload", "value": "b56e4522e6cfea25a70594907997cb246a24bd1d9302450b42a21803cca1a07b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629663, "uuid": "2518b6a0-538f-43b9-9014-df84d701789e", "comment": "Malware payload", "value": "7637a42235fa68c87348d9e3040b0e24bc4663e8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629663, "uuid": "3093b943-f1cc-4131-98e2-1fa15587dbb5", "comment": "Malware payload", "value": "58ce11a983b62d65f9becb8086495197e51fb6c928fd1208b49ffa92a6281932aaa48a3a6ce8f941d2d6a49cb9968223", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629663, "uuid": "a88d8760-cca7-4ecb-a327-d03892f5a807", "value": "T123B4F197F98114C7922ACAFCC4236D9C5EAEE32FC9C576E501B52F82B4131085E663B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629663, "uuid": "1c9ac291-1497-4f0d-b699-9c4a66f06dfe", "value": "6144:rjgFSVxWTJe4GOi+wOB9fVwUQ0qJvL3HAvAl73/8kzZTrizoCyej2Ph0l9uUikwR:r08V6eOi7EtVwzjToABpizoCV2U9uD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777629663, "uuid": "2b1f4ef4-27da-4f98-89b5-e490e1a3b29f", "value": 510007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777629663, "uuid": "97dc1f39-cc6a-4ead-a4d1-5274bc3836f8", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629663, "uuid": "2070bccc-ef01-40a4-b9d6-81d909505235", "value": "b56e4522e6cfea25a70594907997cb246a24bd1d9302450b42a21803cca1a07b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56eded8-453e-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777627213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777627213, "uuid": "58414f69-5f98-4354-8704-246562ca4d92", "comment": "Malware payload (ValleyRAT)", "value": "fa922f3c95911236499a722da890d27e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777627213, "uuid": "d8717b3a-b1d3-48cc-a1e2-64a6fb36b56a", "comment": "Malware payload (ValleyRAT)", "value": "b73925ad59bfe5c08c029f740e196812cd89bb808789d4db47b979aa1935da77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777627213, "uuid": "8884497c-4234-4e66-8ff0-f1db7313ba24", "comment": "Malware payload (ValleyRAT)", "value": "776b04728ee424ccb75345a4fa68cb14ed8245d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777627213, "uuid": "9c2f758c-7063-4882-9ed1-fdf42a67e12e", "comment": "Malware payload (ValleyRAT)", "value": "8fa59408a7f0ecd8bb6be467a8e47bfa3c3f4307ed9fc161f4bf44a2133f935547bae32c773a54d30ed5062fbc3a551a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777627213, "uuid": "4f224993-b92b-40fe-b363-cd1ab4915f3c", "value": "T1E51833A1A4694569C8B399326D53EF493DE88DC8911FAB19CF43FC3C0A017D2B07AD5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777627213, "uuid": "70a84238-f818-403c-8468-995aed4b4163", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777627213, "uuid": "273448b1-27d3-421d-b922-08ef7f886662", "value": "1572864:ni0BjjBk7u5Vd3p958Hr03KrcJN4mo/KBV9ggLwiUQxdvtPWVOCmW3HjRqYs:ni0BjD5Vd3nK43ecYmoCWdiUQxdF8X3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777627213, "uuid": "32d15a31-f6f2-4ceb-a787-c06301d579bf", "value": 93184490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777627213, "uuid": "b8a742e5-f892-4dd9-bdce-afbb7f0dd8ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777627213, "uuid": "187af547-67f7-41dc-a512-7abdd1060e14", "value": "FlClash-0.8.92-amd64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b110340-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777618659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618659, "uuid": "c754b6e3-7a8a-4b37-9520-e9d3f421f82b", "comment": "Malware payload (Gafgyt)", "value": "b36deddb25ea912f334931266b360d76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618659, "uuid": "c95dd879-a2ce-42e3-8df9-04025f532996", "comment": "Malware payload (Gafgyt)", "value": "b742f2838ac56dba929b76206dddae24f831ab3b2e276ff5245c668c36ea5acc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618659, "uuid": "6a6ec854-3ef3-4790-93f3-fe0770f6581b", "comment": "Malware payload (Gafgyt)", "value": "2145a5bccf4a66b28a1a304311a68ced8c309af6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618659, "uuid": "9f0aacfb-0d41-4242-bad1-1275dd24a76b", "comment": "Malware payload (Gafgyt)", "value": "74c515abced177a8a421513804e1b7e9ddc368e9564405bb926818769fd92ace6820a9b861d2e621ae2fc63ac80722a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618659, "uuid": "baec6859-2cda-4ee0-8d4c-5441b0f56f36", "value": "T11EA31A06F9008767C1C327B6F78F47493B2267B957DB33026A257EB42FC27991E2A950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618659, "uuid": "117e025a-9153-4de8-8717-192b3aecf76d", "value": "3072:KsPwVe1/5hpUZKaGU+L7yj0yrQ0Knm4XnTe:1Pv1/5hOZKNSj0yrQ0Knm4XnTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618659, "uuid": "f01a5dfd-8450-43c4-b04d-242f7a0e1f74", "value": 103742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618659, "uuid": "856e687f-afa7-43ad-a314-2f682dcc1550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618659, "uuid": "39f248ca-d958-40bb-8372-5b2474ae0140", "value": "hidakibest.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efde32c-458c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777660327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660327, "uuid": "0eeabbf4-973b-4a3e-ba1e-78b2bf7ae80c", "comment": "Malware payload", "value": "a109135159b83fadd59c26637d39118a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660327, "uuid": "af413ff7-0a76-4ba5-a084-950759922ddd", "comment": "Malware payload", "value": "b7d8c602e19344b7ed2cb6c13e3d4a8a2c3ec4d2106227e73cbe8916a3201f29", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660327, "uuid": "376fadc1-e1ba-49e4-a562-f1e55d00bc46", "comment": "Malware payload", "value": "53bc31c9f4781699e5ad84f76a7ddf066f206d77", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660327, "uuid": "e41bb055-d9db-4089-8868-204a62e10106", "comment": "Malware payload", "value": "d1b375f48d3ff83285f4347618a87ffb65499c4ac07a49d3c49d4fb44322a052bf48fc6f2e5b9427a7f5c0d576428919", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660327, "uuid": "6385d1c5-3ef1-4e4e-99d9-6ae8881aae27", "value": "T14FF0ACC2211005B03A684F0BD0C77284D16E2D139AC7BE3039CE7A508BAECAEF284674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660327, "uuid": "70f99c25-3f68-4252-90f2-a869266dcd49", "value": "12:j+AjNMZeT2qF2k4KYjKyI4FKydWs+X3s7DesCn/tiO4K84y3d7P:j+AGZcAKY+yIFydWs+X3sWTDy31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777660327, "uuid": "92d2cf99-783d-40aa-bb7d-aa71661554b9", "value": 642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777660327, "uuid": "229a63ec-7790-418d-8077-2d260bda532e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660327, "uuid": "3039a59a-170c-4367-885b-161d07b97287", "value": "kamru.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc50d2c-44f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777594481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594481, "uuid": "247e8b38-fd00-4f5b-a660-aec69489bee4", "comment": "Malware payload (Gafgyt)", "value": "3df8bc8e254412a950c9b03d61b9251c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594481, "uuid": "4acac6dc-c8b2-48df-af10-13e291d5ad64", "comment": "Malware payload (Gafgyt)", "value": "b87cc24259597812f24f86aa9afbddbf167338c6b92be3fbb6e1499cf9dc15f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594481, "uuid": "f9cacb9e-0855-45c9-93c1-bb237f9cec77", "comment": "Malware payload (Gafgyt)", "value": "832572e5cc3c7457d4602a79155f223140c4d6fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594481, "uuid": "cb238160-ea0a-4c29-a811-12661e2cd97c", "comment": "Malware payload (Gafgyt)", "value": "43c246973780d5901ae5f7814aace3bfe46179547d537dc2ca0a2589ee9b865d60f983b82df48e2e7e1e9cc49fce4599", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594481, "uuid": "7ae052ef-c582-4c13-93d3-9adb2436f4dd", "value": "T14FB30903770E0F83D1573DF02A7F2BF1979ABEE215A4A284651EBDC062718B32595ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594481, "uuid": "12748e16-6229-4f93-af9d-69648e862d66", "value": "3072:itIWYiaM5Gj8iOhrEZfODakSFG2wlu5h7pLg:iCWYmHrEZOdYG2B5h9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777594481, "uuid": "419b7cc3-35f6-4b87-bd94-11d62ee4a3d6", "value": 107848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777594481, "uuid": "20b0c8af-fc85-4001-97fc-7813e455d960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594481, "uuid": "ce99ef53-3d9b-4c45-837a-96ecbb42ee9a", "value": "FBI.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f0251f-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653098, "uuid": "c0a7ba8e-18af-4c04-a805-1666c7c740dd", "comment": "Malware payload (Mirai)", "value": "2e191414678fe8108806ef55174be433", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653098, "uuid": "8215ea59-8df7-4c05-8f9f-ada0b2dcb2b7", "comment": "Malware payload (Mirai)", "value": "b9c96cd37bebf4d74c8eaf212e0672e729eab1de5e04108f6c55af206ba37e20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653098, "uuid": "7a283660-2eac-4c9c-9964-32a1e88bdaa8", "comment": "Malware payload (Mirai)", "value": "5370419263b211d38c6e6d5212e8857a9262201c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653098, "uuid": "99088ccb-d9f0-4024-91c4-b0775cca6de5", "comment": "Malware payload (Mirai)", "value": "a53d6800e0fae0b3332dd1ee892d525babb62dc8bbe4e292789f8e405af07dbed18611004ea9cbdff28b206ac9d6f20f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653098, "uuid": "3408c872-9027-4874-8137-612382721139", "value": "T18E142A85F8C18E62C6C522BFFB5E528D371653A8D2EE31039D665B21338B49B0F3B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653098, "uuid": "7219dd5a-23f0-4c33-bd89-1fee3a5615a7", "value": "3072:PmC9wf2sAK00p5zDVK5tyYrWX62k3MzY7dT4jVKJ552f474DPVG4eZ2fnKG:PmCC+7K00pBDkHdWQAf47WPAJcfnKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653098, "uuid": "0338ff2a-4227-4ce6-8f35-28d04e55d1b0", "value": 202656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653098, "uuid": "38a439d6-4123-49b2-bc71-fefcba2cbd45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653098, "uuid": "27bc3591-53e5-49d4-9297-c10a287e85fa", "value": "vaxbot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223db9e3-450a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777604525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604525, "uuid": "b0c2093b-14a4-428f-8891-332b26289e7d", "comment": "Malware payload (Mirai)", "value": "e53f777ad1e5d5b58f87517d22d92f79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604525, "uuid": "12682b1c-52c3-492f-9df6-9e5d433ebe19", "comment": "Malware payload (Mirai)", "value": "ba8cc69f99e70b159f7ca236ea48591c83d1a07b25c0ead1cb074388b20b6e91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604525, "uuid": "afed3695-ac7d-487b-880a-cec5084fa8f0", "comment": "Malware payload (Mirai)", "value": "14ec6f4e8327308f5c982c9bd65dbdb00ff6e8ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604525, "uuid": "505560a0-4a23-4ec4-b746-68d0479244f2", "comment": "Malware payload (Mirai)", "value": "186ef97fc9db7263b8189e278358311697402df0120bccb63bee12abf3afd70eba841145eec1fbca25465441ec01fec6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604525, "uuid": "f1f32a34-91c4-4d1d-95a4-75e8f027e129", "value": "T1DF33199BB801AE7DF84BE77A94170E09B93073D412820B2363B7BDA3AC731556D16F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604525, "uuid": "88a7b4c3-26ac-4462-a6a6-612fc71b282e", "value": "1536:V4wCHZi0ReKBm78w86zXYV5WZT3D1LPJL:V4wwZi0ReK0oYnZDD9hL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777604525, "uuid": "d8c27b6d-10fc-49a0-8b82-253329729207", "value": 54696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777604525, "uuid": "b6987be5-a07a-4df9-92fb-a727c88f9ca6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604525, "uuid": "a1116389-cdb6-4025-a5d4-854cd4861a5a", "value": "botx.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1bed08-450e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777606605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777606605, "uuid": "f9c1f634-028e-46d5-a0a1-e73525ed2569", "comment": "Malware payload", "value": "a3e9fbcb6fde10e3a8e7558a2912706f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777606605, "uuid": "bd1e56f1-d02e-446b-88fe-e89f4ecc6f36", "comment": "Malware payload", "value": "bcb1b19afdfe3be5c51c895e9b0491770b6858ed0d3653603e84f5c150143dc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777606605, "uuid": "d0bd5d47-07ec-4c02-b751-d376fd8e13ef", "comment": "Malware payload", "value": "85e4957679d87261fb79d6dd73db395d4761e8bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777606605, "uuid": "5ff876d7-39bb-45a4-b18c-c86ec18f7650", "comment": "Malware payload", "value": "bd2e2416609f04372c145e590fab83501741c7b967af33f9180fe5891d5da86a345bc15c2ef14320394641d27a79a5c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777606605, "uuid": "ec7a9148-aca7-425e-974c-1bd9eab0857d", "value": "T184F50857E59550E4C0EED174C626A223BAA13C89073433E36FA1A7B11F76FE46ABC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777606605, "uuid": "14f610cc-cbee-4b29-8c71-831f1e97e22a", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQr:cqYUQuVDt0Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777606605, "uuid": "96bb07c8-675c-4f9f-9e7c-e4999955baa0", "value": 3506176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777606605, "uuid": "5377a831-b941-4423-a8e4-418e694f88f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777606605, "uuid": "a39eaaf1-82d4-46f2-87d9-edbe22bdf6d4", "value": "bcb1b19afdfe3be5c51c895e9b0491770b6858ed0d3653603e84f5c150143dc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc86af16-458e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777661504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661504, "uuid": "07146924-8440-47cf-b7c7-400552c79da3", "comment": "Malware payload", "value": "6f7f4a9b4f3b079142a450ab1b6fc995", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661504, "uuid": "feb9e86d-52ca-44b8-a847-a8b943bbe67a", "comment": "Malware payload", "value": "bcc38bbff20265768776d3fc05a9a798cd0db0ac32761de8733542f9e41344ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661504, "uuid": "a7c5d5e1-0066-454d-99c5-d72da059f54b", "comment": "Malware payload", "value": "963d1cb135d1edd9155c072170850f3b0517b929", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661504, "uuid": "50cee66c-a764-45ef-ae42-733a0a4b2b90", "comment": "Malware payload", "value": "8d7013b98f8a76e056e78bf277eae25c4f1bc051244056bf61d57688c21cd6bb6f2d9f461c0ab1035862e973c0a16445", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661504, "uuid": "50fab7e5-e262-4e5e-b289-80fcdfb7f423", "value": "T1C942D5C6BE85CA17C9C40236BF0E82CD7F35A349F2EB37036B172FA466479620E56049", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661504, "uuid": "444a1883-5522-4b63-b2cc-6c8f897ee069", "value": "192:CwwDxfOBMrlt5LF3UazB8GMTmcBD5SAldjYZCKkEZx4e3x1:CwUxTL5LFEaOlmi8XZCKFx4eB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777661504, "uuid": "b07ccb0e-54cb-4fb2-a81c-706f2c83991b", "value": 12480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777661504, "uuid": "529a632e-3001-49d9-badf-b69ed27b0bf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661504, "uuid": "430e5dd6-6815-4dff-a218-c4e3d61b28e5", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a247e24-4532-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777621664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621664, "uuid": "dd08be31-b1d1-4067-b853-5a2e8fd1255e", "comment": "Malware payload (Mirai)", "value": "748dbb0047408c8539b0761787793d51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621664, "uuid": "91fd9143-6cf0-460d-82a8-fd4922109a1b", "comment": "Malware payload (Mirai)", "value": "bd8202eeef4185bce215c1ffb32cde860c03d9302856704e74a04e70325e8fa8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621664, "uuid": "45e360d1-4f3d-446f-b1ca-e6d943ee005a", "comment": "Malware payload (Mirai)", "value": "2efd0d3e38c364a653b7e7b8bd3d4fccd5afa0ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621664, "uuid": "12abb76c-a710-46bf-ab35-8b7500124a08", "comment": "Malware payload (Mirai)", "value": "3a7c6b214c5cf235866a3b6dcadfd36b31c23ea469cff2a141e25d3ace0b9a0d6728e874527734b3c6fe410b34a67aaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777621664, "uuid": "a39fb463-ea17-4bf8-b6fe-42a8410c1814", "value": "T12FB30845FC518B16C6C651BBFF4E428D7B2A1758D3EE32039A256F30379799B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777621664, "uuid": "9aff123e-bc72-4228-a3df-f69e96efc165", "value": "1536:IcpWjRHLuZK0UEo7V48KVYWKQ4wfl1l2Awyw0WB++m/usw//sVOeDUM:IbjMZK0kS89QzgU1uTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777621664, "uuid": "441b999a-edca-4bf2-a6da-21b8458a9cc6", "value": 109188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777621664, "uuid": "6c140eb2-5389-401b-ab4c-b80e58588e36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777621664, "uuid": "844d239c-4a12-4c15-a4e9-e8369f18167c", "value": "rage.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab904548-458e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777661449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661449, "uuid": "3881c45b-4970-43ef-befa-1f88ce65f6ef", "comment": "Malware payload", "value": "414a53f9fa6ce5f894e2d705f591fd42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661449, "uuid": "b3ae48e2-2b63-4829-9feb-bb2a99978fdd", "comment": "Malware payload", "value": "be02c7dd1534cacffbdd8b693613182419a26ccd2b246f3cd164356af44d3425", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661449, "uuid": "d43339bf-b1f7-430f-bc08-5284b95d7480", "comment": "Malware payload", "value": "5485b55590efb6653b60be8aeae840aa8defac9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661449, "uuid": "f9c7af61-060a-445a-89fe-b7e342e32f20", "comment": "Malware payload", "value": "4f89ed6d1cc0d9790a0023aa15eb2ad7225eba41656cdeb3ce56aea99473c08230706c2255cf5bc2f82c265daec78c72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661449, "uuid": "bd210e49-9137-436d-92de-3547b9b70fb2", "value": "T1C302A0F59F4447AEF45A0B3216139BDF7E9A00A43D3D806F49490C84759E2F7F91E891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661449, "uuid": "1881ae7f-64dd-4183-aaa8-8a77cf4f627b", "value": "192:xE2+VM+bjSzVTvaRRS9JWvzdsd7Gc6dYLrOiwChXK7CpAcpW191Pox:B+VM+XSzdmRvudKc6dFiZha7CprpW19e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777661449, "uuid": "561bd1ba-0641-47c0-80cf-1e1a75c95a48", "value": 8764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777661449, "uuid": "52e9d67d-cbcd-44f9-9874-cffd8bf49b9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661449, "uuid": "88a75be6-1de4-4ec7-a29a-fbe748fb43c8", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2579814b-4579-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777652204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652204, "uuid": "afa1307f-978f-4a0c-8580-f932918d4649", "comment": "Malware payload (MassLogger)", "value": "6ede1e0c23f0cf525acab232d0e69b97", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652204, "uuid": "9c672245-da7c-408e-8000-fa4334bf593c", "comment": "Malware payload (MassLogger)", "value": "beb39889c5b7df8abff28001c204a7592751deb75af780d44a724b6afd6b4316", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652204, "uuid": "9fd98793-4daf-4c36-9d5b-509c36ef4e94", "comment": "Malware payload (MassLogger)", "value": "020e8599f60c2c907ccad0b62e0e9c8b1c7ab7b5", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652204, "uuid": "84091bbb-7a4f-4a78-b716-8fec149ea306", "comment": "Malware payload (MassLogger)", "value": "3646534f29acc6f66d980baca4354253e82f8e5da2898dab0ec12c883a25b30c0a23c5c3d5c3a782a2e6aa8d4351799d", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652204, "uuid": "fc9d7e51-8b0b-4068-8ee0-7a3dc5885944", "value": "T15F85CFCAD16E44D29C053FC9A8142BC78B2546728A7400283A7F7D498F7B5FEC15EEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652204, "uuid": "28898737-308e-4861-861b-f29a8001580a", "value": "24576:F5m6ekdu0ozq9m1LHyuQai+U1dYpS5I1YUe/5NeMpVS0CAU:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652204, "uuid": "8eef61bf-b551-41c7-8d93-34f4528a8f42", "value": 1714021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652204, "uuid": "b9654e4e-07c5-49a6-8e00-8a2f3b050414", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652204, "uuid": "5a835d4f-9dfe-4077-96c8-59261eaa902d", "value": "ps_q4NFiP18Z2BJ_1777613970036.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522e539e-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777635958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635958, "uuid": "d5954e04-4ec1-4c13-a972-458ca4298d9a", "comment": "Malware payload (Mirai)", "value": "df1b7bbc7aa719cdcf9aa5106a32cd22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635958, "uuid": "1c0abf8e-4cb9-45a7-a1f2-e4e961ece75b", "comment": "Malware payload (Mirai)", "value": "becf7c77ee305b1ce587a41b1d7d8d97397ae1ca65e4f433ba0a16c5b2a83015", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635958, "uuid": "92462f24-2b94-4feb-af6f-77e6b314e1cb", "comment": "Malware payload (Mirai)", "value": "c15596cde0a1bbd46495222da6c58d23c77ca40b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635958, "uuid": "d7490989-a3df-4283-8119-16e36b75664c", "comment": "Malware payload (Mirai)", "value": "3dc5e6a7a2b5cf41e3e27d1161c9f92c25ac85b5caa565ec67aff80be2bd0a5aa70caf07579db8827591c1a85c4b853f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635958, "uuid": "a1817234-9783-468d-af14-a217ddb8f65d", "value": "T173E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635958, "uuid": "c7e98eaa-a4a5-4de4-a119-37589e12d8a0", "value": "3072:4xjJw1Cc/0s6YAPwenUr48pzfR+Jon4y:4xlw1xAop0YfR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777635958, "uuid": "8c39f1ce-d934-45c0-a309-12008870fad8", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777635958, "uuid": "22b512aa-61f9-4782-8d7f-245302f58a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635958, "uuid": "83c40fd6-c7ce-4b91-b066-92c21265ea7f", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8b9681-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777635952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635952, "uuid": "4ca58b75-db5c-4e88-9895-05af2a963e66", "comment": "Malware payload (Mirai)", "value": "b76fc4b0ffa771ed4e89ad867f25b8aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635952, "uuid": "75736d55-2e19-47f2-b0e7-e3997a2adae8", "comment": "Malware payload (Mirai)", "value": "beff8e365d72a7774e9eb0ea161d56f01a139831fdc9528c78c90473e3654977", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635952, "uuid": "1af997d7-26fd-4164-966a-08b03683b8c2", "comment": "Malware payload (Mirai)", "value": "fc0cd825d8a5f82af985d97b5db829c885c3e735", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635952, "uuid": "e615dc01-de7d-4fd6-a4d1-7adc6dda9e9b", "comment": "Malware payload (Mirai)", "value": "284050f790231eac6c97e109fcd3aa62312820f344fb091ed989c5a3de520ce94f8b16b4bb1d3d75b16af05e8d73d83b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635952, "uuid": "0a585132-53b8-47ce-916d-b5024094c8f0", "value": "T1AFC30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635952, "uuid": "f1ddf8d0-36fd-4d11-a81a-884100c34ae1", "value": "3072:fTD7YhjFMX+maR8TcDeRqQV3tNQYciYTG1N:fTD76aX9aKTcRQVnoiYq1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777635952, "uuid": "d79e33b0-84b5-450d-8b27-3bfb10320c5d", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777635952, "uuid": "7682f591-4433-4851-a011-b61b2337bc3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635952, "uuid": "7175091e-3ddc-489e-a247-a9846ea3455b", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821f0164-4528-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777617570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617570, "uuid": "7dc6fa25-f612-4a0e-8694-6768a58fe2f9", "comment": "Malware payload (Mirai)", "value": "ae06640b8f15604a2c2a07b3c55ff808", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617570, "uuid": "01ed31f9-5272-4d2a-9a28-ed6a3faf6c7d", "comment": "Malware payload (Mirai)", "value": "c113751e9092eb0251f19022a17a0d3cb255cc318dc1564fd45906d17fb56932", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617570, "uuid": "baceeabe-c370-42a1-b1ca-2149cd4b563c", "comment": "Malware payload (Mirai)", "value": "35f657424c3225ab13ac437a4c4491b1787155ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617570, "uuid": "34013ca7-aa7d-4ddb-854e-10e421b7be6a", "comment": "Malware payload (Mirai)", "value": "a986a00af163ef53d352d4afb2993e29ec083a97373c10fb47c80f60f6220fdab3696188f0ed4c760b3157b42077518e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617570, "uuid": "24fb0b0d-bc6d-4e39-b508-77274e0bb5fc", "value": "T10423E15D118656FBDC6D847190D907B17EB80E67A022F94C8472E997CB078FA7063AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617570, "uuid": "bea222c7-8f2e-4273-af5e-dc4132d82333", "value": "768:Mewvkk7ZN/ys4pQBCkhdR3iJF5JrzVGyqbfNT9dYRCDSGtxVpf0qa3ZJgGlzDppU:ahzlBCMdR8/QJNhiADxtdULV8Yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617570, "uuid": "caa45d08-ac57-4485-a977-fec9b95275c1", "value": 47672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617570, "uuid": "c919e1f3-78ff-429f-be68-345b404b63b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617570, "uuid": "83f14e14-8293-4957-8dfe-6f6b5c1511a8", "value": "rage.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6d5fcb-457a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777652991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652991, "uuid": "1567d9d8-e173-44d3-89f5-112c9ac53128", "comment": "Malware payload (Mirai)", "value": "0195d39be773e5f1f3d514df80161da5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652991, "uuid": "ac528e16-135d-40de-a8b6-bcc37d3d625c", "comment": "Malware payload (Mirai)", "value": "c231d208182506506c67be71199d08fa88da0c3ea0ba426fa120c0b7c2770347", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652991, "uuid": "9d2a6baa-8e44-484c-9b5e-ce6086cae868", "comment": "Malware payload (Mirai)", "value": "3cd6847a76fd13555b28df04fd2b6084c2f21209", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652991, "uuid": "1f91a032-cf74-4afc-a453-f3615c09534e", "comment": "Malware payload (Mirai)", "value": "53d630deee8dbf78f52a3df597a21e7a1d13743a9eb9dea52dbcdb034a3d5dd6c7c25281513dac924d819761194c84b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652991, "uuid": "2ce0a137-7871-42dc-92f2-4386bb244631", "value": "T1DB73026D51461662FC5484F057B2AF197F909EAFB2A3DC1A828C0B5F9A87C0071E7CEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652991, "uuid": "0b9f7b53-cd39-459a-b01c-b021ca841603", "value": "1536:9fmwcCdy18XVuWa66qveNj5zHfuVNPl6HNxNdMQK82VJuu:NDkkoWawvAZUdovNdSRVQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652991, "uuid": "45a5646e-6845-4f88-a97b-50d4df633b75", "value": 78768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652991, "uuid": "9d9c1829-60ea-4d66-9fde-688ebb4a6ac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652991, "uuid": "9b494ec2-9981-4f97-9238-4a0f717c5476", "value": "vaxbot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aeb6a71-4587-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777658199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658199, "uuid": "69d0561a-be66-4b53-b255-ef62b9e2a940", "comment": "Malware payload", "value": "5f50fe14443f0379e94def463868b51c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658199, "uuid": "6d975f95-2b59-4918-8531-89fe1afe76fe", "comment": "Malware payload", "value": "c2b4b08a15ed80cc1ecb8a2e40dddcecf913704cc41fb42d066b74f25c25b490", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658199, "uuid": "ff9aa13b-3bb2-4d36-a6d9-6c65f1e3a841", "comment": "Malware payload", "value": "7556ee2fe658448362cd47a9b3282aa0b6637c51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777658199, "uuid": "e4942ef9-74dd-4fc9-a997-1f5e8c5cacbf", "comment": "Malware payload", "value": "bbd80650ed45eabc5dbfe6552f0e5d6fa40a41b4297341eb955677800421c7a36f97e745f5f55bf35b4bef491a2d6346", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658199, "uuid": "d931722f-de3c-4548-9e97-52d6a6aa858a", "value": "T1B2D1E743B68BCDF2D48A00784807773ED324AA4CB114DFABF748EAA1D9B368D1516397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658199, "uuid": "0a9814cc-cc93-454c-b5c4-24606a2464ed", "value": "192:fFhjtI5RfFfbLEbrVa/MX+v0EqmKyokedsYVQA:f76tzIbF+vomW/dMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777658199, "uuid": "1365ca59-354d-490c-a95f-067a024f83e9", "value": 6540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777658199, "uuid": "fd54c9a9-265e-4156-abbd-233d862a36f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777658199, "uuid": "8b5dc2df-3b18-4773-b835-0d1206afe71f", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f226a1-459d-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777668021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668021, "uuid": "544c9b13-953b-422d-89ed-ee6dde2160c8", "comment": "Malware payload (Smoke Loader)", "value": "8791ed1224d7f34f3194870c4b89f463", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668021, "uuid": "95528678-6937-4228-8ee7-014d66ffaf81", "comment": "Malware payload (Smoke Loader)", "value": "c2ff4567d5c9b07e006cc6dac9f53b4d59a481d97d69176433c4b92fc396d0c3", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668021, "uuid": "a38a5214-f4e3-4e6d-b6f6-c5b75927eb2c", "comment": "Malware payload (Smoke Loader)", "value": "23dfffe3f8458fc84065b9657c5297b01356dc2f", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668021, "uuid": "75f31438-e4ff-4431-9bbb-6fb71ceeb6cd", "comment": "Malware payload (Smoke Loader)", "value": "4095b2847b2e898c38ba088a0b69e9037d5691e6af9befd16c568118023af1ef3e7c5a715f9bbbf666c4f4afbd7b76ac", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777668021, "uuid": "1cdd4317-8c56-4868-a9d8-196f78b0bcb9", "value": "T1FAF4F7EF7B6474C1D9666EFCD8D56D0197B0B8D07A90819F1286EB2FCC68A038F1D621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777668021, "uuid": "52181c7f-bcf3-4c3b-b4bb-08f0819f23bc", "value": "12288:Bg+/OcbZLWniMsrLwe/IFqvFVDHJsfSxEvP:BgNaZaLsr0e/F7V3Kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777668021, "uuid": "032614ab-8edf-47d6-92d5-2e9279a7d6d1", "value": 755928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777668021, "uuid": "0b1fc1e5-2373-4a25-aaa3-96c5498fd904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777668021, "uuid": "174d0ad0-5f73-4359-9038-877e9fdef13c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c9fd1d-459e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777668264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668264, "uuid": "69c7f8c2-dff8-4da6-b06e-d02cdbd16d01", "comment": "Malware payload", "value": "bfce494604114440c12fa6d177d32e04", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668264, "uuid": "048efb71-a732-4208-9c86-fbc2e82a56f6", "comment": "Malware payload", "value": "c3320971eee2022f51e8496b5daae69946526cbf8478434bdcc74af81c1699e0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668264, "uuid": "a89dc781-9754-4298-aa71-6eb54dc54315", "comment": "Malware payload", "value": "013c9e0edc671b72270e48df59e28ace90a6e330", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777668264, "uuid": "39875f5b-9b9e-484d-b64d-f4235a827fe7", "comment": "Malware payload", "value": "b48c53e150d7697989482d0414aeb50810c61d769d9578b1dbd6eb751bebd6adc4fe7987fc928c84c4031651f7dad12d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777668264, "uuid": "5b6f917f-a309-4a0b-bb7c-4c357ccb1c0a", "value": "T193F2AF4BBA019236C5470B754A1FE7E48F7ADC2C9FA7205334D6B34C1E7299066B6AE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777668264, "uuid": "79e80fce-7f34-4f31-88fd-a7d007c76642", "value": "768:wYTpJ6JXgATGvj66OL2rQbs68beWMbC1tN/nq:rpkJXamP9bTEobR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777668264, "uuid": "d6d02aa7-a16a-4450-8a72-c2bd105a85cb", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777668264, "uuid": "677e4f34-a82b-4301-9087-e57ea5b76302", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777668264, "uuid": "a8102f1c-6157-4e93-ac44-271e9551fbce", "value": "disk2vhd.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484507b6-4534-11f1-a769-42010a9c0008", "comment": "Malware payload (Moobot)", "timestamp": 1777622627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777622627, "uuid": "7dc3c920-548a-41a5-8a88-3645fded1d49", "comment": "Malware payload (Moobot)", "value": "99a5f204900c78f0cb772fd67f678b1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777622627, "uuid": "79348335-861b-4692-bc8b-896fe52cca83", "comment": "Malware payload (Moobot)", "value": "c36414aa888266c01b8f1773883c6b66808371d87877e637a23039dceb154389", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777622627, "uuid": "10a1eb28-ba31-450f-90e8-4e2108d7daa3", "comment": "Malware payload (Moobot)", "value": "c3cb7653b624a2f6989af1a3633318bc2c783772", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777622627, "uuid": "950adc20-9078-4d7f-8169-aa365d110f0c", "comment": "Malware payload (Moobot)", "value": "c146f3da4332587de76493e648f1ee07faac4069b08bb5a6f6fb4345f504bf28b8168720a5810ffbd1e8031d44d4e3ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777622627, "uuid": "6f91e09a-a3d2-438b-aa34-e652ac0bda96", "value": "T19933FA85BD829916CAD84377FA1E42CD331173C8E2ED7223DD257F51B6CA52B0EAB061", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777622627, "uuid": "971041a6-c555-4f8c-95db-d514d1d80ea9", "value": "1536:unMyIwJNhjLxWuAwjOstfpsUi9BwbZnD:NyIwJHLxjpastSxBwbZnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777622627, "uuid": "2ac62b20-30bd-4009-8938-a529fc1ca6c9", "value": 51608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777622627, "uuid": "2430f282-912e-4567-aaf6-5452f293c637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777622627, "uuid": "545ab863-897b-4949-8832-b4e2fdea6ed8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c75565-452a-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777618523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618523, "uuid": "47a4088b-1f68-48d1-9296-3d6c7ce2b09e", "comment": "Malware payload (RustyStealer)", "value": "44d6c0b4a4fcaf2d14e7ab6d921cd90f", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618523, "uuid": "0cb80b6a-1fd1-425a-ad32-d246a0f35b39", "comment": "Malware payload (RustyStealer)", "value": "c4514295bc3de02eb83a228ed3ccf8ed52345d16ec349228b9694f372c45a9c9", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618523, "uuid": "15158cd2-35b0-4e19-8aff-c9df0dd35903", "comment": "Malware payload (RustyStealer)", "value": "a22c01da6c724e2df1dd33efbab92330a9e3a652", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618523, "uuid": "0415cfab-9eac-4623-9a5d-72955f69cf4f", "comment": "Malware payload (RustyStealer)", "value": "b81d5116c8f4ae0c0c278383fd3c95ee45d9ea80135c6a15f3823c835e79c0f5278ceda319086011f2d67cf72496a8a0", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618523, "uuid": "9008d7fd-da94-47e8-bf17-18ddad2edcfa", "value": "T1A9168C03FA9581E9C0AEC178C71A9233EB72F88E4621B79B17D44B212F53B606F5D359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618523, "uuid": "18aaa3c1-508a-4de8-a5be-fe53f9702436", "value": "43e070dc437576b7bde81008825a6200", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618523, "uuid": "dd3cef6c-6a4f-4fa4-be4c-981dafc41176", "value": "49152:tmMERya8ush4xPnwee12NezMH2TmJdX1hF6SvwuW+pdyMERhUUBBX3wmaXNPThGE:tfEPjNz6c0zWNIoUfFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618523, "uuid": "e21c4550-9be6-4974-8596-85c5c24fd97e", "value": 4310528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618523, "uuid": "f23a2f9c-0331-47fc-bc5c-892f4e7247a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618523, "uuid": "4802c042-f791-48c4-a611-531b95f3fb5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55150997-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777635963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635963, "uuid": "0cbb2a37-3d2a-44b7-906c-4094a9859878", "comment": "Malware payload (Mirai)", "value": "e45b3f4aecefab1baba3beb0ed067b2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635963, "uuid": "6033b321-509e-41be-b1e2-58363204f7c9", "comment": "Malware payload (Mirai)", "value": "c7408052b5f611befa35550f257f9e404021231e073ed5aa3211779543aaf89e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635963, "uuid": "954f7a08-f222-4d09-b5e5-7f0fe967cc41", "comment": "Malware payload (Mirai)", "value": "8fd7b8d19f344599c36ee7fa651627fb34d6c798", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635963, "uuid": "1e6c386b-915b-4973-bf96-2c1c2d00618b", "comment": "Malware payload (Mirai)", "value": "672a2e3cd316332c00759f69c64fdda6506ea028d13ae3b4b3ba7db26912708f3c4ca56bdf3aa171d4c8aab8bcba2500", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635963, "uuid": "a6f371de-22bd-40fd-9220-8b7a567deb08", "value": "T1EDA328A3CC762F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635963, "uuid": "9cc1c8f0-20f1-4073-b49c-2507d9ca469a", "value": "1536:7HufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAi:abU2RC4kPCtSzWu3/3L1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777635963, "uuid": "2fd6d64a-12f2-4413-ac36-a5b1ef92fa51", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777635963, "uuid": "5273441f-e277-4379-ad3f-91bea48fc780", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635963, "uuid": "34e66fe5-707d-4f86-9082-2dadb007814b", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4eeb665-4595-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777664525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664525, "uuid": "ccc646b7-aa66-4641-a50d-4eee2dfe6ece", "comment": "Malware payload", "value": "2fa84025af48b21d3640f2cd9cefd808", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664525, "uuid": "0d26d4e9-757e-4620-940f-ed2fa964d11c", "comment": "Malware payload", "value": "c8c2aa824c8e13ab01585eaa841005544979716170e23cfb173768d7f7d63f71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664525, "uuid": "e1be407b-585e-4110-8a66-6c877270ccc7", "comment": "Malware payload", "value": "01e0e3882b688d1b09fc18c23c497b9ff1a044c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664525, "uuid": "10952b2f-4327-446e-8c8a-b46af20fe0d0", "comment": "Malware payload", "value": "84b8ea28d4fe1ab72c3e2186ffb37e2f86d20a2d6fd8d7c027dd282b8c3b94a5015b9ccf2a29136465bd348dba9d4707", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664525, "uuid": "938586d7-e473-408c-903a-6a2469aca491", "value": "T1E7D2D093A1ADF7B5C82BC13206675DD4FA73E872561407BBCE9E35ED1C275042D23641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664525, "uuid": "50ebe734-aaa8-4807-9a53-2cb56627a051", "value": "768:YX7OUEIx7v5wKWlXGZUb4Wx2TKsU32v9sPH7m:YuIxElXGZOwKDmFuHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777664525, "uuid": "51e980e5-22ba-42d4-a5cd-dd29ea321995", "value": 30392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777664525, "uuid": "d958cf1f-6e45-40ca-9534-455beb326c8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664525, "uuid": "c6c69257-f84c-4c44-aa67-baf5920ff2a2", "value": "X", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a79ffd-4582-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1777656129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656129, "uuid": "bd7fc31b-d8b5-4337-aabd-e19a6cc58cd6", "comment": "Malware payload (Amadey)", "value": "5405262637a880e08d24a10393ab364e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656129, "uuid": "b62032a4-62ba-452b-89eb-8026b1f67ccd", "comment": "Malware payload (Amadey)", "value": "c8d16955d6e7dec1cc0effb4e8b0d8cdfe53e8f47ed740ee0b0b186f7cc76406", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656129, "uuid": "3ffc4750-762d-47ab-bb77-d3137bd44419", "comment": "Malware payload (Amadey)", "value": "2b07c3132e2e130a430ce6960d9b9d8820b68c09", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777656129, "uuid": "5195e220-adb0-4356-97c8-66295c594348", "comment": "Malware payload (Amadey)", "value": "cb1f7edd942dd04ab8491ed45e2de0b30cb44eb5d16459f3bc32b2d746655aef3c0e050c3a8e77f8897fb9dbad7d78eb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656129, "uuid": "cd203bda-ca51-4373-a9fd-f77a3d8f8335", "value": "T18D5633509F52E6C07FA19C6BBB725CFDE181F1952A2A8C62E3347A393527F06CB60174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656129, "uuid": "8e92939c-0582-445e-b50b-a329ebde8ffb", "value": "98304:QkOMqBJHGH/FO9cwHu40FQOk2n4mC9e7W4zPzMAYG/uI1LwxnN2K9DEBZV/Ue:5LtFO9cwHu4Z04krz3F/uIknk75/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777656129, "uuid": "c092ab29-8485-4a06-968b-345dabdc22f1", "value": 6074249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777656129, "uuid": "629b7c59-6acd-4956-a240-0025e5541284", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777656129, "uuid": "722ce495-3890-4b11-a35c-62adf8cdcb5b", "value": "Intimacao_251751.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc7ec39-4549-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777631950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631950, "uuid": "39613ea7-40ff-43be-8a25-093d2477cd76", "comment": "Malware payload (Phorpiex)", "value": "a22edb2a522cb7c8acf79352f5f690ba", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631950, "uuid": "1c0580b7-e341-4fdf-baff-b59356868e90", "comment": "Malware payload (Phorpiex)", "value": "c9552f76e07a5167a84967646e80f0faeee8ca773c16ab7207c356cfb6c5950c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631950, "uuid": "41f3f80d-2d78-4466-828a-0523b42d3181", "comment": "Malware payload (Phorpiex)", "value": "054439b08154bfab9cc6e251f7899822ed504aed", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631950, "uuid": "cf575b28-fbf5-403a-932e-2a5581d097c1", "comment": "Malware payload (Phorpiex)", "value": "5ddef560219451f0cb4dc158f095d3f020a36c3b63607128537e275f6ae8ebac095f8f6985b363967f565fa361b88a54", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631950, "uuid": "71b8c1a0-39c5-40ef-bdc3-44d9e7c9a60b", "value": "T1DA823B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631950, "uuid": "a3cc460c-1696-42a0-82cd-db8b8f12c16e", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631950, "uuid": "3b12bdaa-b0a4-41e1-a985-d3f422d383a4", "value": "384:0I78VGQic1Kwvw077u9NHu/gBhav8U9cR:FAE0769Zha0U+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777631950, "uuid": "89a36274-d5fc-4cf5-904c-8eb0e933718f", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777631950, "uuid": "bb635a36-c073-4a63-b6b7-2c07a6e811b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631950, "uuid": "d618c202-88b5-4f74-8142-c00c2363f71f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363e1cb2-4561-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777641924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641924, "uuid": "cc46ff83-94a5-43a9-8532-1e7ed4f75ec0", "comment": "Malware payload (RemcosRAT)", "value": "79518fad7cdfc8c3a26b84891cd9eb72", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641924, "uuid": "b2c053a5-966a-46a3-ae31-7fee09941174", "comment": "Malware payload (RemcosRAT)", "value": "c95db68bcc8311a645fed26520a93b8e98d5dbfb69aa06f6c6d57d18b9df0384", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641924, "uuid": "ee3b2905-5826-49ba-8b9d-cfb105304c72", "comment": "Malware payload (RemcosRAT)", "value": "c3c602b6e46474f48b012f5b940c30037280fda9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641924, "uuid": "182d8e4e-c4e4-4c5f-9f9b-6d4697c31b5f", "comment": "Malware payload (RemcosRAT)", "value": "506088b5781edf8cf75ff11a840574ac14c0a372e528a1025cced1e4032dbe294a87a94460133bf640ccd81fc9ebb17e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641924, "uuid": "ec5d83f0-917b-42ad-ab14-d3d9a894000f", "value": "T101A4AF02B6C2C0B2E57E18340425D775CEFCBD21187D9D7BA3EA1D6BFD70140A639AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641924, "uuid": "95407b17-36a2-45b9-94a8-3cff4eebaeb3", "value": "36a8f09a2ba830fc08b8b6bba7c9d4c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641924, "uuid": "427f44e6-9abf-4a8b-9fb1-d163f76391fb", "value": "12288:uLFP5PZRGDW1pSvKe4jeosl65Vj+sPZP6:KpZRJ1pyK+l6TjtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777641924, "uuid": "c97acbe8-82b9-4af7-a794-5e6480f0eaa5", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777641924, "uuid": "e2ec3889-dd98-47f7-a3a0-769c17aca315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641924, "uuid": "a20c7a67-21a6-4f00-bdf5-bbba62fca1ea", "value": "c95db68bcc8311a645fed26520a93b8e98d5dbfb69aa0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5f55db-4595-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777664515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664515, "uuid": "12037ff5-d5c0-4313-b545-5cc95e52d9f3", "comment": "Malware payload", "value": "acb72baf0e25a461ffd0b465520840b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664515, "uuid": "c0985dd2-eafc-4033-a10d-5dc8c85a4a7e", "comment": "Malware payload", "value": "ca7200c628ac101dfd0879c7783c45f074dad71d942abe7b78b96bb3b0b32d3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664515, "uuid": "6f78353a-db1d-42d2-9c26-02c2480a3a75", "comment": "Malware payload", "value": "b07d74e8e59c80e05b0c4baf776ed7d4f738c018", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664515, "uuid": "d923f859-ab0f-4051-b1db-58d7bedb0921", "comment": "Malware payload", "value": "5bce0c2dd9cb299be166544d35c07acf73756a11a70de02c809e5e3c30743e610c6202daf89f89cab07179506fed7d82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664515, "uuid": "e1d83c6a-6830-4690-af46-80552dc2950b", "value": "T1DED2D0528583C88EC1AE5A367DDBBC161900630ED645DBF7DFDCB5336EA3F081A96281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664515, "uuid": "02fc8c01-325c-4338-966f-fc516ada9a72", "value": "768:wArN0XOanUUTv4LydHUJYQCcM1Yxua+0nbcuyD7Uryq6:TaUUTvUydUCIx/nouy8mq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777664515, "uuid": "233c82d9-e06d-424a-83e3-7138a629ecb9", "value": 28308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777664515, "uuid": "d7a7744f-93c8-413e-b558-a7ea281f6f73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664515, "uuid": "846ab484-ad82-458d-958f-b6367767851a", "value": "I5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7cbeeb-4521-11f1-a769-42010a9c0008", "comment": "Malware payload (Moobot)", "timestamp": 1777614506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777614506, "uuid": "03a82e33-7a41-4e64-ad65-c28970dc1826", "comment": "Malware payload (Moobot)", "value": "64db645790886a0d8ab764929f0a174e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777614506, "uuid": "ef062e83-9d25-4ab1-bf3a-a21ffa9b58ca", "comment": "Malware payload (Moobot)", "value": "caee0da41c8a9efa938ecc7bef5a8bf1add1d72f2bbb0598da637b8a9a2af5d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777614506, "uuid": "d95ff400-10b0-469c-ace1-73d331bcdd02", "comment": "Malware payload (Moobot)", "value": "1aae85efad0bc9f416781d7501c6c6fe3554562c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777614506, "uuid": "c175a748-2eb6-4799-8369-3a2cce4d6e65", "comment": "Malware payload (Moobot)", "value": "55fea4eeee5b8989e170b4dc8c8882e216f7b4aa6cc0c3a86c8e9e936f4951013730d327d2a9299e644c7323d8200814", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777614506, "uuid": "c0d9e6c0-b799-46da-b906-1c901d930cf8", "value": "T16063510ABF611EF7F86FCD3706E52B49308C641A21A83F757974E918FA4A10B54E38B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777614506, "uuid": "f45bb88a-afa4-4a06-b5ae-2fbea34206d2", "value": "1536:k986lZoTAtqVNdfWVNufYuI0Kck6n2MFKwbZn:k9jETAt8NVWhulKV6nUwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777614506, "uuid": "ed90aeb7-3a4e-4606-8001-e211b610f9ad", "value": 71480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777614506, "uuid": "ee90f060-b929-45b6-a1e3-0ad0d0746ef2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777614506, "uuid": "7c5bd8f8-bc65-4492-87cb-91e87095dc6d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43d3fcf-4595-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777664523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664523, "uuid": "d5ce6842-7426-4a18-8641-6b9ed9f6faec", "comment": "Malware payload (Mirai)", "value": "6eacebbb9d021cc1f533e4a9168f1aea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664523, "uuid": "14793c44-abbe-47e8-8021-b5964980d85a", "comment": "Malware payload (Mirai)", "value": "cb1726f0e394a07393312975aa7ba1214613a0816b6682f116bf3511be87aca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664523, "uuid": "f38b4c1b-0c10-4dd3-9ef3-abd305b96dc5", "comment": "Malware payload (Mirai)", "value": "6dc4a05144abbb87ccd5bb4cf6cba04be11486b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664523, "uuid": "f2427579-1296-4e3a-a51e-6af2e1236adb", "comment": "Malware payload (Mirai)", "value": "4f2c4039136c6cadfb58c6f9eb012820702449071e03f037444c34698789b152ed7cdd1eeef8d45757ce2ec904e5b6fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664523, "uuid": "cab2a929-a486-44c5-bd10-2f9af52c616c", "value": "T18CE2F2F8A043CF7AC8F42EF0EE580512368F76B497BE70E462DA4AC554F274A95B5C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664523, "uuid": "b75d40a9-c438-47ab-9c7d-62f5c7c48885", "value": "768:NR1IzmSlaxgOXR3CKPhoqV8Nt3e2WbYjM1IzPdpq3U72:f1U/l1AyG6quNtu2G1I32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777664523, "uuid": "381366fa-a6e0-4009-94c3-2e51a0d1c896", "value": 33944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777664523, "uuid": "b64691aa-1e36-4484-bf3b-19b088fa3e0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664523, "uuid": "0986448f-7b99-4a73-8f75-b261cc1f45e1", "value": "AV6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79887874-456c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777646762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777646762, "uuid": "20b363c8-adb7-4e5d-ae99-148216607a9f", "comment": "Malware payload", "value": "4863fc2f5d67bdaaa7b9707141be7945", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777646762, "uuid": "6d34f1e3-f60d-4dd0-a4f5-34f6cba037c9", "comment": "Malware payload", "value": "cc86ef9fed6d4554e4837dab0135765c64db8fe0508028370d402876f9b32373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777646762, "uuid": "c61d8b8f-beb0-49e3-9389-a4d9d9afeff0", "comment": "Malware payload", "value": "89a1161616235e31211f8c05921feba1eb070aaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777646762, "uuid": "0c862eb9-802c-4d1e-adce-7d7ddd7c9f32", "comment": "Malware payload", "value": "5778be9b74c0f710238e4cf4f182225f7fc3f2a446136ee45072e84c25655cb3a3d9eb89d4ba98c2466640b978f147a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777646762, "uuid": "b77bb1f9-4f49-4dd0-9c38-98b95067a15e", "value": "T1D2F7338CDAF2A83DDC9DC57FB22129280E7D5AC29850437EEE1DBBED48A017567253C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777646762, "uuid": "a6b21236-82d2-4925-84d2-604b57871c70", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777646762, "uuid": "c55e6ea1-0d9c-4066-884a-c268ff5b1b2a", "value": "1572864:RejOS3H814EjWPfOny/tmy5DV8bxuNJ1B/4L1ht3YcIPTvgU7:RIdEyOnyLYxuNN/O3GcIrB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777646762, "uuid": "a5da92f5-d64b-4b25-a99a-e9d28f26e02f", "value": 75167372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777646762, "uuid": "7580c2f6-c7ba-49fb-ae2e-671fb0ef2aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777646762, "uuid": "5e837ff0-787d-44d4-84b6-3280385d14e3", "value": "java-7byA72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60188336-4524-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777615795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777615795, "uuid": "4d541162-fd54-4ca9-ab49-5bee069aef51", "comment": "Malware payload (Mirai)", "value": "2c7f2363b4fd73f6a996a0bc2169a7c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777615795, "uuid": "51aeb77e-bc33-4428-8da6-12fdb13cd2c1", "comment": "Malware payload (Mirai)", "value": "cdacc1a832a1bbaa89480792152a908afd036836d4d0256ac1bbb7f3491ebb8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777615795, "uuid": "624bdb05-f7a7-463a-a95e-64fd0cd78af0", "comment": "Malware payload (Mirai)", "value": "c6c78e628b97f80b96496a2ee34d20d675e40f6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777615795, "uuid": "07041247-9344-4458-a321-38bb27311cb5", "comment": "Malware payload (Mirai)", "value": "aa61f194f9a1f628774299e71d13ebe8ec12cd41b5fa723f304879e30d2a1603b219cb9bfd592683d88c796de73156e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777615795, "uuid": "0418b186-b149-4b80-9c31-b27aaf3dd7ba", "value": "T18B333A13258089FCC40982B183BFA22BF572F57E4134F68D6BA87E27FD5AD310A594D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777615795, "uuid": "58209c2e-6011-4fc6-b54b-7e0f14d20940", "value": "1536:Yx13k3aR9FNlEq2C/7a0xxMd97cleTBn:YD3uaRjN2qbz9xxC97cleTBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777615795, "uuid": "8471c52e-1b87-419c-8471-a18f312f78dd", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777615795, "uuid": "68a891fb-a49b-4b0e-9a94-684f51e8df89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777615795, "uuid": "b135b0f6-2cca-454f-ae63-ca17092caf38", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d740e7-4530-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777621179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621179, "uuid": "85fe67ca-9c18-4f4c-aa48-de3fea3b84d0", "comment": "Malware payload (Mirai)", "value": "54b8c132b43cfe95df2a88c24d38608a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621179, "uuid": "82818698-ac7d-4b3e-87eb-3b9d32aa86d1", "comment": "Malware payload (Mirai)", "value": "cdca20a33f34b443cf3a82465aab69fb81a5de1dc543f6f6ef2ddff0bf32f648", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621179, "uuid": "79067658-303e-4239-b32f-d9c46734fa7f", "comment": "Malware payload (Mirai)", "value": "a82cb809d4102b520f5e022f38b75f51e25de10c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621179, "uuid": "0d2e9946-d1cb-49d3-8b3c-3bae9abc9310", "comment": "Malware payload (Mirai)", "value": "fd2c4fe30d86573d847452fdb2e659e4af841fe1390c1ddf81efdae63d9604dd82b9c1792ee19aaa4c74c8ae13fc1f4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777621179, "uuid": "04c5c243-6b9c-4826-bf92-c1114d90982e", "value": "T1B813019860DB4A73D2AD2FA6BC644D0737A4AF8A36D5EDA013135F7C4D07635C40AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777621179, "uuid": "38971f88-6686-4ff5-a31b-a288aa3ac7df", "value": "768:YDcQa9DeEcPRv/VdArANi2Oo5ESXxRQnYj2dbO82zQNO+fb4uVcqgw0t4v:YmA68NLOo5ESXxRQdE86QN5fb4u+qgwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777621179, "uuid": "d4d6a8ef-47dc-421a-8515-ff0695f68ace", "value": 45072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777621179, "uuid": "91833ef6-511e-40a7-ba3f-af3fb9ecaecd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777621179, "uuid": "6dae9e1b-66d0-4560-8948-8a6c4a260e2a", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adb1691-4528-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1777617451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617451, "uuid": "e7f33655-bfc8-4c94-98d2-a64597d57d14", "comment": "Malware payload (DDoSAgent)", "value": "690d85927238b0a5ab70acab83976490", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617451, "uuid": "1d9047b2-3aef-4ef7-93f3-355b3f127831", "comment": "Malware payload (DDoSAgent)", "value": "d04776523b483d79b5cf38577e335dfc81de73d4ae13bef4af972a19b92fdca7", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617451, "uuid": "00d4e8a8-64a1-41f2-821b-6e02b400c04d", "comment": "Malware payload (DDoSAgent)", "value": "a3e9b96a11c467346578f816fc72bf061493e045", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617451, "uuid": "e4bd38b6-b692-4298-8c58-bf0a2d9da70b", "comment": "Malware payload (DDoSAgent)", "value": "2e79866e79fc06d98e13a7fccfce771da72f832ac1b07b7533d8591861f937c812e3f40441e91b58e74a002f86f73aca", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617451, "uuid": "553d5696-d0d3-436c-8cfd-46d43e374933", "value": "T12C730995FD429B52C6C251BBFB5E438C772B4368E3EA32039E259F2037CB55A0E2B145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617451, "uuid": "60df016b-2259-4582-89fc-7a884b3a3039", "value": "1536:Vb8hY6l0biruoG7OeRaaLYjdldQ9dZwd+J6vAJa:Vb8hv0blogSraRu55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617451, "uuid": "90b98316-83ce-46dc-aaa0-aa26fb795377", "value": 75568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617451, "uuid": "1b57044e-a13c-4e41-8a5d-14d2b4b1e8a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617451, "uuid": "05c071ab-ab7d-473f-9af7-a728acdd1b45", "value": "boatnet.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7984a8fc-452a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618415, "uuid": "a76cac17-5d44-4fba-a290-66a8239e7234", "comment": "Malware payload (Mirai)", "value": "afdc834f8616da469444bbf7d0e27143", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618415, "uuid": "7a10586c-fe34-4cb5-940e-cb85f0b1ed9e", "comment": "Malware payload (Mirai)", "value": "d07d4cda6d4ea409660f7ceb5712e9eecc254a3ca9cd4710a3520e38677cc6cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618415, "uuid": "9cb12591-7ec6-41fb-883f-2197b7afa9cd", "comment": "Malware payload (Mirai)", "value": "125349d68d88c3380a867be279dfd8df5d4b02f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618415, "uuid": "1fcfde51-6ba7-4940-9003-596051e6ab77", "comment": "Malware payload (Mirai)", "value": "ae387035ca50f3376ed71f3377b98aed028dc87508fbee12a1e979a5d5324a93407dca0a16a90f24519a5bc35d3b96ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618415, "uuid": "fe6d72a2-562c-44a7-a203-20c4eca5adff", "value": "T144E3B61A9F910EBBDC6FDD3702B90A0239CD915722A43B793674D528F54E90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618415, "uuid": "84c948bf-2d2e-4779-b6c8-ff1a1bcb8824", "value": "1536:/+fp7KJQ8h7+C6dsm8x77RuCzZ39ZICSYPackRg4T+PcCn2cZqeK9abO3iCXM26X:sp7f8gzy9vi7+PJ2oKM8iUOc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618415, "uuid": "6872ec5b-d0e3-4b21-81d3-b631e312b35e", "value": 148756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618415, "uuid": "44b36bd7-902f-44a9-9a88-f884d10067b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618415, "uuid": "328cf911-2cdb-4549-bc70-20f55a476992", "value": "rage.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4612fd7-450f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777606917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777606917, "uuid": "6d1417a4-e677-4dd5-9df6-03e019d82b55", "comment": "Malware payload (AsyncRAT)", "value": "03e0fd12e79cfa32b65bdddb5f98d718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777606917, "uuid": "66e00aeb-2004-49fc-b73b-46feeaa1c55b", "comment": "Malware payload (AsyncRAT)", "value": "d1cf9ee0fcb77ea118936a0a1fc1c159be7f37413bc060823632f8fb67349f31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777606917, "uuid": "06f063b7-185c-4620-832c-18382bcc97d2", "comment": "Malware payload (AsyncRAT)", "value": "b25ee7c211266370f46ce46a28c08e384453b23a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777606917, "uuid": "e292e2b8-9e90-4b00-a1e4-881949c16281", "comment": "Malware payload (AsyncRAT)", "value": "8927c277123893d6d3190102de63e33d7d1e68dc456d771f1334a7cb701bd775ca9f71607be9dc673a6e5598664bdbf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777606917, "uuid": "ee6c986c-7605-455f-9306-5f4752feedbf", "value": "T103F633301BD61384EF2D0D711F1CDAE4ED2E712C9ABEDDEE96E382E4CD960D06651A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777606917, "uuid": "d4022267-ff26-417d-9d5d-247638d0a25a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777606917, "uuid": "75bcc9ba-ff7e-42e1-9927-48dfefeb6c34", "value": "393216:VWPUO62PwJ1zO83wH6VhrHejs09QAQ9IcisOyiyLis1crjz:V26YAY8gH6ujGAQ9Ici1tK+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777606917, "uuid": "b140e398-cf8f-49a3-b9fe-de87178aa92c", "value": 16520704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777606917, "uuid": "1856c915-9334-46a6-8dcb-00ba515ab847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777606917, "uuid": "4ab2970b-c83b-4bd7-b092-c9e2e7eeef9c", "value": "XWorm7.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37de1617-4522-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777614869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777614869, "uuid": "c8798b75-76ae-4f52-a634-d39a49794e86", "comment": "Malware payload", "value": "06aa77c6952b366176478c6873319a89", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777614869, "uuid": "ace28285-c0e9-4e8f-8438-f3312392f4ae", "comment": "Malware payload", "value": "d203fa4cdaede7cc398fe62da32386bafa11c7f84f7d74211f822036b0658c2b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777614869, "uuid": "37c8ba2d-7a64-4378-a1ae-202b130d32cd", "comment": "Malware payload", "value": "48bf7e5d2108814a3b9da6762309f6a258fab6f7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777614869, "uuid": "d555fe11-97b0-474c-ae65-567594f59374", "comment": "Malware payload", "value": "ab5d1fc6a60521505150f3206781de947e7ea26e27ea4cd8fc10162b3d62499476130e759855811d77901d0aea210ded", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777614869, "uuid": "ca6baecb-2da6-4080-9747-3c62eda8e32c", "value": "T151136D6566913C24AE9998371D7E1F0CBDAA83E23104A1DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777614869, "uuid": "374a7dae-cefd-4a30-a6c1-1208e599c56d", "value": "768:bcsXRWNGxVZ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bzlxgcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777614869, "uuid": "f8fcc55f-cfca-4f6a-89f2-47099172b8bf", "value": 45441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777614869, "uuid": "2e9ab688-e6c8-423f-9199-fc8a31c097a6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777614869, "uuid": "860e6440-eeff-4786-84ae-f388211c2b05", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717be425-458c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777660492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660492, "uuid": "2dd2ea79-ba0e-489b-be56-0b07ba9f1228", "comment": "Malware payload (Mirai)", "value": "98a6f2fc17fede73d62352090b10dcbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660492, "uuid": "c5f4eef3-c510-43a9-864f-717291d0d3da", "comment": "Malware payload (Mirai)", "value": "d26fdb99bcff2c518add5662fec4fee1d7e929f26d477763e66b6f0777271b2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660492, "uuid": "470aadfb-0716-4782-a138-940041059bbc", "comment": "Malware payload (Mirai)", "value": "acfbbb23d94f392c3b21f6454668d53a2f0d07eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660492, "uuid": "bae53c8a-1d04-4db4-a467-ffa6ef3d120f", "comment": "Malware payload (Mirai)", "value": "9abd470970c0b26ce021eddde50bfb60d226e856ed279d03e28919c35cfed3ae5c137d21da0cf3c40881fd541aa6a5bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660492, "uuid": "ed9af53b-7845-4d79-bbf9-2c8d690ba978", "value": "T1C773122B519F0AB3C0F99D3370077B30AA75B053E9F53B09FC51908AA91DDB66184B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660492, "uuid": "d56e8a9d-a5b6-442a-b486-0e4b5b414377", "value": "1536:EOlDJ9nqHLw+ZQeuFvQfPbYGiNw7VI/rW0wvnEJ3gzE94e/ohmkE9ora:Ppn40+ZsvaTYbeO/VwP/zE99/ohNE9Sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777660492, "uuid": "c0c2c559-5765-422f-a46c-1ab06e752fef", "value": 74740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777660492, "uuid": "4b136b06-5e00-46d3-ba52-2e402d504a44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660492, "uuid": "db736ef9-108b-4342-97cf-7b7bc416b63d", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f3079e-458b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777660154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660154, "uuid": "86c090a4-5c3e-40e1-90f3-281668e6fe4a", "comment": "Malware payload", "value": "927148ce14b4b82a88440973bf36daf8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660154, "uuid": "509ea138-9588-4cd7-8ddb-3ee15105fb3c", "comment": "Malware payload", "value": "d3eab9371170de687b81f192cefdfbadaf114cc60ec4611654f4d0577876abac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660154, "uuid": "d57baeff-06ef-4b6f-830d-8fff478061d3", "comment": "Malware payload", "value": "5d519571f5c5b1eb4c9bef70975485e3697eaaed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660154, "uuid": "da21b249-d6bf-4971-8ad9-f4ff1249f6ad", "comment": "Malware payload", "value": "cad5d6074b7fbb980e79ee87f20bc9d209824791c4dd83d64070d1afc58607a5735a1add46219df3e50e62b9668d2854", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660154, "uuid": "a2043078-0a8f-42e8-9344-eac1db64dcdc", "value": "T17D413059892182218D33275A2327B60CCFDA13432B10D781B54FC700BF64788DD68AFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660154, "uuid": "7e615c04-775a-4f07-81f7-a4c98b2281c3", "value": "24:p+jRrpXheSe9ldvyR6vhgbrpGZu8tMBVGib/nzkebAnAGH3/OsB34zTKvaICYILN:+EJ9TvPWZQoRwLH3/5BUTKvolWJg6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777660154, "uuid": "ef4b6d7c-e628-4ad5-8a48-0c14d042f14a", "value": 2155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777660154, "uuid": "3def1298-34f2-4359-823e-6651c43b3d2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660154, "uuid": "91927194-e28e-4cd2-885a-0a694477d308", "value": "Docpac.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37cf68f-4595-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777664522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664522, "uuid": "d61fdb51-1008-4e50-aab8-d59290aee4c2", "comment": "Malware payload", "value": "45548c929f831b993272e8cf4377a150", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664522, "uuid": "0260db1e-19f1-4e24-a7ac-62faf13bbd38", "comment": "Malware payload", "value": "d41c909c18296a27ad713e25378cd077aa9d79fdf52dad1b320c5693709d92f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664522, "uuid": "a6e17b75-b50b-45b2-81d4-957821f48b04", "comment": "Malware payload", "value": "48996eb8f3cacebba800946684106e26b09ad96a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664522, "uuid": "6df41f4a-e347-4e83-a917-fa68b5b22fed", "comment": "Malware payload", "value": "e28cdb388ec3794d58ba3171f38cacc55d2f3d473cd0e7715a2eb122965d380184a842973ddfa81befbccfbdf2ad5b91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664522, "uuid": "fc753107-e3f8-4fa2-91ae-3733caaff18a", "value": "T11DE2CF6DF0943E6CC9EC5D38818C17E19E80F8E1758A539C0705ECDDA7AAC0E679E4B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664522, "uuid": "ec7a35ca-5b76-4876-b42d-d89ee2d437f9", "value": "768:pWPSnLAm8rrLK6sDoVFs97rfQN4vUWR/1Z6:pWPGUrrLKpDQSNrYN0Z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777664522, "uuid": "bb5ef296-267a-4220-b2e6-82b49f1da8bb", "value": 31940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777664522, "uuid": "217ccc12-5cd5-4282-a77f-f5f59a89b127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664522, "uuid": "98fb1749-0a62-4a91-9b0e-712217d456eb", "value": "MS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b59fd2-450f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777606926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777606926, "uuid": "477b9779-7782-4bff-a6f0-508384d1e054", "comment": "Malware payload (AsyncRAT)", "value": "71b25741db55771dcea876fcbbc60375", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777606926, "uuid": "27d1e54c-079d-44fe-8b31-bdf3d0b77484", "comment": "Malware payload (AsyncRAT)", "value": "d426ff3cacac38c0a23664f28ce79a070bb331e3c04921bf98653bff6c8b96ef", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777606926, "uuid": "c6cf5c2b-49a2-49cd-b18c-fb736d058d6d", "comment": "Malware payload (AsyncRAT)", "value": "77e3336895a9de7902e5e704942996579041c2b7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777606926, "uuid": "d1720e73-96d9-47af-be43-23d21a011db2", "comment": "Malware payload (AsyncRAT)", "value": "182093cdb043a9347fac6b9e287fb9c45574dba4a8ad8f6e57c1e975213887432fc3241f93e350f4de93e66997aaa9d2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777606926, "uuid": "2b135fae-9d0d-41b7-8130-c2da91a0c1f6", "value": "T11BD3BE1CB7E68019E1FE6FB149F272578E3BF2635412A66F18D541DB1B23A89CE006F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777606926, "uuid": "e1831b2d-fb35-43cd-969f-99d1ed9e3dc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777606926, "uuid": "1edfc242-f49b-4b05-8a78-723140ddfd32", "value": "3072:1PXnhRh6ZQMRkbGiP3q/ioOGwtCnyFGJDfZz7IweYpEF+:1ZEpqb5a/ir+JbZtHOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777606926, "uuid": "8b2b2a20-37ea-4c53-951f-40845466ef8a", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777606926, "uuid": "dcfd44eb-ddfb-435b-b68c-54b2b202b746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777606926, "uuid": "d58a6359-8bd2-4c65-9ce7-820c9f6020d8", "value": "XWorm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c45b161-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777635948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635948, "uuid": "556f61ba-b608-432f-b38b-e404b1dcc6d6", "comment": "Malware payload (Mirai)", "value": "f2833f48eb202ad791269bcc0a86940c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635948, "uuid": "15e5a9c1-2e29-4323-a403-924594474c48", "comment": "Malware payload (Mirai)", "value": "d460a573d303fd80e57b28aadcc22e61d8b609d5427144a02d3ba237407771e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635948, "uuid": "57e612e0-431f-4474-8826-885f1e98ff24", "comment": "Malware payload (Mirai)", "value": "3940d6189729faaae8896fb3ec140d8e063fbd68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635948, "uuid": "e2f75129-ce91-4405-a85a-9de5a81e97b1", "comment": "Malware payload (Mirai)", "value": "442342ab5b5724cd10e32f4f79607879145e10970bafb335ea5dc2975bb9fd8ed50c5ed99aad08e5b307c5fa0c5d0bce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635948, "uuid": "e0b99cda-52ee-4c86-aead-d388ddb0b078", "value": "T1ECC32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635948, "uuid": "4ff6b3ce-9761-48db-af12-0a1446d649a3", "value": "1536:66B72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dMJ:6YB4exMF7oZKJnCNYaGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777635948, "uuid": "38216377-ab7c-4d63-be57-1185c6f099d5", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777635948, "uuid": "bc8258fd-1cac-4575-967c-170af4bcfc7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635948, "uuid": "a16bb321-aed5-4b04-8c7b-95e9ede77786", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16924f5-4595-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777664519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664519, "uuid": "075355f1-b450-4c9e-b0f3-4ccad88739f7", "comment": "Malware payload", "value": "2f806234d3169442d41b04cd76a548dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664519, "uuid": "ce57c002-8ee6-4e3b-a7f6-5b07d3d0fac9", "comment": "Malware payload", "value": "d6aab46ddb2d1d469bd43e9593c00f1d06c8f9acd8793ee3d92e4004491e015b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664519, "uuid": "10460c72-7e3e-4fcd-8ae6-b39ffb7d58f0", "comment": "Malware payload", "value": "f66ceeeb56e15ff06cbcf2fca2de6a28871fff66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664519, "uuid": "6c4a1072-e8df-45c2-bbe4-c3b9764e97fc", "comment": "Malware payload", "value": "6f7d958d3b60ad15c7cdb6af7164b7e65fee55b2e3c3ecd20972f2e4ebe51134a1c4bf7d1db5a549c2ec0ed8852d7550", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664519, "uuid": "0d282716-a362-4d2d-a8ef-8f6b561e92d8", "value": "T172E2E11C274208F2C467C8BA92AE8352CEB247D5D91295C27950EAAECF068B1BD435ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664519, "uuid": "119d1e75-a11f-4111-8095-8d5eca0188cb", "value": "768:uXwHxAiSIOIkbSuibrNiV7WXtzbynLl27KxRxaJgGlzDpxYs7s1x:uAHyiSBIDNbr+sdALU7KKVrYas1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777664519, "uuid": "dc0a142e-2e3a-4bfa-9f5f-fce72d2cb5a7", "value": 31572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777664519, "uuid": "a03ba260-5722-4f2a-91d8-e560a22427fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664519, "uuid": "ac876fb2-7bbc-4408-9f90-10a5b8b2e0ad", "value": "M", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77687c8-452f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777620666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620666, "uuid": "e5f696c9-d7b6-4563-8ca0-7652ced900e5", "comment": "Malware payload (Mirai)", "value": "fc1d321c528b52b7e0ceef7e61f60ee8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620666, "uuid": "f3e7562b-4ecf-4828-9b07-2d01feb7cd78", "comment": "Malware payload (Mirai)", "value": "d8fd72b819efa504ca1681a7634b90844e78f578aef1695efd66c8e89955cdd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620666, "uuid": "6139fec5-296e-4a61-a7d3-4bb20b84203c", "comment": "Malware payload (Mirai)", "value": "ff92020a6d47fa35e4a50b1456bb2c5c31bb3e3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620666, "uuid": "85231000-7603-4066-bb05-c6740679052d", "comment": "Malware payload (Mirai)", "value": "cbb456ab5e82064d1feba208a6cf175143bb7d842f62e401b93b91fd84f3baf7da1650e7e42352a7effcce422a9f8dda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777620666, "uuid": "b3dacd2f-e1ac-4de9-8f46-4ad0496e59ff", "value": "T15BD329077981CABFC497D1F44BEBD5269932FC2E493571896794BEA20F49EE02E0D720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777620666, "uuid": "7164c331-1611-42f6-a345-ac05e4fceeb1", "value": "1536:FUwjCq3K1wMCD79t9aVBTvpVcJwrsgTkTW5F9BCe5roW8p3rRuq:FUHqa1pgtoBTpVcJpgTwWBB1oW4dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777620666, "uuid": "5c5bf9e6-50ca-45cd-b86f-abd731776944", "value": 131176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777620666, "uuid": "b0e46d3c-e214-48f1-b2a2-6023223e9cd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777620666, "uuid": "f524648b-12e5-4d4c-b45e-660ab80acae9", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e71088-4542-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777628776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777628776, "uuid": "5e85ea99-457c-4b66-9bca-2456de45f409", "comment": "Malware payload (RustyStealer)", "value": "7bc3dcb338996743aa3d718d045fd1f6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777628776, "uuid": "f54c951e-0747-4720-b8ff-061aa58bef13", "comment": "Malware payload (RustyStealer)", "value": "da0e5dd9cd520704cc1ef7b197ee0f89603eea77e2b8aa4683522829bbfc6d3a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777628776, "uuid": "d3cd458b-6467-4edf-a1f2-f9eeec3ee940", "comment": "Malware payload (RustyStealer)", "value": "805c03dfd083f3ba5fa1bc9e342d4c178c3d5e94", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777628776, "uuid": "1c422a79-feb5-4c24-9b8b-9aff060d49cc", "comment": "Malware payload (RustyStealer)", "value": "73fd4486dd3a682ffe5c94f0605c0f488df6f29d78920aa73e97053a18e651be60bff853666e32ef8a448cf7665323bc", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777628776, "uuid": "485c0156-fee7-40a1-8911-251d73233592", "value": "T18C173397E8D8D51290019769BB798FEE9080EEDD68270B5D5A435BD3BEB1D802FEC304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777628776, "uuid": "8ad5dd3f-0822-4d8c-8d88-50c0bc532f52", "value": "393216:/6GIjbGqgYoSMrYnLET5srnJOo+torq2O/vOQtJKunv8xclW:/FabPgYorELET+LQnor4/tzKunv8xcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777628776, "uuid": "f4e2b2ab-0d44-47a9-978e-5c2a677e54e0", "value": 18644548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777628776, "uuid": "d5e41898-1763-438c-b810-d893e772a97f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777628776, "uuid": "1e49b287-f6d0-41e0-a750-acd45ba20bc6", "value": "Loader.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb1c079-4533-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777622182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777622182, "uuid": "34cc31d7-4d40-496c-accc-b3fa77909d34", "comment": "Malware payload (Vidar)", "value": "e35c171d2cc8dd09ef71885502821398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777622182, "uuid": "04254737-9838-4e1d-9838-98ca9ece1259", "comment": "Malware payload (Vidar)", "value": "da2b961b8513fac0b238014377f3e30709990b3b3ed7a3e829756ec429ef1727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777622182, "uuid": "c8576d51-fa34-4588-8af4-0444bcf4c4fa", "comment": "Malware payload (Vidar)", "value": "d6858b00b9aeab65f64ea772cd673dab3f1f8468", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777622182, "uuid": "beae4527-675d-43ca-b6db-72cc7c26802a", "comment": "Malware payload (Vidar)", "value": "ea881c527fce332b8f41b34147f1db54ffd894da8054e25da4bf81f589eb624efe03deaf248e8d215953d066c05e3df0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777622182, "uuid": "53d786b3-a917-4277-864e-bd480cdeff64", "value": "T1DEC57C523990407CD6D5B63285E1B191B730B45C1B346BD32B52ABBA3E3B7D01A327EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777622182, "uuid": "3651f673-0b86-4340-9fa6-4fbe5766daf2", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777622182, "uuid": "b8844625-4b64-4304-a16b-d8737db2ad37", "value": "49152:tZkSinX/I80tCgPF0yaAJpARs9h1HUWfIRAk/jNwFVzpb6iMaa+eIB9SVCF9CPMg:gI80ggPF0VAJpARs9h1HUWfIRAk/jNwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777622182, "uuid": "e0b60bab-a46a-4909-8837-2abe79837937", "value": 2606760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777622182, "uuid": "db5f4321-4264-4093-998b-18168fff50c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777622182, "uuid": "f3452e59-18c9-4025-bd39-8cd8e1191c92", "value": "Home_Story_Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408c0c84-4527-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777617031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617031, "uuid": "a75e396c-2cc3-4800-b121-2da261ea7338", "comment": "Malware payload (Mirai)", "value": "19027442d1ca3fd50cc03eddbbcd7149", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617031, "uuid": "57acb82f-c22b-44f5-aa00-101bc1fbe987", "comment": "Malware payload (Mirai)", "value": "da7dab34862e3d139ef3479ffc8de4e06daa76a6adb2086976db239590265fe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617031, "uuid": "3063753f-fee5-4166-accc-14288b2b4b6c", "comment": "Malware payload (Mirai)", "value": "4c88a6d753cb2e6c48834b22b9d274b308cdfee7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617031, "uuid": "7b85c4c2-6c1b-4e78-aa6e-59eb301fed58", "comment": "Malware payload (Mirai)", "value": "10d328cc492b23840715eb376e9f31f11d5a2cfa420e0d012219f327f5aa13f21cf25beb9e4bd5c7ed1ccccc62108ef7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617031, "uuid": "04d78757-ccfc-4fa8-89ef-119c97fd0c55", "value": "T1B623F2A79375BB7FFC6204BC2898F335306199869EC91C508A11D6A8EF79B900CFC746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617031, "uuid": "d959452e-92e8-4d55-8699-3376b661e085", "value": "1536:5Xm0CTK3KmycoomflBoEDBx7d8aJ9+6p1:hm0tqHPf1VVd1Jhp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617031, "uuid": "f0ebdb81-0c2b-4791-9269-935ccf4f25e0", "value": 49220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617031, "uuid": "21acff84-7c26-40e0-848e-c9ec20cfadc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617031, "uuid": "528d211c-e83a-4955-aad4-8f674d871baa", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5426968-4544-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777629682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629682, "uuid": "6deb7580-05b0-4d6d-8884-a3d475c6ee16", "comment": "Malware payload", "value": "cbe64d671120fc9189ac493aacbc5f1f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629682, "uuid": "e071151c-19f7-46c9-918d-52ec89fa8a66", "comment": "Malware payload", "value": "da9cc597d6473e31d7e3f4d5e2198509010164b48be96e97b87b788655146631", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629682, "uuid": "f793b6f1-04d5-4ee9-8cdd-af6248b54ce5", "comment": "Malware payload", "value": "b994abaa4a5bfa861000cd10fdc27e6298930fb4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629682, "uuid": "3cec5706-7e8a-4110-8931-fe84160dd4a3", "comment": "Malware payload", "value": "7c715cac7f56a08714724928b45c0654f4041500432282115f476cd1081211e3fd1fcce243081f7c8b09b0f3de3296f4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629682, "uuid": "6dd346fc-3c69-4d03-946a-ef8fbbd81c96", "value": "T1B1546C27E68169FDD1B180305BCB43B27174F0785731766FABD19A353AE2EC05B286E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629682, "uuid": "e85a2dac-a650-498a-a746-220415ef5234", "value": "6144:msVePCdeDMAB2vMv/SggUA68IJHbFjLXwR:msVeqIIMvKR5IJHh3Xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777629682, "uuid": "ce2f6441-b812-44e2-8c54-45708d069c30", "value": 297288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777629682, "uuid": "b3a292d3-86d0-4c9f-82ec-8b4fdac4afd2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629682, "uuid": "3b0f4c99-7b98-42a2-81bb-264c1ff39960", "value": "da9cc597d6473e31d7e3f4d5e2198509010164b48be96e97b87b788655146631.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e01f543-450a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777604518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604518, "uuid": "4fb394e1-8bee-438d-8bfe-eddf1e58658d", "comment": "Malware payload (Mirai)", "value": "31439b51da26d5d5071bff815430a02f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604518, "uuid": "19f4efc3-6f58-4956-a228-d59cfde8edc8", "comment": "Malware payload (Mirai)", "value": "dc65afeb652432a561d6390f74e66b9c8a80ec71e508806d938897a5f6a61f3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604518, "uuid": "22c5b981-aea0-4944-a01f-b3f135755c9e", "comment": "Malware payload (Mirai)", "value": "57990fa22641099ab5389cab02383cb6cb427a56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604518, "uuid": "05ce2f4a-b899-475f-a116-3b1f6504427e", "comment": "Malware payload (Mirai)", "value": "3d2591f315a0e2ddbfad152bd7cd5fcf572098e43d00c91ce593e841c916b00f2be3ddcc772a38dc0bbfdb5ac2926edb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604518, "uuid": "3821b350-289c-4254-9f31-78d41f71d8aa", "value": "T1CE338DB1E06A5D90D1520A78B578DF352F23E6C4E2533DFA465082E24447AADFA0EFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604518, "uuid": "7167d502-50d3-4c0c-b0b1-a8230de35b9d", "value": "1536:naJ3FZkBzsdFq9tmAuZSmYjxdCkTb+10muRV:n+3jUs68AxmYjxdpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777604518, "uuid": "87debaec-ad78-417f-af39-f04284c3025b", "value": 51588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777604518, "uuid": "54eb5bed-32db-4281-a6da-4011e883d6a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604518, "uuid": "027d1c57-1362-4205-94e5-f3d45e71628f", "value": "botx.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a55f47-44f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777594488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594488, "uuid": "aff83a71-b6ed-4a3c-9344-7e7bae03ba92", "comment": "Malware payload (Gafgyt)", "value": "b7042012d7877b7ab74b99089c39aa97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594488, "uuid": "b1de560c-dd19-4486-b090-ff2675fd63e5", "comment": "Malware payload (Gafgyt)", "value": "dcb7220b66e1c7737a0407177e77dba1cb999527d10968af400efb3a07f1206f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594488, "uuid": "fa1ebd01-ef17-4508-b2e1-759f7ca72dac", "comment": "Malware payload (Gafgyt)", "value": "01aa9d506dcc3c3d1bb6e0e7be8ed05eb529353e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594488, "uuid": "368e0217-25a6-43d1-8a10-28af1aebcfa3", "comment": "Malware payload (Gafgyt)", "value": "8d63cf592b13145c29158033b92187cebe76bce1bda0f0ffc4fceb251b783e5552ae8ad084d33c268f29da4dbf9ed971", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594488, "uuid": "d8597408-5ee4-444a-90ef-b3e68f6cd22b", "value": "T156B30997F801DEBBF40BA67600A708157130BBF60E931672B2667997EE761D12833F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594488, "uuid": "12594746-8db6-400f-8122-c7bafd838c67", "value": "3072:8JcZoUl+fZV8yTd0+kU9ZjFILNOxsJ3MZC91:qcS86wyTq+kU9hgnJ3f91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777594488, "uuid": "7d8dfa97-38d9-45f1-beba-e4240de75b5e", "value": 114596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777594488, "uuid": "5641e0aa-4176-47c8-b651-96142ece2ff7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594488, "uuid": "7aa9b18a-44fd-4fd8-81e5-93631cbe7e85", "value": "FBI.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06efa95-44f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777594482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594482, "uuid": "55331869-a5ac-4da2-b1f0-e31ace3a7db2", "comment": "Malware payload (Gafgyt)", "value": "7ccadec0a84a865577bc45be2c99d8a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594482, "uuid": "8d30fc6e-5143-4b30-aee6-4a3b67087b54", "comment": "Malware payload (Gafgyt)", "value": "dce3098e476c38eca61cd82c982e2f1710412b53c4188e5870d4d8fef16abfe8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594482, "uuid": "0972b69c-5757-4be0-b714-9e5ce8618a97", "comment": "Malware payload (Gafgyt)", "value": "d99fe50e666b8218ed6f22d0366bd993a80db249", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594482, "uuid": "3380ef40-69af-4297-a91a-436b1c9cb5bc", "comment": "Malware payload (Gafgyt)", "value": "41ad6bbe5636b3e0d95a5ffddba86c3abfb5fd1fdb4cb52b812c8eb1df14d65ef7f06c71f9808a2f6d45477be6a3e8d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594482, "uuid": "cd7b86a0-e15a-4161-9c44-4a576a8af213", "value": "T1BE931A9BFA42CEB3C41310F112AA9F219D71F9FB4823D642E3646DB4DE154C25A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594482, "uuid": "93e9b214-ae84-4b20-878a-a67ac7c511f2", "value": "1536:Wi+k82vF4l2qbZckmjWGw57fobEOQryVwCiUH1FVLx8rbrbUkmyukJ33xZTe0gw7:WildFY2qbhpRfobEOLVBiUH1FVLx8rbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777594482, "uuid": "60ed15f1-7453-47c0-a2c3-f6e4cc71a477", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777594482, "uuid": "86d3a45c-07e9-4869-83a9-201a03578232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594482, "uuid": "f5d98875-3001-4a82-9aee-efe416d97314", "value": "FBI.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4188c54-4549-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777631935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631935, "uuid": "823cc28b-fd79-4990-bdb3-c19609f92706", "comment": "Malware payload (Phorpiex)", "value": "245eb6c9cabd5a35d53b62ac89ab1bc6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631935, "uuid": "488371f4-c677-49bf-88bd-afe320e9519a", "comment": "Malware payload (Phorpiex)", "value": "dce7419779966068b2a0ac63aaf43534cfef9d9a31e5b96e0975524ac5b0d8d7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631935, "uuid": "c141d930-8bae-4cc5-b735-336e4d01178e", "comment": "Malware payload (Phorpiex)", "value": "7e10bc5dd48b4aed20ae2705c826c82d9595fa1d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777631935, "uuid": "7f030866-32e7-4fea-acf9-bbfa36f64268", "comment": "Malware payload (Phorpiex)", "value": "f7f9e0f3896184a2e7e9567e80b4d2856a513d04c810910debb45ee6ffe8da2bee8b41d4ea462e90b5fef50ae58d75fa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631935, "uuid": "4c37ee34-1c40-45ec-8fab-ea01eb4dff79", "value": "T172823B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631935, "uuid": "9c5b709e-93ec-483f-8f03-454dfec6c397", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631935, "uuid": "4785220c-3afe-40ec-a908-b27386bb5573", "value": "384:oI78VGQic1Kwzw077u9NHu/gBhav8U9cE:5Ao0769Zha0Uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777631935, "uuid": "5753241d-e649-4c00-9fcc-f7c1f47bbac6", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777631935, "uuid": "edabdd4c-50f3-44b6-9bce-10ad95369d8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777631935, "uuid": "9f72bd46-3ed6-443a-80b0-caf93fa20432", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a51bc75-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653071, "uuid": "8e4a4ee5-7a8e-4211-b474-b964ceab2471", "comment": "Malware payload (Mirai)", "value": "3751a72b1d1820bfe47879daeed8b657", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653071, "uuid": "91d35d5e-03ff-4636-95ec-fc071bada970", "comment": "Malware payload (Mirai)", "value": "dd6e15fcd86a1ef8715cbdf6680b1ab541549917e992a24f9ca2f2a569457775", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653071, "uuid": "659c6bb5-7e2d-4da1-a443-ac616e05a978", "comment": "Malware payload (Mirai)", "value": "9c4e13d3d42803eb6d03a1632562a33bd5ce6792", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653071, "uuid": "36fbc9ad-e98c-419b-b7ec-74947c371407", "comment": "Malware payload (Mirai)", "value": "c9d76cd04620c1c2cf44fd3a177e813cda649239a20e1278a7f34644e28a5639d97ceb2ad396ffe3a2f5e95603113cb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653071, "uuid": "f933c8fe-2db9-470f-876d-7f78b8419f79", "value": "T136E35BC4E68FD4F5D8021175217BBF268A32FC3A113EDA87D3A99661AC93681D80B75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653071, "uuid": "84243fd8-cc68-4df9-8281-77536c83c4c3", "value": "3072:wPOEV3zhvFrptEnmIpIhD58h+Ctmb16zYGUA9F9:WOExzhvpsg8h+b6Y72F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653071, "uuid": "f914bca9-9a70-4f93-924e-5948622c640c", "value": 155372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653071, "uuid": "d42ab75b-e8c8-477c-a5df-f01e47ba840f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653071, "uuid": "c7a0cf82-5c09-4abc-89a2-bbfef903771a", "value": "vaxbot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff253a7-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777635955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635955, "uuid": "4f11a533-65a3-4001-ab3b-25d131a57dd5", "comment": "Malware payload (Mirai)", "value": "31f4e9a79c0189c4306a63fc5a1ad678", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635955, "uuid": "ec3775ac-8580-4c6a-87be-3dd5c2731f22", "comment": "Malware payload (Mirai)", "value": "dd9632725e81b851b0fc50e3d819ab542f1463a94001f0590650eab5f6c2e89b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635955, "uuid": "9e60dd0d-478d-4d8c-a3af-85e081a9e609", "comment": "Malware payload (Mirai)", "value": "7587d2e95a516302549bacdbb077eb679038145d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635955, "uuid": "99b977e3-459c-4054-a292-0abfb4a9602b", "comment": "Malware payload (Mirai)", "value": "527a84d35eaddf56250074e25e33e5b3dcee5421b5588bf58872c290cdb8e824a7f4964da731ce572fa8212d586d5e8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635955, "uuid": "934044f3-7850-404b-aec5-4bb49ef5b69e", "value": "T120B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635955, "uuid": "7b0539f7-7251-413a-8ea8-85bb8e06d820", "value": "1536:BUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45Zv1:KixnUHz4Z+5ypkn3E81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777635955, "uuid": "6faedcc7-5808-4c06-b17d-ff650af2e4c5", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777635955, "uuid": "a5d7ecb5-8331-4794-9ca1-2524b78e8a65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635955, "uuid": "39ed0650-4630-47d3-9318-92145f7cbae1", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac84bf5c-452e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777620219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620219, "uuid": "8e6db080-0f38-4936-ac6e-d55437cb7129", "comment": "Malware payload", "value": "9a9899d26ee79f0594d872f526f4db50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620219, "uuid": "f7f79ee7-b17e-40b1-94c7-e0b252520552", "comment": "Malware payload", "value": "deb867070ccffa614469df4ba5972426a4a23162152c7f3ee8579d6934b776e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620219, "uuid": "3c8c7056-19c6-440c-bba9-f30f65963df8", "comment": "Malware payload", "value": "ade593d79c97de5e2f83e09b8d0dd784c3b0864f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777620219, "uuid": "c70fa773-a77a-42dd-b759-80dd7beace13", "comment": "Malware payload", "value": "1f14e70ba0cb17ef15575b36be60ca7c5e08654b2ee5f3d20ed56d1c321a470f343e7efd5ce8f201bd5e5334aca77578", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777620219, "uuid": "b1d7fe7e-3921-439f-b678-33a169b258e5", "value": "T1F8B30845FC508B17C6C655BBFF4E428D7B2A1758E3EE72039A256F30378B95A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777620219, "uuid": "9e8d9428-cff8-40b7-bc7d-e5988d61b545", "value": "1536:McR4tjRbbqRlcUVrs7dnULlxApA0KHD5qlSwwywJU2H2fIEWHL9OvJYfvgqO6:MHjkRlcdZnbt6EmbgqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777620219, "uuid": "907a1e03-c9cd-418d-bb04-697583fa1339", "value": 109540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777620219, "uuid": "b352ae60-03a5-4e22-881f-47b97c91219b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777620219, "uuid": "7542370e-2307-4ec6-b55c-ede2d3d64b6f", "value": "rage.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef739f20-4561-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1777642235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777642235, "uuid": "baedc233-91ec-41ec-bfb4-23654caaacd6", "comment": "Malware payload (Joker)", "value": "ba73273c93ac9d8a3f8e05605b42640c", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777642235, "uuid": "d1a46190-5fd6-478a-a6fd-038695bf1d8a", "comment": "Malware payload (Joker)", "value": "dfa3d8a7eade9284adb09bdb6282b086353f1079612f6c2f571512d5c9a16da9", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777642235, "uuid": "b0a6d083-84c5-4a43-a661-d185e73080d9", "comment": "Malware payload (Joker)", "value": "3edefa681f46d43ed84527e1b862ff3ec5404413", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777642235, "uuid": "39108fa8-ed78-4aed-a4ef-eac7a64a9264", "comment": "Malware payload (Joker)", "value": "3123e23297b7de6969f3012adb54a502e00de6d2c81287375a4b4c9332d6690319581d59b440656a0f119f1276c919ce", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777642235, "uuid": "24154068-d468-4de8-a0a6-cb86f8996ac1", "value": "T177870149FA0CD927DDE6B0BC8D8B13A3B5267C551B10C2872821921DFEA37E49F15BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777642235, "uuid": "8713340e-4a96-4405-9432-fc476657b3b5", "value": "786432:k5XI0bxLq+VCOEfz825wObaM/8z1M2EOJcFv4d:040Fu+MmKaM/8zmTOmWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777642235, "uuid": "8a626b3f-0cf6-4789-a9b4-e7a78d3d8b9c", "value": 36781767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777642235, "uuid": "8a1c1547-596f-4ca0-afa8-bbe9aa402ad8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777642235, "uuid": "189e9da3-20c5-4c3c-bac6-6f8fd22340b2", "value": "Text+Chat+Messages_2.1.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d1156d-4580-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777655211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777655211, "uuid": "248eaac7-fdb2-4fef-b6af-59f2b2ad8fdd", "comment": "Malware payload", "value": "5dc87724c58c8737bef28ea4c6f5bafa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777655211, "uuid": "fb4c6162-5f0a-49fb-a787-e2578c89efba", "comment": "Malware payload", "value": "e023d5f33d6e03132736b0f5ea6504dfe6f612eb7e7a260ab774a53013986fe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777655211, "uuid": "50cf3b76-6d23-4478-a027-d510c16721cb", "comment": "Malware payload", "value": "4384dabd6a9537a408b6011a05402c68f3e3f5d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777655211, "uuid": "5e99bdd6-797b-42dc-999d-05ef4960dcd1", "comment": "Malware payload", "value": "172cd1dbc0d02b9c1409910b3458e8b67ea5d4ae8bc9227d60e37f9b2102ab6e987041ff0dce7b05d88c2d6a95482604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777655211, "uuid": "1232e41e-ede4-4bf1-bb54-ed8da62fe9b7", "value": "T14CC66B11FADB95F1E903183140ABB37F67315D048B28CB9BEB547B6AF87B6A10C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777655211, "uuid": "4fe08291-7c92-40b4-951e-ac4cbd14951d", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777655211, "uuid": "09d80001-073e-4df2-a792-47a5b75d849e", "value": "98304:Ghcf8Nw5ijCQnZADg/KbvKOad4DG2nNSElv:n8DdnSiKbiOEylN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777655211, "uuid": "9109a855-9be0-45c3-b07f-7a50d8439cc4", "value": 12572672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777655211, "uuid": "2f669f4b-a70d-4717-9a80-8237381d6c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777655211, "uuid": "b56001f2-4585-4452-9ec3-c1bfcd6143d4", "value": "docconv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edec5356-4528-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777617751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617751, "uuid": "b1aaad77-c423-4d91-b76c-64be1d1ed245", "comment": "Malware payload (Mirai)", "value": "6da0f7509578fa8a308da8e07d1c2e3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617751, "uuid": "285abc98-443a-4d03-9326-7db0d0602abc", "comment": "Malware payload (Mirai)", "value": "e05b4666e41775319122973d781ea6ec21cd7c7fa24919df08e92a794b619bfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617751, "uuid": "3345326b-ceb0-4dfa-b9d1-765fe51b87b8", "comment": "Malware payload (Mirai)", "value": "8a4c32e3abc3edbf45deadd98954834ec490b61b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617751, "uuid": "d8ccae67-2def-4e29-a896-a3f2175a5785", "comment": "Malware payload (Mirai)", "value": "a261774e2dfdec3861912d0f5a5cfa466f521ae12066271e53b67731ae6baa61e5ef6e37ff813d47eb1f0f59844d6a24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617751, "uuid": "736ff6d0-5dbf-4cce-9c03-4d199c9143b5", "value": "T117E2F1F852D7D8D2CA9126F2ECB0914A610225F493F976D11F5EF0847853F62A5EC21F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617751, "uuid": "32a3f277-0bec-47f5-84ef-5d03d74152e9", "value": "768:xO5rUJKm5MvSjfMhN9kfcoM6U/YnrGYcFmzg3Ufw:M4Jf5pM2tM6nnWmzFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617751, "uuid": "2e68eb2b-3cd4-4038-b7de-7998e7f6c938", "value": 34116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617751, "uuid": "78a8668f-3f8b-4207-a5d2-50bfa6cdb39f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617751, "uuid": "df44888d-3627-4fbe-8109-25ea0c6d4bc9", "value": "rage.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f5c4c7-452d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777619857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619857, "uuid": "16486ecf-4be4-4989-a5f8-982bfeaab955", "comment": "Malware payload (Mirai)", "value": "159ae92b403dbb379287358b3c102cff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619857, "uuid": "64390e00-fe0f-45f3-a6d8-796f9a4fc820", "comment": "Malware payload (Mirai)", "value": "e0d23fe419f6fabd01c93e52887e6787a581a90acec12b42759a75c245643879", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619857, "uuid": "be798334-2ffd-4f48-818a-e97fcc5c17f3", "comment": "Malware payload (Mirai)", "value": "0e16530b135511def36334bb02b4f94b2b2de543", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619857, "uuid": "14cc134f-4b85-4d7f-a520-0b3fb276b92b", "comment": "Malware payload (Mirai)", "value": "c8c96d84993708d93a4c2e02d4ae3742b2dcad32ac2d8de85279dd92476c195dc5898820b117a3178d3bf77bd02a890f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777619857, "uuid": "0bdf41f1-3a5e-4bf6-af36-8929671b62c1", "value": "T18013E1B8E0894CB5E9A3CBA6FA4583D0779057C9387B69F007046F94370B52D5195CEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777619857, "uuid": "32840513-8724-4dbd-a54e-8d4b26991fb5", "value": "768:YFWde9PllvZpU2EO7DKlkb8oSKTZ6+BjwiPdOqSs/EkJexwAo2OYTD4x7D4uVcqr:imyPLhme8bKTZ6+5wi86/HCZUD4u+qge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777619857, "uuid": "dfce00cd-fa3e-45d6-9ee3-02df7bf27258", "value": 43524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777619857, "uuid": "a068cf16-e582-4ca1-a00d-c0d9586adb21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777619857, "uuid": "bd1f0a29-3648-4edd-95fa-238c2cda5b58", "value": "rage.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55db58c6-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618785, "uuid": "970c92af-5322-49a3-b0d3-bafd63f96725", "comment": "Malware payload (Mirai)", "value": "da3ddfd61359e595470e754012ac7180", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618785, "uuid": "045c9bb3-83c3-4bd2-96bd-48b5f6d6f9b2", "comment": "Malware payload (Mirai)", "value": "e108703bf2cde2f61094c4a12a417401c1cbc5877c5452d9e2434b924531cea2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618785, "uuid": "112596ee-f0c9-4c7e-9412-74e1083b37b1", "comment": "Malware payload (Mirai)", "value": "ae3d36431652d95dc002ec880017d17a5c339b96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618785, "uuid": "45cd1096-6404-4cc1-8f05-f9dcdeed48b3", "comment": "Malware payload (Mirai)", "value": "e39231406c3dd005404f8bbb67f5a4bd8ab17d4a47b2c0ddabc55f4c76175a7a077469da30dbb4423fc5d313b9ae7274", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618785, "uuid": "877e0218-cc0a-4bc5-9a84-449abca9ad1c", "value": "T17323F1EB815ABBB8D03EAB370445C6E4A5B31C9B1362537B69C580B3D079C163B93366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618785, "uuid": "63d67e05-1048-4b5f-a83c-442a2a08f044", "value": "768:PoRiXnfr1KwPlVJokdmtPVwefmr8JwQq0qGyHU7yrZnS3FtmqPg:siXcwNLtkHJJwQ+HUB1cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618785, "uuid": "e1c125ad-d372-4404-8e8e-eab3c744cd7e", "value": 47312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618785, "uuid": "020c5922-c491-4cf7-86d5-6319b98c01ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618785, "uuid": "ba72496f-af73-4c1b-a780-99ce90dc5fef", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d341ba-44ff-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777600098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600098, "uuid": "adbfcb15-bc16-4a13-a9c7-f03d71f1f7fc", "comment": "Malware payload (AgentTesla)", "value": "ed6f47a984ad17b76cfc9d5c86a01fcc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600098, "uuid": "d93ae77e-9541-4b90-8df2-44b9b1c5b5a1", "comment": "Malware payload (AgentTesla)", "value": "e26d72f2cffa2589de9ef1d5db811c5e7b58b33f08745c4dad1693662a4a934d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600098, "uuid": "62548a80-3118-4370-a058-7819bf6c8790", "comment": "Malware payload (AgentTesla)", "value": "7b147656e5074c556ca777156b4d1d7abf700bff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600098, "uuid": "3b38671a-e2de-4cf5-b87f-0cf7103b9065", "comment": "Malware payload (AgentTesla)", "value": "fa451dd00eea14bef132d828ce31c3a4bf4fa7d6d2667924fc2fb5f2e98b629562e71f6505c23249195accd042ab6b26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600098, "uuid": "a13c365b-7933-4a19-8772-0d5c75b20f5a", "value": "T1ACD6339FCBEF067DC928C9F37110157991AC009E9E0A7433CF7B692557803CA6BA529E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600098, "uuid": "64717b29-1b3b-4bfd-908e-685c76dd1b85", "value": "94e6eb0ca65cc3c1f10967cb56cfc905", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600098, "uuid": "33e33971-7ff4-4ea6-a907-5e13a60e3371", "value": "393216:OSjHZ6/bHXFm1o9eUsHBLo6c8WhLhJFhRGxzfHpJy:ZGD8o9EHJo6FWPJ5e76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777600098, "uuid": "603a99e8-10aa-48db-9be1-fa9e50b9ea4b", "value": 13223936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777600098, "uuid": "1fb7938b-0ba1-4dc8-89dc-bc34ba382587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600098, "uuid": "1e804d8b-2611-4bb7-be06-83513c47e23e", "value": "apphost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19d6615-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618965, "uuid": "4efa24e2-ef69-471e-94b7-df416ae3f840", "comment": "Malware payload (Mirai)", "value": "c43c86af94a32d8e7fa41d14397071b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618965, "uuid": "b66b1e90-4ced-49a7-97de-4d3d359ffe1b", "comment": "Malware payload (Mirai)", "value": "e34d1b801d78805efbd573065087d3641c8c5c75d9bbe6bee2259562244624bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618965, "uuid": "f1c64bdc-a843-4e9e-9de4-42152ff6c25b", "comment": "Malware payload (Mirai)", "value": "01b07200cb6d2ba50a44cbeb24aa3fe2feecd70a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618965, "uuid": "736d0d07-4bda-46d6-af4e-b2c66c15140e", "comment": "Malware payload (Mirai)", "value": "2e30fc232aac29791f4b1359e62c4cf2c33066731fbec7fd8d90515a33944f7bebd9dcaeb34dfa07df99fc3a7d9cb783", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618965, "uuid": "ff885b8e-1abf-4a42-8f02-59b7659b1b66", "value": "T1EDC33A077981CABBC8D7D1F44BE695269932FC3A1935715A67D8FDA20F49EE02E0D320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618965, "uuid": "804f52a9-0544-4fad-a5b7-5a0f3a83658a", "value": "1536:d/Afzj0DLEYDmATXMucgTvpVcb+nzIck5KNYhR61W6zZZzui37+:d8zgD42TlcgTpVcbAIcaK+RIlZ57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618965, "uuid": "fc873c49-0af7-4d8a-b467-717cf41b2c6f", "value": 127080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618965, "uuid": "26d1ff19-2ce1-4285-8b7a-04f622213a79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618965, "uuid": "fc3e83ba-c12e-489b-83d6-e4ad52f724b3", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86291b9d-4573-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777649789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649789, "uuid": "065abcf0-7d5e-4f71-97a9-52fa265c876f", "comment": "Malware payload", "value": "49b4026cc5ea6a5fa31192d0e2cf9b65", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649789, "uuid": "404f7fb8-0ff0-4437-86bd-14455fff52dc", "comment": "Malware payload", "value": "e39693a87201df843e78312d886c3b0e89817bd82bcaa6afdb3c5e4669896e1b", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649789, "uuid": "b288a617-69e3-43cf-b30c-d72868716417", "comment": "Malware payload", "value": "16d1869c36cb5547dad7f2e96faa103c3d83c7d5", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777649789, "uuid": "f671838b-d3fa-4d35-83dc-a8b0b5bad53e", "comment": "Malware payload", "value": "c2b4a364e06ca7164cf0f8b15d6c422f6cc1e1c8f3770fd43fbc047e38432a16d5ee6f0526e82e9238b444f30d3602d1", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649789, "uuid": "6300bdb6-cca7-4b68-b46e-8e991af0f6a5", "value": "T1D2D330AD439F89E866576449C1DB1145DFF1A023825CDBC0FF1CFAF62F01A68E0E2A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649789, "uuid": "220e96b1-d413-452b-b27c-693ed5e43252", "value": "768:Sa+Wzj5DgQUtrED9JZeSgrzDhYtzJCZK3hy7dhL5bkDUn0gYSkewwrua/8/r8NlY:jF6O97lAPX6wn0Gv/8/rQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777649789, "uuid": "0c24bb17-9a0f-4269-8aeb-438fdb6d4dbf", "value": 142821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777649789, "uuid": "1f8ae2e7-fe75-408a-bb3b-bf31cdabe4f9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777649789, "uuid": "8d66565c-c2ca-4c87-b8ec-7c08324c2419", "value": "Global_Archive_Temp_3614.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ced3811-450a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777604730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604730, "uuid": "011283f5-372a-44f1-95d7-84ee47138d77", "comment": "Malware payload", "value": "bde35415fee537d0cd0f955067bbf947", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604730, "uuid": "83114662-4964-4fea-baa5-4cffb05cc1f3", "comment": "Malware payload", "value": "e4e8707f1ba03004f4732a7f5345b26a7da2c026dba9af854522851e9e6de192", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604730, "uuid": "4d5f2f14-6b56-43b2-bf64-063a762ddcf2", "comment": "Malware payload", "value": "25581f4ce24700911d1b0cef07051f93fce38cfa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604730, "uuid": "bf31d762-52da-40af-9b85-e1be3b4d981a", "comment": "Malware payload", "value": "4f4b962fdeee13eb1919e6de15d1ceb3dee82a9b86f01a2ec14c3f11ab80c700627624eed75eee72a2f89ce81e7004ba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604730, "uuid": "f08eca24-49c8-45d3-bac2-bc0aa2a5a4b8", "value": "T1D4118CCA84151D6450C3446D2A976429F899D28E53064F80BE7D9C3EF7DC965BC38B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604730, "uuid": "ede79e06-fc1d-4776-9e38-ebcdc0139e5a", "value": "24:kXCaKvjuZI4WuBl0P8l/KioPlrNG0lMvlg4lVAC:eUh4NBCP8pCPTOvz/AC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777604730, "uuid": "f30a0228-3a59-4c3e-813b-77bc94985c1b", "value": 875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777604730, "uuid": "9a5727ed-f10a-492e-bc28-348251cb9805", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604730, "uuid": "c46f6b20-db47-4499-bae4-58fd183f2f4b", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60087256-4527-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777617084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617084, "uuid": "47c339e1-01e6-4e6d-ab17-2825607fd2b7", "comment": "Malware payload (Mirai)", "value": "a66d13e365551a6e4f5a08912487618c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617084, "uuid": "e0efbf0b-74ab-4a94-a2c5-12d891a8755f", "comment": "Malware payload (Mirai)", "value": "e5257f7b8982d6411ec74b1a4c4ec7679a2e89504e4071f3998914ac14ec41d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617084, "uuid": "e0524d18-30e7-4c44-b1e7-89d631c504d8", "comment": "Malware payload (Mirai)", "value": "1399162e92cf4ce2a92d27c0263e4b30e6ba2520", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617084, "uuid": "6cfefc39-659e-44de-80f5-e4c1665141b6", "comment": "Malware payload (Mirai)", "value": "db8abb672adda92fe786bb1f0722318af130bc27cc7126f00443179405d3684d5b58eab29b493f44737f28a9e09c9cd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617084, "uuid": "f9809280-70f6-48ec-87ea-9e8213ecf817", "value": "T16DC329137981CABFC897D1F44BFB94269D32B83A093572596394BDE21F48EE06E4D720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617084, "uuid": "e257e118-fe35-4a82-925b-77745a22839c", "value": "1536:juu/JBBeFhvqH0sFD4uyg/CkTta9TRMKWmJx5Yd6fj4lq0g3QTa:j3/JCqUsF9yg/CkQ9pJYd64h0QTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617084, "uuid": "80ccbf9d-d447-4751-bd8b-667921504533", "value": 127096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617084, "uuid": "753ffad5-c10b-4a6c-8435-6ce52e1dfb96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617084, "uuid": "d9e87d49-7df5-4552-a7fb-32c3e022ed04", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5685c5db-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618786, "uuid": "8b271f99-f06c-4d0d-8260-887dadfa966e", "comment": "Malware payload (Mirai)", "value": "6645168ccc6c279f603206701f05c38b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618786, "uuid": "4b735639-e654-4288-b5ee-b4bc3f6b0cb7", "comment": "Malware payload (Mirai)", "value": "e697d6bef02a1ae86b38185d2a0229d6eb140d2fc84a9a9805884316c44c2311", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618786, "uuid": "5b2dd2ba-bdc7-4024-878a-168a7aa541a9", "comment": "Malware payload (Mirai)", "value": "3a985b51aa22bf13ba7be9a8efca7551675b2292", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618786, "uuid": "020b0e6a-d038-4f8b-a8a0-a994e5bc2549", "comment": "Malware payload (Mirai)", "value": "95cf4e33b7108073cedad997bff0766d22e9cea641cf85584f83d5da491fdb51e01a92f74cabb12af8c79cfafd66da57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618786, "uuid": "3df833e7-909d-45de-841a-9c36bc0cac1b", "value": "T1EC33F26C411FF12BD696D8BE99D40F9217D40BFB6005C90A6FB22CE0DC25ED978846DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618786, "uuid": "274bd0db-a23d-4d1c-abea-e5348e6ab98a", "value": "768:z9Dr2xSrTOwxsnWnoEjl2+QWabcL6y50gkDIbwSLp3WzKXIXdY2uk/8FiyL8yeJ9:x3rSeizW3uy50nIbVLpc5dY32NV8bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618786, "uuid": "9b512da1-9190-48e6-a634-7943417d147a", "value": 50624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618786, "uuid": "8b893777-1133-4c9f-beba-e7fcb01fb9c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618786, "uuid": "670094ee-1447-45a0-81e1-7dcbbf7e1cf9", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff49a171-457a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777652999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652999, "uuid": "cca216ad-95ce-45c4-bb85-efaf451d970e", "comment": "Malware payload (Mirai)", "value": "ce6c436091b52b49978ad9685cec1330", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652999, "uuid": "d4ca13d3-f5f9-4242-abf8-594737f8066d", "comment": "Malware payload (Mirai)", "value": "e6d88997b4721c0d9c6c52e55eb3e1d5de6551add4fd364720f6d9efdf5532ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652999, "uuid": "b0f6c0ae-7985-444b-8ca3-2a4cfabc3673", "comment": "Malware payload (Mirai)", "value": "ae0aa917458eb29cf411ef821218668c14bca479", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777652999, "uuid": "3ff3c120-b791-43ba-867a-4a889ea45d11", "comment": "Malware payload (Mirai)", "value": "9a7531d4538a0bdddf7fbdd687c22f4be9d0eca700cdc8939e6c9bf95e1adc8e5f6788be9ee4bea7d56f078f9a2dd1a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652999, "uuid": "90beaede-d494-412a-9eed-c34730202d77", "value": "T12B83019C2188B456DD1BDCBB9BE43391A54871C4333E0F1EB736448BF97AA241D8857E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652999, "uuid": "79fb73a8-a132-4d45-b3af-fa204433b897", "value": "1536:IpN8lad0XCrmdy09e3jmODX9TrBrviaLnjkPbmSIIGeX91z0S:I78lkm39ODDTxY+eX910S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777652999, "uuid": "00d9378f-ecb4-422a-95e4-1b237ecb94de", "value": 81296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777652999, "uuid": "87d0a896-78db-4421-9c7e-5a9b1f0f9f9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777652999, "uuid": "d40ac57b-46f0-4802-9aac-8978ef450f0a", "value": "vaxbot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5459d322-4553-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777635962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635962, "uuid": "7b020d05-7455-42be-b7d7-9f7d12e73e3b", "comment": "Malware payload (Mirai)", "value": "09137384217c3906eaed1bd232f171b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635962, "uuid": "e3fac4e0-6375-4036-9ea5-092cb83f26b9", "comment": "Malware payload (Mirai)", "value": "e818ec5958fe9544afce9c022501eb4306384006398ac4c7d11d94eb9cc857cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635962, "uuid": "91781405-59ae-4145-ab28-653dd6acbb9d", "comment": "Malware payload (Mirai)", "value": "06667ae776aa426a73e965ba6166a02137688cd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777635962, "uuid": "b3bc317a-6a49-493e-b4d7-a911540f7ab4", "comment": "Malware payload (Mirai)", "value": "0d41b70532255cc0ff0a02191c5c272860cf1668970b311a7a71678112bfc9de163e11ff91aebee147648cf774c738c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635962, "uuid": "585d75e7-4cac-4eea-85f4-cba265f8ff4d", "value": "T1A4930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635962, "uuid": "2703fc4b-745c-4cb8-99ee-14a3f943d81a", "value": "1536:wqnZX8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1YSn:f8NUv5nTacgzafVAwe4BNRIbT2gXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777635962, "uuid": "b32e0595-ed4b-4ddd-a898-329f1d2e73fc", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777635962, "uuid": "2192e16c-871e-4af3-83fb-aae8a5ad0d4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777635962, "uuid": "da3d14c9-edff-406a-9ab6-70c924946987", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e144032-458f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777661748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661748, "uuid": "cb9b72d6-96d0-428a-a87d-c5fe2c3460f3", "comment": "Malware payload (Mirai)", "value": "1a77517ece452ac7f2770a61311be202", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661748, "uuid": "b3b96791-6c07-42d8-810b-e5fe41cd1a75", "comment": "Malware payload (Mirai)", "value": "e92f0609a8596e60a04b3865ca38cdf89cea9fb06ded3541f92e9fd778e2c933", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661748, "uuid": "9d7d93c8-f6c0-4aee-90fc-8b2e26ab47e9", "comment": "Malware payload (Mirai)", "value": "11868eb2d25b097ba3597ac15e92843638a2717e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661748, "uuid": "245f19ec-3b84-4d17-a2a5-b463ce3147c6", "comment": "Malware payload (Mirai)", "value": "797dc207525e6674b9bd166adf75b59a5881bd0fb4e3c432cd53d4a416859663efe19dcac27f97fb9eab7cced5173d0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661748, "uuid": "574f85b2-87d8-4cd9-9034-c3ffc9d56f53", "value": "T1B662418929329FECF66DC63447B34A30676933D626E0E688E35DD9040FA034E944F7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661748, "uuid": "80eadb30-dc38-4267-868f-7ee8c5bd8ee6", "value": "192:FkP+Djcj8OnEOLuqihAZjq82do0BPWUx0k5PfIbkeigA8nzBo7e:mG3cj8IEYuqbtq82fPJ5vevA8zBo7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777661748, "uuid": "f208c33d-217d-4127-9937-758490ce3062", "value": 15836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777661748, "uuid": "c09f25d5-839c-498e-b5e9-d4bc5c2a97b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661748, "uuid": "54cdce55-5b27-4df5-85e1-1e2ec40ebe7d", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb3c944-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618665, "uuid": "81c073be-ae2d-417a-8296-d388bba1e46e", "comment": "Malware payload (Mirai)", "value": "c4ac44fcab7436511480f826a418b7bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618665, "uuid": "270a6dc3-52f3-4723-af93-d62bcf0a7e4a", "comment": "Malware payload (Mirai)", "value": "e955fe28d83b763dda8da871a44bac3ca7e9102e46f33a1923dec740c48f535f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618665, "uuid": "45378fcc-8a9d-43aa-b35e-0390be6a7396", "comment": "Malware payload (Mirai)", "value": "b34f514b46a6a2283e0be34e8a14eed03a8e49d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618665, "uuid": "7f632a65-120d-47d9-81b3-22a60975a255", "comment": "Malware payload (Mirai)", "value": "62baeb7a513cdd2b31a81fe6de5b5bf4355a7ce216263063a538601ca324ee63513dd400b967088afaebcfb36c7d0c71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618665, "uuid": "f614f6a7-ae23-4e1e-8f02-174717807eb9", "value": "T125947C98E90F7E02D2C7F2FCED4A8BA27027B9F8D56190F27E03424DC5A59E5D5E2424", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618665, "uuid": "b1c62f83-89df-412a-8f7c-a3eb06c9b83f", "value": "6144:FjxrEs3OJ/aEck6KIz1xZ8cvXizmYrpSxCGkkwR1mUq0LHKUMx+:15Es+fw1zqcvqlMe33v1ME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618665, "uuid": "5c9e50d8-372e-4cc8-93bb-17790de57026", "value": 429728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618665, "uuid": "3d5116c2-1e8c-4117-9821-7ac6a969dc64", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618665, "uuid": "f7b84668-c521-4fc6-805d-c8541f58528d", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca1583f-450a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777604515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604515, "uuid": "5e26ae33-9e95-4609-a8f0-8f18bac3a7b5", "comment": "Malware payload (Mirai)", "value": "7ae0b16d6d8c98699a4ab56a63b0d137", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604515, "uuid": "cb41fb2b-ef8b-42bf-88d2-9fff8254f53c", "comment": "Malware payload (Mirai)", "value": "e9c0a35100302e6e53e1f8b020085754a136f5f67e34cf2b2867e96ef82cd748", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604515, "uuid": "6d5d3366-a885-493f-91f3-efefc484a45d", "comment": "Malware payload (Mirai)", "value": "486a90819dbb10bf1d2024a80588ab9ca505ab59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777604515, "uuid": "5034d15a-b2e3-4592-a90c-3224fb1f0a03", "comment": "Malware payload (Mirai)", "value": "71079f19ce5ec6191a4c2cd838baa3f10b8cc99ad090c4323ee23858669e08329ddffc07ebd5bdf79ef9b479f7d82ca1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604515, "uuid": "be6587aa-441f-4b56-8fbc-00d6a26f039c", "value": "T16A63C619BF610FB7D8ABDC3745A81B02288C555B22A93F36B974C428B71B64F19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604515, "uuid": "e5760e01-6966-4843-a208-e673df42927f", "value": "1536:5TqFVic1aGJ1UZudMciomybusjjlJZuG82tb+10WSN:5TqFViU2YdMulJleO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777604515, "uuid": "bdda33d0-5f98-48dd-b587-893edfb91b46", "value": 69208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777604515, "uuid": "ce1a9597-763e-426f-86be-15bd27464070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777604515, "uuid": "e2a33593-02d2-465f-b087-b25511414e7d", "value": "botx.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066c0375-4566-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777643992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777643992, "uuid": "fcde213a-a508-4ee1-b132-e16fa0db77cf", "comment": "Malware payload (ConnectWise)", "value": "747fdf0defc2d2f3bf06ec3b0374bdbc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777643992, "uuid": "a6541345-72a1-4392-afb2-eaa844f01234", "comment": "Malware payload (ConnectWise)", "value": "ea20958ff16356562707269753e817ca0fadaa73b0d2cf8d2baddecb523efdf5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777643992, "uuid": "0631a721-4337-4818-a64f-cc258f50ac5b", "comment": "Malware payload (ConnectWise)", "value": "d6e10d70ff41f369f34bfdb9613e0ff53ab87204", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777643992, "uuid": "4d55a444-9ae7-4a67-a391-b94cd0b5c6cc", "comment": "Malware payload (ConnectWise)", "value": "0857853872c518007cfc59c8bc7f69da83d156b43cd7f610445d4418b86646c556b927654f2a0d02a8c094dbf5ddb60e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777643992, "uuid": "4a7ef9a5-e1df-4695-b57d-1d3b45d9ee82", "value": "T1C9A623116BF8D278F1F22A39D876A0B1A5367D119E23D12E2324791E2C75EC08A73777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777643992, "uuid": "65377166-1f8e-477a-a6bb-0dfb00c2b5a3", "value": "196608:uHxcp9ym3nltDUJVWHxcp9ym3DHxcp9ym3mHxcp9ym3HHxcp9ym3:8GplpBGptGp0GpxGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777643992, "uuid": "c04aeec6-1fc6-46a5-984f-f83f11447bcd", "value": 9961472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777643992, "uuid": "9bae3b16-df69-4da7-80a9-5ea7ccf53abd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777643992, "uuid": "65676703-358e-4306-9447-4909cc262c25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc3730e-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777618660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618660, "uuid": "7561ebd4-052f-4873-9e45-0d949e54e894", "comment": "Malware payload (Gafgyt)", "value": "aa16915aed9e5655af935f719dd59597", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618660, "uuid": "0ffd4394-8661-4f23-90db-948511f20cd0", "comment": "Malware payload (Gafgyt)", "value": "eb08f124ba7d28f287b97aa3a0ac63231b5ef2c6b4b9ef90c68e219432196bcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618660, "uuid": "7920c911-a222-4eb4-84b7-f13b0f065303", "comment": "Malware payload (Gafgyt)", "value": "8e9adee9ea12a916e3c712783697a72559d8065f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618660, "uuid": "a6e2e2dc-e7e1-4a76-a31f-e68c9e74d1f2", "comment": "Malware payload (Gafgyt)", "value": "9ac03d6a8d5ff176d79599e78e72f0b4fbfea4f4f8aa6b66acc24fca1edc54274da8b9df9fcb1e1115ace50eebbb47b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618660, "uuid": "2fba55c2-f344-4456-8964-836c71168250", "value": "T1EA932B41F9044B53C1C327B6F6CF47493B226AB95BDB3312A6346EF42BC2B9A1D29D50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618660, "uuid": "139634e3-adf0-4bd9-9533-282ef3f1b493", "value": "1536:r8TbGir7UXykSCxTAiJxEON85hDePK1BT4WVM/bC3xjvxqQEqn/lJXfPe:Kr1CXJU5hCPK1BTdVqijvxqQEqn9JXfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618660, "uuid": "1ec7dba0-ec64-41ac-879b-009150d9c28a", "value": 96196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618660, "uuid": "7b5fa312-aa27-47b7-a01a-442603917c7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618660, "uuid": "62d1fac2-55a3-4c2e-adf3-c03bec14640e", "value": "hidakibest.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6c1175-4561-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777641910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641910, "uuid": "aaef3c13-a7be-4284-a922-b45b342e7928", "comment": "Malware payload (NanoCore)", "value": "ddaa81acbfd7935d90eb97626950e4ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641910, "uuid": "120af019-a260-4de2-a08e-4b631ec412fc", "comment": "Malware payload (NanoCore)", "value": "edcf6181bdfb8d796c08951dce6c98cec2fdada844e56a9ffa5ed9bce62e035c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641910, "uuid": "12ea622b-65bb-407d-bb69-d8ecca1ed538", "comment": "Malware payload (NanoCore)", "value": "1b8e7c43b294290390dfd7e62d077c5b6dac580b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641910, "uuid": "02e34ad7-f589-44b0-a9a3-49f63e3b8d0d", "comment": "Malware payload (NanoCore)", "value": "e93810b96121207a98367e2756971c40a2813501c2ae2562c8258b70bde4efebaf6420115942faad2e02ce41a92df1c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641910, "uuid": "6ef6ae64-91cb-4abb-8313-ba416e7c8fc3", "value": "T1B314BF5637B8492FE2DE86B9611241479379C2E3ACC3F3DE28D850B79B267E506071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641910, "uuid": "db7a96a0-c7a2-4506-affb-95847c4e0853", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641910, "uuid": "765c5fd9-0a44-4a14-bb04-aff088a242ac", "value": "6144:wLV6Bta6dtJmakIM576xUtdHfBTQxVqtjreq:wLV6Btpmk9kd/FcVqxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777641910, "uuid": "2fb9bea0-a6a2-4f0d-87d8-aa6663f1839a", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777641910, "uuid": "21491307-c724-4dad-be1d-e21d8a3cd907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641910, "uuid": "a89d63cd-a195-453f-b504-8519c983a0d6", "value": "1.1.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3363430-4544-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777629706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629706, "uuid": "860c24c6-18f9-4ba9-9871-f1ad9281603e", "comment": "Malware payload (CoinMiner)", "value": "f869b23597c9937173f8d0a33c3e79fd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629706, "uuid": "15dd2f4e-99f4-43bb-abef-b0e6dcde174e", "comment": "Malware payload (CoinMiner)", "value": "ee0a2f949f2db4a9234c1116ba1f5db643c1a0329ed8ea4e5e8c6fbe6c0cda11", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629706, "uuid": "c0aba6b9-3070-472c-b08a-73aec94d89f3", "comment": "Malware payload (CoinMiner)", "value": "1e08a23d54dc858ced00ae32c85727fa0b085573", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777629706, "uuid": "0fab74fe-2c78-4759-a78c-7eadc6298d55", "comment": "Malware payload (CoinMiner)", "value": "af3076a382bfeee78afeb72614436956a3524f7594168aec53a804d4672c921f5b8ce07672f91bf18f0c53ff675a0244", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629706, "uuid": "323b54cd-3b2c-4546-8c21-4beaeb17f300", "value": "T1DF666C2BF5A254BDC19BD074865BD5B3ED3074A802217D7B2684EA313E23F601F6EB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629706, "uuid": "9d636a4f-e5f3-484f-a5e8-0bd5a40d57aa", "value": "98304:VRpVcLuz5Ik/eo53KSSSSSSSSSrrUJBxkCLTJkd7F+ZTMrzZxt92a54WsvTCZ+ol:Lz5PrUJIpxt9ivSrhNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777629706, "uuid": "88838a19-0f51-4535-838e-71424dd19255", "value": 6581536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777629706, "uuid": "0d8a6c20-8478-4bd7-97ec-4e1a90e29fdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777629706, "uuid": "f0ba6133-554a-4d59-b779-32eeea20a56f", "value": "ee0a2f949f2db4a9234c1116ba1f5db643c1a0329ed8ea4e5e8c6fbe6c0cda11.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a130e2-4528-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777617660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617660, "uuid": "e9d150a0-ef12-4b69-b1da-88fcd15e21dd", "comment": "Malware payload (Mirai)", "value": "5861f7288dac311fe64746e931941ff5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617660, "uuid": "d89ddbcf-79b8-4ae5-be37-90fdc42717a8", "comment": "Malware payload (Mirai)", "value": "ee24c28cf8d99e689d9e606aa5daddd2182756663ce4aa4f355447fd81322d95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617660, "uuid": "b4541985-e2c6-4c12-9068-9d1186e08f55", "comment": "Malware payload (Mirai)", "value": "30a33320c78c4beef1db9b5a580b1e3fa7e09432", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617660, "uuid": "20b2d5d0-9f65-4ab7-bf9a-7808e20db933", "comment": "Malware payload (Mirai)", "value": "1b72fe8e97a5bced6f0008210235cd784abe8eefb3bebc0179603aeed7602be30874b02af35c457d08ee8d43d24b1c7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617660, "uuid": "96039664-0549-4eb5-aac5-844015447a54", "value": "T11AE3875A2E328FAEF56C873047F74A35976923D622E1D684E2ACC1101F2439E545FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617660, "uuid": "d9d2ad06-3d40-4af5-aac2-82a12e001c3c", "value": "1536:RAxYGcMMEsdmfwI3ku1eHILotSNcJwQzWeySTUTWuJWP9DTevQ:RjGmUJ3ku/otSKwBXnSuJ8DTevQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617660, "uuid": "318d704f-f693-4aa7-9c6c-eedb0ca83df4", "value": 148596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617660, "uuid": "8c268653-60a8-46d4-a1be-6d59b26c9184", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617660, "uuid": "324a83f8-b1a6-4e33-961e-8c52b5717381", "value": "rage.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e982985e-4530-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777621180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621180, "uuid": "eda4a0a8-ed2f-4d14-bce0-fbb38e424f74", "comment": "Malware payload", "value": "9daee0d1b91e1ef2e8ca15e92d53cea9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621180, "uuid": "d51a20c5-5b67-40b0-999f-3d9e325f247c", "comment": "Malware payload", "value": "ef52d73129d6a20b76dc883c55f2f10e634b2fc8b7ac8419fa6d34edb5327f0d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621180, "uuid": "761cb1f0-339d-4836-9411-57ed566a5013", "comment": "Malware payload", "value": "b9b13c384c21e0aef65fb0aca6d115b0b3746cd3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777621180, "uuid": "d7c1f4a6-2980-4732-912d-32d52c0a5cab", "comment": "Malware payload", "value": "e6e8f9b162f8ad230f29ffcdfe4eac12dc6483b2d10529cfdff7952f2b33f7cead6f64f6f60e3685dfd512a9d5e5286f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777621180, "uuid": "6b15c19e-553a-471f-a8b2-5edade28bc13", "value": "T1A2F04CC6F07D1D325E7488573146EAC43041406297F467F8F04CE3638B8F5387226B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777621180, "uuid": "17716fdc-95e7-4ec1-8ae2-5d1ebdda41ec", "value": "12:Z7L476Vy7Ty0yjyyyow/IOB7wXrWWBGy46kRy9LiOUimwB8rFUGy4kXLyPU:Z3476w7Ty0yjyyytQOBcXKWB94/yJ2p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777621180, "uuid": "a20c8201-bd56-47ab-b7db-9d808535a1c3", "value": 604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777621180, "uuid": "fbc51545-49e0-4e0f-8056-fa77be6064e2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777621180, "uuid": "3ede5fe4-8335-4e21-9a38-be876af4e583", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cdacc7-44f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777594484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594484, "uuid": "e495c76d-b8d8-4973-9ae8-0f6a8f12862e", "comment": "Malware payload (Gafgyt)", "value": "3c160b36c64027ce1e72b35d50084f36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594484, "uuid": "8555cada-b5a3-4720-bc74-49181f5a17f1", "comment": "Malware payload (Gafgyt)", "value": "f00e66ea92ed7c553c10423b98ce0e77f062aee57c349e53b801943426589f63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594484, "uuid": "d309ba02-c5b8-47f0-9f19-0f14d44c86df", "comment": "Malware payload (Gafgyt)", "value": "ecf30cea6f7cf457abc775c7b487445ef3de3350", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594484, "uuid": "09bd8579-4db3-4b40-ba86-b7d88d2c2d27", "comment": "Malware payload (Gafgyt)", "value": "9680115ac315c0c1b4d890d2e967bfbacbbf803cfbb43fe11965f182a388e0e20564c26909f26d9b707565c252b7f997", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594484, "uuid": "c7fad580-fb50-47bb-bf3f-488e45681389", "value": "T107B33A56BD018F53C2C315B3FB9F47887B1667F8D2EF3203D925AF61278A4D60926990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594484, "uuid": "98d80005-69c5-4805-99f5-2c459fff806e", "value": "1536:tFLUYuJwW9Mgw7G84b47XGF2rwGDcCa6rwO0923qVbvR0hrh9Fvo5hJppvq:tFYfT9qa+GQcGK6/U7qHro5hJppvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777594484, "uuid": "7603e951-2795-4306-8840-58934c4e2e38", "value": 107720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777594484, "uuid": "1c279eff-6eee-4bc3-8202-a3efffb2b224", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594484, "uuid": "b00bb56d-28e7-45f0-b7bf-5b9acfe7aa90", "value": "FBI.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b055390-452d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777619518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619518, "uuid": "74dafc1e-d1d9-4b35-9217-7105dc58a6cd", "comment": "Malware payload (Mirai)", "value": "adf2093ae54c5a9dc5b3d2986d121769", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619518, "uuid": "736dfe8f-0d9e-491a-b047-36204b4a30d4", "comment": "Malware payload (Mirai)", "value": "f02d536dfd94ac08139e554d8379aec8d1759f6b1d822444432453cde2b5427e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619518, "uuid": "c6eec47d-cb3e-4e11-9e65-8fcdc194d805", "comment": "Malware payload (Mirai)", "value": "a3c52c2bce6c1eb3ebc65b164e1e9d621823d980", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777619518, "uuid": "bbf7cf4f-2816-4b36-8406-89cc9d5a4a36", "comment": "Malware payload (Mirai)", "value": "b187a7a4684a6f371c3d14f85fffeab4c1a808b736ca442dd27c54c4b6da2bfc1b04b8cd8e0e72d1ce5502c22f0a5034", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777619518, "uuid": "48ead02f-51f8-4334-aea0-e74f34e320f9", "value": "T127C34C17B4C1D0FECCD9C1B48FEAE227D973B5291138B21A27D8AA261F5EE205F5D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777619518, "uuid": "5658bb82-5521-4b69-b810-099297a99ab0", "value": "1536:pGFslGdkEoF5oOHdjwFHfPmrgaHcw03VFdd8kaYG5Wky9a35zRyswww:p0QGdrO9jCfPmrgaHy3rde7YGwkyQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777619518, "uuid": "2cc074fe-f776-4f9d-ad11-4c10a113f42f", "value": 119624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777619518, "uuid": "04dbcc6d-2c74-4d3d-8069-3fcf70378aa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777619518, "uuid": "3ece1db1-26df-47b1-a092-f7d3093ff43e", "value": "rage.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b50ea17-458f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777661690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661690, "uuid": "677db3b3-3759-4cff-843c-406f656826fb", "comment": "Malware payload (Mirai)", "value": "3ece74e2ccca3efdd11768282c387fca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661690, "uuid": "f745168f-7145-45e9-bdb7-524c127d54c6", "comment": "Malware payload (Mirai)", "value": "f04d96cd1d12dc9467c5325fc7910d28abf36e8ba37da8b56093ffc840355ac9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661690, "uuid": "6e029bb4-574b-4b5c-a538-b616945d4c0f", "comment": "Malware payload (Mirai)", "value": "4950627e7ed1da894e4ea120d5b09acb3c0f55cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777661690, "uuid": "fb6f6d74-c2b5-425b-a339-b98f77faf560", "comment": "Malware payload (Mirai)", "value": "91f60f2b7803682b4f566c21addf908da1c935dcca5da43ef9de08d658cadd658301fece744c5d70d7428213008e4c5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661690, "uuid": "f4f7cce0-f0f8-4102-91c0-7c4467d01fe9", "value": "T1626302B872FF8174E0DDF532254F21303331EB9A946B53DD3E89B5D9E2925580817E68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661690, "uuid": "481e1739-93cc-4310-951a-69653e80028d", "value": "1536:hltrI7mDmde7Lletk8cghgLFPjihgulh6DoIZ8DrPk:hl+YmdkLMk8c5PdulIZ8DrPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777661690, "uuid": "85c95117-bf7c-4958-b028-d83612b401f7", "value": 70848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777661690, "uuid": "65d231d6-722e-44a2-9983-232745c09ae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777661690, "uuid": "0d5fea31-5442-4abf-bb3e-e1b7a6cab19e", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840e931c-44fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777597817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597817, "uuid": "64d79711-41a7-4cc6-b39b-3de1b55cbab0", "comment": "Malware payload", "value": "d47a46337771f96d51be0b795758d3f9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597817, "uuid": "0357bd91-b6bf-4959-8c38-fc06ffa511dc", "comment": "Malware payload", "value": "f104ab822d17a13dce3881ccee3ec59a0f7cacd6a7be20da593d42a9f32fd5df", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597817, "uuid": "7a282ef4-6f62-4b6b-bba6-73f7ec8fbc40", "comment": "Malware payload", "value": "281a6140ffdb4748d3e14f33eefeda3b6bc9bd24", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777597817, "uuid": "a7ac4d36-bfb7-476b-925d-f6fd1765a48d", "comment": "Malware payload", "value": "4a98bf8764f424a857fe02dd3b801c3f74a999a8316d5c0e9ee8f40e56ef7b3b8667321111a5f64450bdee8441d59ebd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777597817, "uuid": "ab7f17a1-59c3-430a-b901-5971b8f2480b", "value": "T15DE01AE94E764C62C07C9D22C04A8B27DAF8F9AF9210DC31148072E0E58169E0F37CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777597817, "uuid": "52434055-09fe-4290-b594-fbf6692b982c", "value": "6:hnojHVCFkenDtBM/gWhenDqhenDw5henDKhenDS7AhenDDn:YHVCFkwmhVhb5h7hchy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777597817, "uuid": "19558756-5581-4682-b028-0d6d81cd236c", "value": 353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777597817, "uuid": "86adf64d-de66-4cde-a502-a9184da62dc8", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777597817, "uuid": "4adf838a-68b0-41c2-b776-9606269e1b01", "value": "regkiller.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b889ab-4595-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777664517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664517, "uuid": "b034f29b-f4e1-4168-856e-5116d4a6c08d", "comment": "Malware payload", "value": "7a9033900487b0caa34bd14f0286e504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664517, "uuid": "ff7eaa95-c224-41de-b4ed-c360f7b02c6d", "comment": "Malware payload", "value": "f1bf98f16fa3252fa03827a9665d364b75e75a457d9eeeaaefe3d838d4903337", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664517, "uuid": "71727e1b-63cf-4960-adc0-6929cd0bae53", "comment": "Malware payload", "value": "e9457821615c338d813289059bc0fb3546a10ca8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777664517, "uuid": "79fa3837-12d6-4be4-878a-a593eb93e65c", "comment": "Malware payload", "value": "00c7e86a3eba0883ae21e291a6df7dd0ce7e8e18ab83ef6086279ab08afbc17673558ad058722377ac27d03593245630", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664517, "uuid": "f973a28b-2efb-43f7-a228-f430c6f4e135", "value": "T1FDC2D01BE24D2CE5FDEFE6B50A67A3412FE10E8760B1B5E46359FBC258214B002A4DD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664517, "uuid": "59bdc5b1-12eb-4c94-9798-1d765f74d599", "value": "768:rBvNTnI+OV/B6W7E+eEn9mM++hOyJS6hEt7D4uVcqgw02NWXU:7nItV/BBIGxlno6i1D4u+qgw06WXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777664517, "uuid": "5b47700b-b02e-48fc-bd6f-3a3fb9cc8aa8", "value": 28228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777664517, "uuid": "c5c9b0ed-613a-41e6-98d5-15cfb6628c8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777664517, "uuid": "dd989bef-ad8e-4ae3-95fd-862b722cf3ea", "value": "PC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff62903-4528-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777617701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617701, "uuid": "a75247be-db0d-4e0e-98dd-b7cfcd6ebaa5", "comment": "Malware payload (Mirai)", "value": "ed2453f930abc24dd2691071c0a1c4a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617701, "uuid": "b4fabaad-bb4d-400d-a107-f20d7925f5d3", "comment": "Malware payload (Mirai)", "value": "f2055f9a9434687e990d7f917dc70bee5c573935e763a45af94877136419061f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617701, "uuid": "9d0f3e4d-bf05-449a-bacd-9e4ccb298598", "comment": "Malware payload (Mirai)", "value": "33dd4756db7b68cb14cd24ba3382f663c6c20c84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617701, "uuid": "00538504-dc96-4df4-b3f3-cafdb8c1be10", "comment": "Malware payload (Mirai)", "value": "c136e93c1f7a79139a033406dc247e873930a0be7695336183e6d49dd7310fb852d19cb5d0b2c5905582610f44077c9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617701, "uuid": "4af21d71-0d3b-4170-b3b8-d47b9dd6e85c", "value": "T18B638D85FA83D4F2EC5301B2843B6736C732E5269066DB06D32D9E35DD23951AB2B31D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617701, "uuid": "6df0aabb-ddf1-4d93-bcd1-b4858c125d2a", "value": "768:wSfMxt/IvVHp8cS0k9WeTdhI29EhN6Y3JhBwPJZfKLf4HDOJQafvepPIIJRpBG/M:wSfMv0rSL9WIIzgdmBtEPIkGia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617701, "uuid": "a58e24fc-9117-4ae9-b471-9434c57f4553", "value": 67996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617701, "uuid": "863f80ee-f9f6-4d4a-aee6-79e778ae9b6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617701, "uuid": "9d9505b3-2073-4fc6-9ed7-e1d6d90f712d", "value": "rage.x86_686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a60dc31-452b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777618658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618658, "uuid": "e91e273e-b238-4372-86ba-69c94197f6a5", "comment": "Malware payload", "value": "366b67cfe7bb5941f46ed55572fa0863", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618658, "uuid": "490bd42b-0275-4bbf-9e46-82415b5a3ff4", "comment": "Malware payload", "value": "f277545dbb84359223524b354716977539953bf1206ff2f46fcfe73a0a88b8d3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618658, "uuid": "05fcaf5b-f2ab-40cc-a5c2-69eccbd40a56", "comment": "Malware payload", "value": "1ae38efdb66241a0a4f020d556b1b6f0fa1306d2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618658, "uuid": "190ce2d6-1e44-416f-9614-15ec32163c17", "comment": "Malware payload", "value": "1c1f08a9f111647c7b8af3e83f81976c1902278cfff07f3a8af83f914594501761783b0abed426ae857f7fe4c1fcfcaa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618658, "uuid": "b9e29188-7125-491c-8ce4-e01f6b807ad6", "value": "T193710FA5105544FF4A09D05FCF26390E3C9A13BF3E190D2535AE2FAE3FAA01461FA57A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618658, "uuid": "681433d3-206e-4d50-848b-ed88e4b271cc", "value": "96:QF01YM+10JFW7M+ekumAZ0Vhfdw6vD83p5g6B87rhm7j1rLfzco:QF01Bmw0Vn7T6KrA5rLIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618658, "uuid": "574427fe-4cab-4ce3-a22d-4a7fa6dfd3aa", "value": 3768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618658, "uuid": "917f57c7-eff4-4312-a537-30dfb4059e81", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618658, "uuid": "fb72a756-bc56-4555-aa32-5bfdaba672cc", "value": "hidakibest.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3edcc553-4561-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777641939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641939, "uuid": "0044c48f-f47f-43cc-bbf5-fe54aa92cdb4", "comment": "Malware payload (ValleyRAT)", "value": "1f2387268bdb3557b21b4a0db958c130", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641939, "uuid": "3613070f-7458-40d4-91f2-1272fa10b156", "comment": "Malware payload (ValleyRAT)", "value": "f2779c317e26445046ccdd22a36e3a0423a647449e4e978a16f435b6f1f910a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641939, "uuid": "bb0fd4e9-bf39-47cd-a543-d38ef3f25b53", "comment": "Malware payload (ValleyRAT)", "value": "0a71906dd82f0d53ec425bb43c85befcf4a88121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641939, "uuid": "2c291af0-ad78-40d6-b493-cd9c3064726a", "comment": "Malware payload (ValleyRAT)", "value": "3f237ac1eb825bb5530d5cf559dcfa40e12fdf75f7150b823304fdf0e14f504a02862a786138b79beb7bea54befa41b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641939, "uuid": "d93e049a-e014-472e-8c47-4367c6fbd078", "value": "T1FEC53311EC10DC99C96CDE3285E9D1B0C7369DBDEBC649016099B3BE27B31C7BA72285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641939, "uuid": "75737331-5555-4f82-a6f3-5a07365c3ee2", "value": "fb590a2992c1abbe4bf9a244871e73de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641939, "uuid": "239eb693-319a-4758-9f48-ce2b3a487a78", "value": "49152:A8x/JwHYBUl1ioGjuPIItSxMUSr/6sqReFsF16dDPxjku:AQnUHGy10Mdq4JdNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777641939, "uuid": "cdb249f9-4dab-44fa-98cc-5ec9d37cb73a", "value": 2585656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777641939, "uuid": "2164a431-5c2c-4e78-9f6e-3ed908d4c379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641939, "uuid": "13ee75e9-22b5-48c2-a25f-9b22869ece73", "value": "f2779c317e26445046ccdd22a36e3a0423a647449e4e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba071184-44ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777600055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600055, "uuid": "80d7fa17-03f4-4cb8-822b-6e42db8a5ad3", "comment": "Malware payload", "value": "3a655d1aa0c3632fd9dcb13a8624f365", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600055, "uuid": "aa1f3748-90ca-4e27-8c65-ae9769968e2e", "comment": "Malware payload", "value": "f2b4d8128725a290688748f8d89cf2955e761b57fe846970719a8b0e924704dd", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600055, "uuid": "18d81ad4-2d76-43fa-898c-790db08d91b9", "comment": "Malware payload", "value": "e82a98fd4a42e2ce19f7c21e41d04a7a3ab09bae", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777600055, "uuid": "1cba6528-1d86-4bd2-b3b2-94fc9b502d68", "comment": "Malware payload", "value": "362bf66d40c730473f9472dc455f948265d7d7d85aaedbecc766374d76a6c380ac71d36e73caba9e5d29089eeff849d9", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600055, "uuid": "f21241b2-90df-41c7-9bb8-11ec6782c1b1", "value": "T130168C03FA9581E9C0AEC178C71A9233EB72F88E4621B79B17D44B212F53B606F5D359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600055, "uuid": "45b00ab7-ad11-4c08-b7cc-add7db9e95d2", "value": "43e070dc437576b7bde81008825a6200", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600055, "uuid": "9d6f60c0-dc6d-462b-b837-c9bdea01eb77", "value": "49152:AmMERyQ8ush4xPnwee12NezMH2TmJdX1hF6SvwuW+pdyMERhUUBBX3wmaXNPThGs:AfEBjNz6c0zWNIoUCFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777600055, "uuid": "3c7d06ac-fd39-4555-aa1f-a8536a42541e", "value": 4310528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777600055, "uuid": "21faab15-078f-4a41-bdf7-d5b1385f8b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777600055, "uuid": "1fdfb20c-79b8-4b6f-ba5f-eee0aba70739", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97adf051-4581-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777655832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777655832, "uuid": "a3fdff41-6562-4d56-926f-13501d92f424", "comment": "Malware payload", "value": "8206ce7c187d381add8ee9c995472197", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777655832, "uuid": "af082272-e85b-4288-a4bc-e86ab134e157", "comment": "Malware payload", "value": "f58889f3394e62fd6b4aeae86630300650479faea431eb848c5040090399adc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777655832, "uuid": "0b2edaa7-5b6c-4365-9c4e-5a190ab2e49d", "comment": "Malware payload", "value": "6b861a96ceb1112860f1816614ae3e8197760089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777655832, "uuid": "d41fa79d-de41-4bc7-865d-df0caaa3d797", "comment": "Malware payload", "value": "eae78ec894b10b4b88c3bc2083962db26830aa879bce0486024d6586f8f6127c906edcce6aca2f46d5742d5a818cbb9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777655832, "uuid": "ccd5aca1-45fe-447a-b7b8-673b2067ba4e", "value": "T15752E905BBF0C166E5BA4B7499F359045A33F7624932CE5F24CC818F0B27680ADE1FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777655832, "uuid": "6517d956-2700-49aa-acf9-069e9b7c6029", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777655832, "uuid": "4e6b1a2f-61ab-45e2-8b5f-20409bfb2488", "value": "192:vfEDVIYxbladn5GBTcigrmblB9aZuG/xOkt7EvVEMcRDTQ6W7vm:nEN+d0TJgrmblB9guwQAA9EMcxFW7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777655832, "uuid": "7fc9ac39-41eb-4ab2-b079-403a7194ea96", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777655832, "uuid": "a5433f1e-304d-40d7-9f2b-eb08b3773a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777655832, "uuid": "5ed982ca-be11-4509-8840-7f710446c0e6", "value": "CoreWorker_qLCqsxVdbYIeeGF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af78e4a-45b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777679755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679755, "uuid": "13a203ee-fbdc-4b21-a0db-62c816179972", "comment": "Malware payload (Mirai)", "value": "40c3701099a87ce8f8b63724f2cd729d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679755, "uuid": "290cfb4d-665a-4d54-9188-1697590fcdab", "comment": "Malware payload (Mirai)", "value": "f662b1094f7ac4beb0acf83d36017c8b0535c2be965ea536b7a68b7a4de2197b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679755, "uuid": "dbbe096b-a2e3-4335-8ae6-cac556ea53dd", "comment": "Malware payload (Mirai)", "value": "aa85ffe3b7ae2285d9cb424f76f1a8e672a6cc41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777679755, "uuid": "97bed281-0e78-4a02-8895-e6e4bed93997", "comment": "Malware payload (Mirai)", "value": "1856c11dfc2d24e0e5c527f057e8c21abddeb5ef242873fc774aa4e8310d86ae3eef58b6796aacbe32bae24299956d1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679755, "uuid": "ef0ed968-5fed-4a74-9f43-d38e6f1bd128", "value": "T113B45C03EED4557AC0C6C2728FEF8627A774F4AE2334752B1746AF516D05E60EB4A382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679755, "uuid": "94536e38-7fff-49c7-b508-549f6f6784c8", "value": "6144:vaNChh4J9LVr20F5EhtHcWobHNRLK4G1qnG9uOFRWD3lw4pYZ5yU:Cg8rhb6gOFRWD3W4pc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777679755, "uuid": "37c5f97e-e30b-4f39-bc63-8cb01d77d109", "value": 512840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777679755, "uuid": "85544abc-9783-4f13-b771-7c7626347048", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777679755, "uuid": "fc041c8b-6ae5-4d78-9fca-d5644c17f254", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fbe03d-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653005, "uuid": "990feb5e-aa73-4ae0-8e18-123c8f74dfbd", "comment": "Malware payload (Mirai)", "value": "926d2a12211d0350a66d607fa2eddb96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653005, "uuid": "d0b9aeb9-2a83-4134-8c98-b555df02751c", "comment": "Malware payload (Mirai)", "value": "f687174ab344d314e236e32efd73ba3bed27a4e6cf3fee1c55e6a40effbf8783", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653005, "uuid": "f36f4731-ed9c-4a43-8bc4-4a27802faaae", "comment": "Malware payload (Mirai)", "value": "f9b9b238fefaf9375e22f481d156ccf9f0581d46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653005, "uuid": "1d717ee6-a6b8-4e8c-894a-636159bfda51", "comment": "Malware payload (Mirai)", "value": "9c584078114840c02f616f7467f6d9e0a045267cca60bedac65fcd30b80402302ff303171e5e5fe84454f61387c0c66c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653005, "uuid": "1d9fb79e-7e67-4b95-92c3-4de8d8a8010f", "value": "T181243ADBF800DDBDF81BEA364C630905B120B37254931B376297B967AC3A1E54927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653005, "uuid": "ee7c168d-03c3-4d1e-8ebe-76c2b98703af", "value": "6144:vbC3PyD29essFI4/qzZ5N31DaLRLWmMynMWT:z7hY1LmZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653005, "uuid": "9200fe35-377a-4396-86a5-fb3305a6abd3", "value": 217888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653005, "uuid": "0d8d3226-d336-4ac9-93ca-6e6788336bdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653005, "uuid": "fafe47f6-0dbc-4082-bc6e-c22ef03220c7", "value": "vaxbot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11e87ff-44f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777594483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594483, "uuid": "72592842-8f7f-4d1c-8219-55787bf60037", "comment": "Malware payload (Gafgyt)", "value": "4ddf40b7abd167fb37517fe2c73e2dad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594483, "uuid": "26265470-1b83-493c-9668-9b6da4384900", "comment": "Malware payload (Gafgyt)", "value": "f7a410fccd9cd65ca883a7270455b6cc07ea9351af6b9fe13dc3129b2c5539db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594483, "uuid": "4a8128bd-14f4-4298-b7b2-6849980c2744", "comment": "Malware payload (Gafgyt)", "value": "847c21648dfd73f04ef9d4142dd3499d35d29109", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777594483, "uuid": "86103061-1665-4214-8011-a42c863a77cd", "comment": "Malware payload (Gafgyt)", "value": "73ff4fb7e5ac7868cdd9551fab642934f856d175610e41529a343046ebb6626fb07eebcacdc4c5fc4d19b10d003c827c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594483, "uuid": "90b0181d-acbd-47a5-92c3-846e9d6fdf6e", "value": "T10EA34B03B6D18DFAC08BD1F047DF6A259D32F4FE166371A76394AD902E1CDD12A19E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594483, "uuid": "938f6bcb-7b43-4233-a574-38a8650cc288", "value": "3072:9DOh5sEyGiQw2g2BkhP9HJkVX/9jJ3vQteQZCV:9DOpXfW2BkTpmBJ3vQtefV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777594483, "uuid": "9eee9598-5819-4939-97ae-2636a1aa74ff", "value": 100216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777594483, "uuid": "1cf37c5b-74c0-4dd8-a6a6-41af57b5e45c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777594483, "uuid": "3ff3bc26-19fd-4698-903c-9305b6805235", "value": "FBI.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae360cbe-458b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777660165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660165, "uuid": "2b7dd414-be1c-4d6f-91b0-bc2c4f8a2fb3", "comment": "Malware payload", "value": "9de975d0dd3a030da39f83880f9a6662", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660165, "uuid": "a7c4bdb3-2e95-4425-aad9-51c3df868683", "comment": "Malware payload", "value": "fa6828c5c784780ef820b0c075ca5837fafe2c21581ae84bce99563917b89163", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660165, "uuid": "bdf23950-d1ae-413e-84c1-7da61db88a05", "comment": "Malware payload", "value": "7c0286a237bdece883a10127a79cc1e2f4fe5c5d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777660165, "uuid": "35a55851-a451-475d-830c-b3e23585ed23", "comment": "Malware payload", "value": "998af3ea2a71c17e804286e247c3512c701ada84c0d11714f6c4836ae3b4e3e800e79c74d8713bcd0d9823a443602335", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660165, "uuid": "1ec36f53-4466-4b9e-be03-43ca0ca56d11", "value": "T18EB0121A9551F5FC2D600BC2D2256C41C00E17D100B154F546F657C84B14C69984C32B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660165, "uuid": "ff791d48-6eff-426a-993c-0271884f60fa", "value": "3:Sb4etmAcLhzAK5DFBOWBzZYmP87A:Sb8zD5P5TYZ7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777660165, "uuid": "8fc77a84-8a8c-4088-ae64-823389981452", "value": 100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777660165, "uuid": "91e352e7-2114-4ede-949c-2723c93f4a5f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777660165, "uuid": "aa6de03d-b6c9-44b0-8ff0-9f43980238d5", "value": "tmp39C8.tmp.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552fa0ea-452b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777618784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618784, "uuid": "c747810f-0fde-4483-adfc-d6ca470c3a6e", "comment": "Malware payload (Mirai)", "value": "e90f861b856f7a01d6ef7309562c587f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618784, "uuid": "803832a6-0167-43a6-9536-a091740b05c4", "comment": "Malware payload (Mirai)", "value": "fa849aee0c05e22a4673e509698fa24824bdab531148012bfdb691ffb6f0cea3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618784, "uuid": "484ab244-1a2f-4e74-955a-f7acb0596ae0", "comment": "Malware payload (Mirai)", "value": "c10a09dc5f6d595b250d25283b7f21017927cbe1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777618784, "uuid": "bbd351c5-452b-4d13-b881-202c91f79f10", "comment": "Malware payload (Mirai)", "value": "e69d0c44606f97617ee4be73d1bc0721c5fa2fa417d4c57f4be36cf71160e7cea1fdfeb930bbf06c40018448a2096c4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618784, "uuid": "9431d857-d8c9-4126-96a8-c957cfb9f670", "value": "T13DD3E787F901DFB7F40BE372489708157530BFA60C625A73726778AA9E3A0C51467F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618784, "uuid": "da7b4a53-5e57-442b-b26d-a2d162a5294c", "value": "3072:CvdzYnZIJ3zgp/ThuOAoVEjbixLm1YFtyIVrBi:CvMZIJ3zcAOAILMayIri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777618784, "uuid": "cdf545d6-ff91-458d-8293-a2294aea76f2", "value": 140276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777618784, "uuid": "2bc8046a-b272-4f9b-97eb-dff01d402abb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777618784, "uuid": "14044ade-0972-4ec4-a0c6-7ec6256f7a1e", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de9e117-4519-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777611094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777611094, "uuid": "52501183-26ef-46a5-b45c-87e663189229", "comment": "Malware payload (ValleyRAT)", "value": "a54865c9fdc2a6537f3bf06e3fba0de3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777611094, "uuid": "233196c5-83e6-49d9-95a8-02daaa337b01", "comment": "Malware payload (ValleyRAT)", "value": "fbdc52e893c216d9069764379d6b7d08f13c2572d8b92f30a8ea999421301918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777611094, "uuid": "abdd51ed-a4c2-4159-af11-efba0ef5098d", "comment": "Malware payload (ValleyRAT)", "value": "2fa39fdb8009308072bb532945b43584e3fce041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777611094, "uuid": "fe3bea51-79c9-4486-82f7-1c3be423b755", "comment": "Malware payload (ValleyRAT)", "value": "e6d0d813e2e5703db46ddbc3fce19b054e075110ae66e9ed0e69dbe451f2fccb642cd1ee098d4b4ee899dcf11b2f12cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777611094, "uuid": "bb961309-11fd-469c-9941-72523bdba4f1", "value": "T1C5973313B2CB153BF1AD493A4977E21A553F6A22B512483BD6E8096CCF294D62D3F307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777611094, "uuid": "ceb826d1-f1b4-4062-9b71-9fbba73cdf1b", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777611094, "uuid": "068c16b7-a9af-4a47-aa57-9e7e61f2b5ad", "value": "786432:CkTwl+Wo68aEQdmPL+H1ain+rgeVBZexC5lL8EtQfSczLXNsp3+YdA:CkTwMWKCH1T+UqAMlL8UQqSbqd+YG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777611094, "uuid": "7a9283f0-6765-4952-843d-e4fbe9d3533c", "value": 40520826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777611094, "uuid": "6b1348d7-9337-4072-9a87-656953d7e38e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777611094, "uuid": "6c9ce8a8-0d99-497c-9d8a-9a82e61ae6c6", "value": "Clash.Verge_2.4.4_x64-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3240e329-4561-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777641918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641918, "uuid": "2e79131d-2419-4733-a1b0-ab1e5e252cab", "comment": "Malware payload (NanoCore)", "value": "b65ec58b6b8c3eda9c937ea262fca4d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641918, "uuid": "c73e2fc2-298b-4bc5-b4c5-afb676b99b92", "comment": "Malware payload (NanoCore)", "value": "fcc039083a40b310c2be7daf5cb1866ebfd3043c680d92c1ad4e0f83a3a4fff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641918, "uuid": "c62569d1-a946-4a7a-a5e3-a1c005ab2072", "comment": "Malware payload (NanoCore)", "value": "2f44b95df03254db2f2bb1dac67f098f7478c7a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641918, "uuid": "19a1fc97-80fc-4b5d-894b-10ce2ef74ae7", "comment": "Malware payload (NanoCore)", "value": "4058acff6bfc2fcc99fc1fd47f1c85eed632b682ec4cba24843eeffabf50147c8c2f820e28306caa63b18e2cf8672d73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641918, "uuid": "ba0c9b86-fa3d-4ef4-a44c-0457ced59f0b", "value": "T1A714CF5677A94A2FE1DE89B9711241038378C2E7A8D3F3EF28D425B69F267E006471D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641918, "uuid": "79f7c28a-d837-41a8-aa54-3ec8fd365b7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641918, "uuid": "59b326f7-c5bf-49bd-aadf-5fb6d1d0d897", "value": "6144:gLV6Bta6dtJmakIM5SQa2WCE085Qe6nGS:gLV6Btpmkf2Wd085Gn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777641918, "uuid": "b48e615f-08b8-4cf2-ae3a-7564a76f173a", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777641918, "uuid": "573caeaf-803d-49df-a04d-7f73f6476da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641918, "uuid": "ca8077e9-0c09-41ed-b3ab-c666492dd4c2", "value": "gamebai789.club1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fb51f6-4586-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777657839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657839, "uuid": "46f952c3-a4c8-4066-9de5-256323ff4767", "comment": "Malware payload (Mirai)", "value": "f6b81ead40c79f8f88805510c5801ee2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657839, "uuid": "3a7aa567-4fc9-4ceb-8f30-5c550e697297", "comment": "Malware payload (Mirai)", "value": "fd5191315c5242ba4c22313c9d305cb005cbc5db5e81456e3a6df7cd8cbf312d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657839, "uuid": "f3d07593-ba14-4007-aad0-b0831e0f04fa", "comment": "Malware payload (Mirai)", "value": "ab937a862605d54acd4fb6cd52c81675faf7c48f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777657839, "uuid": "cbbecba5-7bab-456e-a466-c5e27b17cf66", "comment": "Malware payload (Mirai)", "value": "81d014c81807dc91b09e6b26fa7a061110b6b1ac4b3487f90a5dbaf15cd046b985087f6b69834f502bdf97fb880a5b31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657839, "uuid": "e0e90a6f-bf89-4b27-acb7-7ceadb671793", "value": "T1CED35C0A79D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DE05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657839, "uuid": "5576dbcb-2e71-47dc-b02c-a06ef08f939e", "value": "3072:lAFWsh8fkY6i3iP+9gK8JYYvk9d5dAl8tFEU84YTh:yssqf/3iPcgrerAl8fEtHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777657839, "uuid": "d844418f-35d2-48ee-851a-acba05c85d65", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777657839, "uuid": "b1b25cad-b5e8-4c00-89ac-9ef490cbc4fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777657839, "uuid": "425e3eb3-4338-413f-8514-babbe34c0daf", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010eefcb-457b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777653002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653002, "uuid": "a6b2c730-70bf-474c-89ab-1f487abe7dbe", "comment": "Malware payload (Mirai)", "value": "b9cdd88e1e8faf8dd5d6e75f6444c1b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653002, "uuid": "2b97d9f9-6983-4371-88c9-dfcaa58c7dbb", "comment": "Malware payload (Mirai)", "value": "fdd1338a2e75ac961c5b9d3e76e3a39a2114437d1adafb440926b2254afa09a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653002, "uuid": "28d540fc-0789-48c6-b95f-daeea5ad00c4", "comment": "Malware payload (Mirai)", "value": "b2e21c1776e0ca60c67e569668b2b6c275a63d64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777653002, "uuid": "a3e2af17-7458-48da-be9e-2858d039e3b4", "comment": "Malware payload (Mirai)", "value": "15bd4180cfa4500576cf596fe9d38345ef3dc5a314ae238ac312639368ee9dc9f71b339892c9b69a9555af4bac490035", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653002, "uuid": "8a44335d-22f7-4888-9e55-c8a3eea06cd1", "value": "T106049F22C9A59ED9C164C574F1B1FE395B93EA4244875FBA1A97CB724043EC8FD083B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653002, "uuid": "96884726-4101-44e6-b380-2e51f06eb3be", "value": "3072:AQFe9WTBk7QKPnee0PIdaVYfH6rsawh07P423W+AwEoNW:AQgMimLQ6rsaLjG+0oNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777653002, "uuid": "1d383cce-ce88-4b5b-be8d-a9b24d5792c2", "value": 178976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777653002, "uuid": "966aad55-61ee-4123-8cef-4e8bdc00f38a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777653002, "uuid": "56dcb5c0-4ca3-4947-af5e-aefa7abb6cbd", "value": "vaxbot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f7cd51-4561-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777641921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641921, "uuid": "9fbd96b5-d68d-4c5b-a938-daad2888e60a", "comment": "Malware payload (NanoCore)", "value": "69c927819cebd59907cfce4c7a512cdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641921, "uuid": "6b2ae525-9130-4a48-953b-b7068a88dcf7", "comment": "Malware payload (NanoCore)", "value": "fe2ef9e59fe7e671001e660bdb13c275c411db1b6f5836e707b022a70dabca96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641921, "uuid": "0b15092b-83f0-446b-8d84-a6729411ebdf", "comment": "Malware payload (NanoCore)", "value": "d53fdda836a1778827b866ce454859b3d34a0fc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777641921, "uuid": "6ee9b0f2-8519-45b0-9663-6d18c2de312f", "comment": "Malware payload (NanoCore)", "value": "f754000de88bf0c72c2a0b398d3b01dfcfac8f50ec626a38cc2d4a1361b65b9cc73a3acace6e6e3d4d2d3ba0856cf271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641921, "uuid": "b99f6e75-aaa5-46bb-9437-a575a203d7ba", "value": "T10B24C0167BA98A2FE2DE8679711252134778C2E7E8C3F3DE28D455B34B227E106071E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641921, "uuid": "7145c00d-52a7-464c-8e96-cf236bb3cfb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641921, "uuid": "a723d2b0-4f15-4c49-a830-1071b3ed0a0b", "value": "3072:PYzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIR8C7cn1rbbuwvjFytz3jxuht:PYLV6Bta6dtJmakIM5Y7GXmzduhD4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777641921, "uuid": "3b7c18ba-e93e-456d-9dac-6cca2d709f60", "value": 218112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777641921, "uuid": "1157f2c5-3002-458a-873c-a1496b972457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777641921, "uuid": "5e4cdbef-9ead-45a1-b5f9-40645e1318b1", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9c0446-4529-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777617992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617992, "uuid": "b7596844-ecd5-440d-bf0f-1318096ce1a6", "comment": "Malware payload", "value": "004f14afc6a70392a4c8a27b6f8c279e", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617992, "uuid": "95606cd1-c9e2-4559-90e2-6514955bc15c", "comment": "Malware payload", "value": "ff552281c0f8fcb5afcf4b727cf26f5304157684f38cc3b16100bee1779db54b", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617992, "uuid": "e70cb56a-0a9b-404a-a848-c8897f28949d", "comment": "Malware payload", "value": "943017c32b3edc53f66cd6f6498561150000aa4c", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777617992, "uuid": "87c521d7-d895-424b-befc-69cb624e229c", "comment": "Malware payload", "value": "a45a9b9e72934070a752003eba13287146a3495e97b082249990c50a9886868157a91246dfac3af765d4bff79cbb97a3", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617992, "uuid": "c8b9e6e3-6d05-42e5-9e41-c6d8bc4e4eaf", "value": "T1A7A5235B76DA20FAD16B84308A510E45A772B8379358ABCF03904AB71E177D48E7DF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617992, "uuid": "d85abf28-f0b4-4af3-b50a-4400a9b27aaa", "value": "69ee4db2c183a8be36217e84a1cfebc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617992, "uuid": "6f91b03b-c635-46be-83d7-7bb5b90ce1a2", "value": "49152:4ZJy5wdZXgxBpZ3LqW8SvZGDz4LyN7k+m1Bb8JlRjeweWIkLT:4P/dqp9H3vZGDz4Ly7hmCRjewnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777617992, "uuid": "37340009-17ce-476a-8d16-452eb135b792", "value": 2095616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777617992, "uuid": "64a7d059-585e-4540-9cc5-fd74276458f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777617992, "uuid": "578e6db3-d827-480e-9559-ec6a6b522120", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }