{ "Event": { "published": true, "date": "2026-08-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-08-02", "timestamp": 1785715382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b66a94f1-825c-401d-9369-df42d6ec67ac", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece0968b-8e14-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785635594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635594, "uuid": "d26910ca-9910-4fef-9a57-792d417b8e59", "comment": "Malware payload", "value": "f91925b4a115c7c91fa23d8d194f44e5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635594, "uuid": "d2f9552e-6c25-4593-a2fa-63bd39eb7dc4", "comment": "Malware payload", "value": "01ee4d3f8cd104975fadd5282d27524e8c7f08335c01200434bb217a3be62917", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635594, "uuid": "6373a228-0396-41e2-afdb-41adbb4a86e2", "comment": "Malware payload", "value": "dd7b4b54a1e56581c227a1f6f0cc531bb9b936db", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635594, "uuid": "e41afb24-611c-409e-a542-969dfc9788e6", "comment": "Malware payload", "value": "e36e1a3ec6300944395a17896efe403e4e8a230998eb0fe83234491dd0c7a0b06335f96adfaba0dd9249b817e6662934", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635594, "uuid": "2303753a-02c0-4302-bbdf-910457d53997", "value": "T1CA01ABCEE164881040DAD91D329B5594FC71C3CB164A4FB9BF6CA43ADB84E14B036FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635594, "uuid": "bae3a57b-d33c-4627-956d-5ccdad4d6fa7", "value": "24:kXCKysE2hi0ziQvZohaCEX3NUyJp58yeE/F/uX:e9Qp+MsCEX3NXJkqN/uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785635594, "uuid": "bc4124bb-ec2a-4c38-80f2-2fa268f1b011", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785635594, "uuid": "eede169b-9f13-4c76-814b-bb45348a1e3a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635594, "uuid": "ba2ad813-da85-4694-90ff-f433c27bffb7", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da580a3-8e4b-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1785658842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658842, "uuid": "3c520c58-6458-4069-be4c-00b7e57b836d", "comment": "Malware payload (SilentNet)", "value": "507381ab117759fd05a7b3fb4356e8e3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658842, "uuid": "597b4cba-73f5-40fe-8b8e-6bba236922c5", "comment": "Malware payload (SilentNet)", "value": "023127e61ea84b5a133a0a640628c3cf883a4eae722f5618a37380db500d284d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658842, "uuid": "af6d2081-505d-4cf0-8932-45b73fd2be9d", "comment": "Malware payload (SilentNet)", "value": "670c16c89825baf0ba8bdd0b6f02c61b81ba439c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658842, "uuid": "a0a530ea-801d-43cd-9646-5a8a0a22c79d", "comment": "Malware payload (SilentNet)", "value": "f59beb7de69c2d16c03a818da5f28d32b275520398462c8f7d5b6ac27d5416618d5201fa033f98b3781de80b7d6857c9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658842, "uuid": "a20edd85-cfab-4b4e-84c8-351de72ff6bc", "value": "T1102733F48795400D56C670B1A738BC58BCBFF9893F8D6D9101948A836E123B73B5AC6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658842, "uuid": "e7e9068c-96c7-4374-bceb-ff8f0896756e", "value": "393216:AfrLO07GzZd/Tw8Ao6BBYrPK2ia5X9HrN7p+ohObX82cBLt2Q8f7Mkfjpt060uKv:Af/OQ6sZBWi2xNHrN7PhO7scFfw6jb5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658842, "uuid": "821aaf81-bf96-49f0-93ec-53401c0445e8", "value": 21181459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658842, "uuid": "25a6abbc-545d-4474-9fab-5deac46f48d5", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658842, "uuid": "1b274849-698a-409e-9f01-b4c98eff498f", "value": "VAPE-CILENT-1.21.11 (3)-injected.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb212ea5-8e70-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785675132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785675132, "uuid": "888966a5-8a9d-4dd3-8664-0b39cf4f6594", "comment": "Malware payload", "value": "cdce5aeedde5310dc77a83de896035f8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785675132, "uuid": "a8a245c7-2857-4dab-94d9-70da22d6d99a", "comment": "Malware payload", "value": "026612e5a888eb7f2a7e28cb3b9a56562feece8ca676f6b4a8f6d33dc14b6cb1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785675132, "uuid": "441ad9cc-4809-43df-8ba0-84c09735a81c", "comment": "Malware payload", "value": "1591f5bed28ed0aab53b8f4f64c840044ce6be19", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785675132, "uuid": "a4cafb6b-fb93-4da1-85e9-df40426f25b5", "comment": "Malware payload", "value": "def04b998cbac17123b8040e6513a3acd19833751d99727920d6ac52cf190d3da0a6eb6c0df033852a7796f5e2d23f8a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785675132, "uuid": "006baa78-df47-450c-8f27-c5929e82bc71", "value": "T138C27D966A867C44BEC94A3E4CBD2B4D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785675132, "uuid": "0e4872a9-f1fa-44be-ae41-9784f0940707", "value": "768:98vCB+25j6es8RY9FYpMSUpi+20qUpi+20YQX:98l25Jud2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785675132, "uuid": "04f982ef-dee3-4f35-8b6a-af0a43164b74", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785675132, "uuid": "8813e6e2-186c-4273-884d-ae294bb25e2f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785675132, "uuid": "f16029d5-cf3b-45fa-a102-8a5ae7e146a4", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90220f52-8ec6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785711889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711889, "uuid": "0b72b561-f24b-42b9-ad46-13e1468a9367", "comment": "Malware payload", "value": "8d1be377fc84754c93e74eb6eb7cd2f3", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711889, "uuid": "398615a4-649a-4e3a-8cad-a157b6a9ac0c", "comment": "Malware payload", "value": "0314e5776227f605417d00977137f1b637ab8b4760ec3b1fb3030d1907854c39", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711889, "uuid": "d965f833-0f3b-4d55-9029-7911b84a2abe", "comment": "Malware payload", "value": "f0d03b9d05d2311d1137f20083e413222043405e", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711889, "uuid": "cc152774-6533-42b5-8c59-0ab8c6b353e9", "comment": "Malware payload", "value": "9664f83e9108a9d9ae66d939c3be59af5894ac6cee8c93ffdf6b4068a1d4b437528fc7c4790411c4f84159647fec1a9e", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711889, "uuid": "7f253082-40c0-46f4-977c-884c1927808c", "value": "T18385238313E08172D4B6537AD8F9425365B0BCA06F62D2CF32E1F6DD1A326D15AB6327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711889, "uuid": "e1317b2c-f13e-4dff-8cc1-27a8cbaf5071", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711889, "uuid": "c1ecc7a5-a36a-48f8-bb21-b573e95ea6fc", "value": "49152:tphAst555bs57g+3bCeNvFkpzwaODPLH:tphAst5Pbs53Owipz/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785711889, "uuid": "474a794a-c3e6-4376-872b-37a722861297", "value": 1716736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785711889, "uuid": "b64b6a37-3bcd-4ce8-a117-d30720644811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711889, "uuid": "04d0ae01-5222-4d8c-943c-a0f45433ed6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b0e503-8e4b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785659176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659176, "uuid": "ae259135-35bd-4bca-893b-818f6a2725c9", "comment": "Malware payload", "value": "5e1b1e64edd3809e1937b9e4d845de7b", "object_relation": "md5", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659176, "uuid": "d9e20d1d-111a-43c8-963c-5deac64f117c", "comment": "Malware payload", "value": "03d3f82e6cfedbc9eff6a65d6c903ef10febc88204175b49fdb5a7f015cedc9a", "object_relation": "sha256", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659176, "uuid": "47d65ca8-c220-4a4c-8d9f-a2ddcd6bf8ab", "comment": "Malware payload", "value": "3b4a79c3e0da0cc88ddbd8830a952b2d37d37789", "object_relation": "sha1", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659176, "uuid": "76664ce3-fdcd-485e-872c-ce1799da2dc4", "comment": "Malware payload", "value": "dcd9b09164fa6b881f4be70df5214d02ab76e9e8f2e39fdfb2d9d7a356003050767a021700c2e67ddcba031e641e76da", "object_relation": "sha3-384", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659176, "uuid": "441753fc-d58f-4f61-92af-7f72b23bab44", "value": "T138312C532B826A4083574069DFA199488A45F13B1DCDEC29FABC11915FE3030A3BCB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659176, "uuid": "9bb9dbbb-e90f-4fe0-8e0c-d72d103a2def", "value": "24:sELu53sPvdw7dhmRPXG2C1ZIvLwgsXuVBOXtm61ht6G0GGcy:sEL28PnRP0ZIvLw7iBK9tsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785659176, "uuid": "89db4027-409f-4804-94b1-fe92cbb2b636", "value": 1641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785659176, "uuid": "3adde407-d09d-4736-a43e-47ed4922d5f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659176, "uuid": "1451ca5f-a7eb-453e-88b1-30997fcc70d0", "value": "03d3f82e6cfedbc9eff6a65d6c903ef10febc88204175b49fdb5a7f015cedc9a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab81d8a4-8e3b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785652235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652235, "uuid": "fb79b99a-c0c5-4abb-b2c5-e4d33cb71206", "comment": "Malware payload (Mirai)", "value": "9c10908b8a70fb34a1df1d6f6a754479", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652235, "uuid": "52ad01e7-c38f-4b2e-8869-20afac2fecd0", "comment": "Malware payload (Mirai)", "value": "05acc2835d011a176fd39f26a59accf2d73ef0365a26c61510d08336f2b8953a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652235, "uuid": "5cd223d5-50cb-4aa2-b4fc-80ba1a772b3f", "comment": "Malware payload (Mirai)", "value": "166cd565ba826da0831c4b17b9cb36ab3da1597f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652235, "uuid": "e8ddede3-f92c-4921-9a04-1697cc6fa33e", "comment": "Malware payload (Mirai)", "value": "8622eebd65bd65fef392e9af69e34198c1e7df56e513f7b5726ca94725f966ccf89fe6a79dba085675e5c480e98007a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652235, "uuid": "cf0e1e16-beba-4962-a783-6dbc4c53f2eb", "value": "T1AD4302C668D73871FB667AF9B3618487305C5E70F5FCE1CB201B80A50FA328597B168A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652235, "uuid": "92ed7acb-eee4-434b-b778-f3d8f0405932", "value": "1536:hIG0lD7Igk0f/thiqsD+UUJXbKi8aS6U3MOLv:hIGmD7xkUTlXbK1atU3VLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785652235, "uuid": "24cf1b01-9731-4bb8-8122-2d63b323f20c", "value": 56288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785652235, "uuid": "0e78cd63-0358-4481-978c-64d7ec1f7f7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652235, "uuid": "e885f15b-63ad-42c1-90a0-776f4d462c2a", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71c9794-8e06-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1785629491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785629491, "uuid": "30b2b3c2-638f-4b5e-9b2f-a999ec0208ff", "comment": "Malware payload (njrat)", "value": "b9fbf6f35099d3dd0f984ffb7e027b35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785629491, "uuid": "d6308223-d703-432a-b3eb-991a7d0ec5e6", "comment": "Malware payload (njrat)", "value": "06185d74edbdc06f99095e96f74aa2e49a1cda2d02a294c11a9ac35a0231075e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785629491, "uuid": "f06a8205-9a23-4442-a3e2-78e0190267e4", "comment": "Malware payload (njrat)", "value": "2f6e93b860cef097c863668b1f38a6f7088bcb77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785629491, "uuid": "f23d658b-d784-4c3a-b7ba-1377dc57fcfb", "comment": "Malware payload (njrat)", "value": "f63fe852aa052ee4e500c0f4ecb2b42822b9649a104c7842a6dd114742abac5db06b6e4fa78d1224e9949ee86b3980c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785629491, "uuid": "07466ef1-acdf-412d-8dc3-d435dbaeaa6e", "value": "T141E4F119F6A650E8E15E4431C7488662FA773D1283D1DA2F42D0F67E6F32650BDE8B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785629491, "uuid": "825f5767-270c-492d-bc62-830729d73f0b", "value": "905d6e2fd95bb9d68bb959ec7e8cfb12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785629491, "uuid": "c072a184-3dae-403f-ab8d-c4fb3dae1820", "value": "12288:uVrlrnZXcHfoFJ3QTQyLEs6cbVDsNh9qzw87/T/xxPEyhLy4ZxUtx8VCpVf688B:inZMHfJTfLL6cZsj9qzw87/Txx/LBktM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785629491, "uuid": "3c17ac26-2391-417d-9bb8-284cd021a9d2", "value": 689448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785629491, "uuid": "6d255b56-6609-4ab4-9cdc-6107df90828e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785629491, "uuid": "4bee258b-4ac3-4177-a69f-2214638b3360", "value": "06185d74edbdc06f99095e96f74aa2e49a1cda2d02a294c11a9ac35a0231075e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31eb9bf0-8e1c-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785638717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785638717, "uuid": "eacd74e5-4894-4493-954e-c9bbaa9348be", "comment": "Malware payload (SalatStealer)", "value": "4b81cbcc057d46aa660722301d59efb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785638717, "uuid": "ec836a2d-7eb5-421a-b0f7-8bfc3256b58b", "comment": "Malware payload (SalatStealer)", "value": "068fa74e4843dd0a7fd1488f262281e9b6b0e19d67eb8d52b20d63fda158fd3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785638717, "uuid": "9768976f-8094-45be-bd66-9fcc4f12ac53", "comment": "Malware payload (SalatStealer)", "value": "96ff9e92dc4d60b8f00d743e0d2614fbff612788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785638717, "uuid": "4f76e5ed-5cb9-4fd3-bffb-67ca25f93bea", "comment": "Malware payload (SalatStealer)", "value": "12f1216902b7d62d86f82a7e8fbac24b98c6ea3e974e1fd62aa846ef58a933a07235d2c4855eab0954cc5d8054cc3e39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785638717, "uuid": "7b4f0f18-3a6e-45b4-b29f-c72c430eaf57", "value": "T16BC6CF03ECA105E9C0A9E23589669653BB717C484B3527D73BA0F7382F76BD0AE79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785638717, "uuid": "fdb0dbbb-2ed2-4fa0-a302-5144110bc89b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785638717, "uuid": "19f8fde6-64f1-4db3-abd2-fc42c0b759e0", "value": "196608:KID6ZjzrBZgrXnbxnV6mrRBVXeVTZy+YYs5V6:KID6ZDBirrtV6mFBVXeVly+Zs5V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785638717, "uuid": "f0bb0ea5-813e-4eb8-80aa-75c1b44885cf", "value": 11588680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785638717, "uuid": "2dcc535e-d7bb-4962-8446-83689401c655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785638717, "uuid": "cf4fd9c0-4786-4e8e-879a-fd546f8e6a16", "value": "Loader 9.0.11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313fb093-8e49-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785658043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658043, "uuid": "fe6a78e2-0f46-4132-8900-a9e8bbae34d0", "comment": "Malware payload (Mirai)", "value": "261d26d29bdfa44ff9c501e79debb715", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658043, "uuid": "63369309-379e-40f7-8916-7ca89cdbf4ea", "comment": "Malware payload (Mirai)", "value": "076a0ce21586446d8ef48b9b42ad5ecd0e616c04de119f013df971e51768d703", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658043, "uuid": "570c8a88-ad8c-42b6-b113-60353c28fd2e", "comment": "Malware payload (Mirai)", "value": "27d5f3103595bb6dc578929f50f1f17706572ffc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658043, "uuid": "a136a10a-4fbe-4b17-a2c4-77b43ab9ecea", "comment": "Malware payload (Mirai)", "value": "8c6e250d1c09944eb7574e8f5305abf7b5fcf2be16c1e4025944e098e627f61aa365573c8a875b433c0a1d77ed205c27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658043, "uuid": "ca14dfba-b067-4390-b8d9-de49baf971b3", "value": "T1D1F2E1DC07162ABFC05580B826E007143D71AFB321D46D9B7195FA5BAF016B33DABCA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658043, "uuid": "06e3a595-5a18-43cb-9928-c2418cf0fd45", "value": "768:b9NyVDHFgevIiCdAHO7YbSnLTyqX1402IJX/tzJgGlzDpbuR1JBZ:7ugeDCd+O8OHyqGmPVJuHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658043, "uuid": "01743c0d-25b8-421f-9c01-1d772469d3b8", "value": 37296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658043, "uuid": "93d9a855-dcbc-4dad-9177-94ae81988d9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658043, "uuid": "8929e2c7-4926-4a66-bd03-31d1a840bf87", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d854aab-8e47-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785657151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657151, "uuid": "b039cd6d-8336-4139-ab68-29154ba71032", "comment": "Malware payload (RemusStealer)", "value": "368f60b8e34fb19caa134fcd7d2079d0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657151, "uuid": "3ae4346e-47df-4b5a-bbc9-fd52bd5815fe", "comment": "Malware payload (RemusStealer)", "value": "077480d961420c8b53b68059ce2493a1318756c7f9b93e2242020740f98afe20", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657151, "uuid": "01042792-2860-4275-885b-a07a94bdb445", "comment": "Malware payload (RemusStealer)", "value": "52ccf3e4ef9c5bf212ad9a083d0df892d1fcd91a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657151, "uuid": "a2f73a75-b9d8-428a-b31d-4f25df44e86c", "comment": "Malware payload (RemusStealer)", "value": "be3edba12bf888b1a354a893719df31e43748f5a09dfef7498f52424e020b1923c075114633dcdd3d8ef6d8b2e17e67e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657151, "uuid": "4af1ddbe-4ae1-424a-89e0-e729e0384df1", "value": "T187F55B23AEA448F9C0D9E73988675126B670B84D4B3133DB2E51BFB52F623D09E71784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657151, "uuid": "e89be3d2-7560-4276-9a10-a7af7f223b1a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657151, "uuid": "32c3e830-22d1-46b7-bed3-b1fe5f7634ad", "value": "49152:7976l8Vff2iEgG3ajqg81Cnin37Nk0P/wmt:743hEnmvP4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785657151, "uuid": "c2b10172-1d89-46bb-bcf9-0382ba91b856", "value": 3563896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785657151, "uuid": "9141f97e-409a-4518-bf89-886a737bc9f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657151, "uuid": "bb1df857-2101-4177-a9f1-043013eb809c", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b24dd4-8e73-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785676167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676167, "uuid": "7faec8df-271d-4d34-a126-7d7209ec2e06", "comment": "Malware payload", "value": "1cd3d12fd3102ed8d46c3ed151fed722", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676167, "uuid": "fee2fcc2-8890-45be-a879-72340dbb9d7a", "comment": "Malware payload", "value": "07c1e3de8f2346a60540a39925e97ba4f9825b74ce249fdfa8ebb69fc3804b43", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676167, "uuid": "5424d27d-f12b-4d77-8cf7-c78776943fcd", "comment": "Malware payload", "value": "f019748d549334ceb302f3f0817a2b0e90b6fb8e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676167, "uuid": "5c62250c-500d-4edf-b7e7-696c885c9adf", "comment": "Malware payload", "value": "aff2a66ff51e99f2f0751a9ec73aadbcae6ac59f0bd1f715580e799101a9db5d22a0ef2aa406ace879fab12501ba9e91", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785676167, "uuid": "7374ef99-2e90-4eb9-b9cb-b3b850f27921", "value": "T1C601CEC6D230A5105029D89E6BAB55E0B821C3C7475B0FB87F9C943DFB98D00F066FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785676167, "uuid": "098fb3f1-d7b1-4cd2-99b9-90aef1a12ee9", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaoC3juXC4xsFHXCUHa01C+rCGDwauD:kXCKysE2hi0ziQvZohaoxXbO3mGvY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785676167, "uuid": "d2098fae-4be2-48cc-906d-2ba0bcd6693d", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785676167, "uuid": "b5de9c08-4d51-4635-afd2-bc2f78615bd1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785676167, "uuid": "bc1fe7f2-5e31-4934-a332-af4585380f12", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723a83cb-8e7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785681345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681345, "uuid": "c73275ed-445d-45a7-b80c-c5afcec4dce9", "comment": "Malware payload (Mirai)", "value": "653561c32a6890ac375dc2d80d2be6f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681345, "uuid": "3c1bf4a0-3661-4885-b256-bd9e270e8a35", "comment": "Malware payload (Mirai)", "value": "090dcce5eaeda80bddf9c6a3dd58da737bdf6bdb904a995eab142c37b32a26d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681345, "uuid": "22135284-001a-44e0-89f9-f71ad95cefcb", "comment": "Malware payload (Mirai)", "value": "873a5e201e59acd39ac6c397453382505fd40187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681345, "uuid": "8bdcb04e-6c0f-4eae-bf81-1e355ea750f1", "comment": "Malware payload (Mirai)", "value": "ccd8f83752d5553db7512a5e61260fd741bfe4c263069ef3c24619c81bb561dbcdb628626d285a7ac071c084d0442b1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681345, "uuid": "3186270a-b03f-43de-957e-89cb9595d813", "value": "T1AA830220E6E1D212CB30687FD63EC3C269705BF5C6B56A4B87D8DB88D5D9440BF2681B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681345, "uuid": "32ac2f22-c894-4532-99a8-5733629e9651", "value": "1536:IEQTAzwGnbUUFjJzfNeJh0TRsrZLajJ+pnO0:IELNHF7N+h0TOFLyJ+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785681345, "uuid": "24875d28-5fa6-43a2-92c4-e9314afd79dd", "value": 82544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785681345, "uuid": "0623b3c7-1271-48fd-85d8-2b87ac15b7e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681345, "uuid": "303c5e81-68ed-4515-89f6-0c243f925b5f", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8ff755-8e11-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785634277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634277, "uuid": "d181fa56-aa9e-4e1d-91e0-4d8b6b0f89df", "comment": "Malware payload", "value": "0867673d1f227dee386a8078edfcab04", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634277, "uuid": "da61fb58-a754-40c2-bdb6-428db3cc9da4", "comment": "Malware payload", "value": "0976602bea0da4814b69d1985b4fb488ecca41574d037dd64a6f55ba65c0b69b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634277, "uuid": "6e82a241-2a4d-41d6-9c1e-f1cdf5abcbc8", "comment": "Malware payload", "value": "a6308d725c0f4c10a6614cd2b6b20b83e4494c5a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634277, "uuid": "62b6df13-73ce-45c3-ada8-51155d18a5e1", "comment": "Malware payload", "value": "9b644a076cc9fccfd72e6ba956c7b6781533f39b6839471a0ecee66bfd6c507228deca6c0be766411908f15f31e5be25", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634277, "uuid": "2e1be1a5-217c-4dbf-a70e-ad4bcbcaed8d", "value": "T1CC237D552A857C14AA98C4371D7E2F0CB9AD43E6320452ED7FCF3CF68C4A69DA11871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634277, "uuid": "24ca1668-091a-4393-a27b-1376069b25b9", "value": "768:XXOGVv59GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:nLKcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785634277, "uuid": "9fce7341-87fa-4a6e-bd23-a420586ff560", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785634277, "uuid": "f5e39dd2-a42a-4152-a7fa-5d50364a0af1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634277, "uuid": "2458ead7-f616-48b8-ae18-a27da9d1b37d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a73b80-8e14-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785635252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635252, "uuid": "bdbaae35-80f8-47b1-8e3e-290db291ab5c", "comment": "Malware payload (Mirai)", "value": "fd30b15425790cf19291d8f703c49d28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635252, "uuid": "c2a6c3b1-f4ae-46d4-bb45-c0f5f1c65300", "comment": "Malware payload (Mirai)", "value": "09a0d0b2a3b5f7af9990075bb8ddf974b9233d8b94883f63f9660642753bd667", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635252, "uuid": "dbb2ce47-615c-4f0c-a2cc-9782a8b71fe5", "comment": "Malware payload (Mirai)", "value": "eccc162ea9f37cc00d03bc31901e9f3c02cc4c8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635252, "uuid": "7134c5d4-9d97-420d-9f11-3f08fce5b4a2", "comment": "Malware payload (Mirai)", "value": "cd8246efca720287f30edb52941b63672ac14d0af7df9e564920befb70b34bd4f879dfc866ab7b4074eb39ebbe19c8b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635252, "uuid": "14f420c1-e926-4b95-a081-d2895d05124f", "value": "T1002302778EB60362D0275138DE7DF28F0455118A60E2D4A7F29C723D499B7D522B0EE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635252, "uuid": "1905d6c6-8ef1-40fb-885b-cffc16664c26", "value": "768:LHcV4XqzbovGBNotOenQOuMX7tNy3wASxWIFnLsjkvCz2/jHE1X1X8YM+/SqovMn:0qqzbovGBN6bQ87tNZfxWIdpqzqjk1XD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785635252, "uuid": "b91845eb-0c58-42e7-9383-45266d919bf9", "value": 48012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785635252, "uuid": "02fbd698-1881-435b-860a-7627809f6cd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635252, "uuid": "1952c08d-5bec-46c1-98a7-7ba94832a340", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed823d9-8e69-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785671890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785671890, "uuid": "570314a8-2b35-4634-baa7-52bcff2821b1", "comment": "Malware payload (Mirai)", "value": "a9ece8aecd93c3fb125d6fe83bc17be8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785671890, "uuid": "a74a6d75-ccc2-406d-9f26-85cfe1d57349", "comment": "Malware payload (Mirai)", "value": "0a47d48907b08fdc0e946983ec981e348468e187ba576152a10d27c418559310", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785671890, "uuid": "d797d750-9d9a-4785-ab54-c004bd0882cf", "comment": "Malware payload (Mirai)", "value": "dde6135961b1abeedc9117a0f2932cfd42bec516", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785671890, "uuid": "5cf33c2a-dbd6-4a47-9bb1-50f3a2f274ad", "comment": "Malware payload (Mirai)", "value": "5ef6e48a3c247a5841620119e8f6ad148955d97f0af653dcaf45659b9f85fcd9efce1db2f51a708cbfb382ce0a31fdf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785671890, "uuid": "fddfa071-0aa7-4bc0-a5fd-7eca8f6ce50e", "value": "T14903F26781E78ED691626D32E88D894133CF0FB183F8777B1095367E38C6D876AD2609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785671890, "uuid": "8bf7ee79-bab7-4d34-b013-a698524efbfc", "value": "768:rLNER5y2XIBPhsLFzWjCMLfTzNUunx+plfBVBHjXhbd9q3UEL84:rBER+PaLFz+TpU6+lZjDXhELV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785671890, "uuid": "ff3f32cc-04bd-4b1c-8422-a800bba1c6e1", "value": 38164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785671890, "uuid": "5980133e-ff0b-489e-9d30-ea64bb9399f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785671890, "uuid": "9a413d13-b5a0-42cb-9fdd-b234ec1e13b5", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f064be4a-8ec5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785711621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711621, "uuid": "99b0752a-f0af-4e77-99b5-2c7666897f6b", "comment": "Malware payload", "value": "f3a3c44d80e98b8abaeaa40bf04441b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711621, "uuid": "daafe1f7-96ec-44d2-b3a2-a1f02a599df3", "comment": "Malware payload", "value": "0bbee3979b0327b6c327c4522414a90d18164af3846ea6a8e62e5fee861f6d51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711621, "uuid": "e8d29358-1989-481a-a7e2-539210001119", "comment": "Malware payload", "value": "a6a3a0793241779fbc6e54974473256a63802ea5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711621, "uuid": "5252ecb1-6d9f-4324-9e35-29635709d7bc", "comment": "Malware payload", "value": "3739bafcb45f0553c2b7f58474e74aa32c0e919241cc917ab6258122fbbb8b826545a043b11cfe05b1b0292992d9eae6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711621, "uuid": "20959111-2900-4a92-a244-1513213b397c", "value": "T19AD68C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711621, "uuid": "0217d772-0442-4e87-9dbc-a22a214984cb", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQz:cqYUQuVDt0TZEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785711621, "uuid": "b0d302c5-d060-4da1-933a-052e8c18f40e", "value": 13598720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785711621, "uuid": "f1b5fca4-fbda-4116-b11c-a70d8fc73832", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711621, "uuid": "5073f738-a844-4c16-a152-0d7388df7567", "value": "0bbee3979b0327b6c327c4522414a90d18164af3846ea6a8e62e5fee861f6d51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e45183-8e49-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785658297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658297, "uuid": "39eac32d-5252-4a38-90a1-1873b74cb82b", "comment": "Malware payload (Prometei)", "value": "07bb3a02acad6ff666e684ded30cbb5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658297, "uuid": "d87884f2-f9ad-4e9a-ab5e-aac8b06f7687", "comment": "Malware payload (Prometei)", "value": "0dddc24e76e95c090cbff9e88fcb75a8f5f73e4f40599f245a0c218ae5ec376d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658297, "uuid": "0722ca64-facf-470b-a117-76325895acb4", "comment": "Malware payload (Prometei)", "value": "3e7006504eb3ebfac5449c0d4ddbd55a3aec0591", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658297, "uuid": "3f55cd56-0f7e-40d1-9301-84eae41ad50e", "comment": "Malware payload (Prometei)", "value": "cb83df6399b9066d0decd97d80638d5b3cbb366d368c61429259467c8276ca2b76644ac30f2cac4b58008d67f65cef67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658297, "uuid": "07cc9bc2-5f36-459f-879a-2605d98a96a2", "value": "T1E5A423B4F9219E9F6DD769B91B24C31DE182C172589D4C2313AE94A34F3D732AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658297, "uuid": "a8fbddb8-d0c0-40aa-9d30-a3f5baccd44e", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdA:Fs6pyCC/Ya2hpi6T6N4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658297, "uuid": "ca8da33c-3fef-49ac-b592-343587b4b0f9", "value": 449088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658297, "uuid": "221730f2-88b6-4cd4-a044-e34c479d6202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658297, "uuid": "05694c47-1b8e-4501-ab25-654beebeb5f4", "value": "0dddc24e76e95c090cbff9e88fcb75a8f5f73e4f40599f245a0c218ae5ec376d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc5883c-8e2f-11f1-bd95-42010a9c0009", "comment": "Malware payload (SheetRAT)", "timestamp": 1785646922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646922, "uuid": "9152e33e-33dc-4271-bfb9-5d124a5f1353", "comment": "Malware payload (SheetRAT)", "value": "24dc5145757e9f438e801518bc74c0c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646922, "uuid": "b321bd1d-546d-4cdf-82b0-ab51e7158fac", "comment": "Malware payload (SheetRAT)", "value": "0ffec6082c9540ac473d603f278168458f574ac9018ba5ed9b7b1e7ec1539133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646922, "uuid": "1035af74-1f19-4185-9896-a815251a9ceb", "comment": "Malware payload (SheetRAT)", "value": "c6c0210e1e5828aef772a030ce9a4e93f31c1848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646922, "uuid": "d828e1a1-4f63-4714-a4f2-5a25dceeeb45", "comment": "Malware payload (SheetRAT)", "value": "6678199dd0f27fd576bb7b52b92f5b128445e8bb9cc5b2c5e395e4950a883907d1feeea8388ccfaf40b74c720cec6d49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646922, "uuid": "289ab319-10ab-40bf-8c32-41c0353f0656", "value": "T136E42742BEDC4BF9D7BE053844725714E77AB8114A22EFCB468844E91EF2FC29D24B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646922, "uuid": "a86213f1-ca97-4e80-969f-d3ccfa9bd99f", "value": "6144:X/KhnAGs9wz4ZoeETEW1gbpJA3KpSL0pDyyiblGbD2C:X/KhAGs9ULePJA3KY0pSblS2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785646922, "uuid": "8c35cbc5-a8cd-42a8-adac-6b5ff6acabc6", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785646922, "uuid": "206cb3d7-87ba-4bc5-b250-3281c3d37663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646922, "uuid": "c5283cbb-090b-4e4e-a2a9-b2f9c2b0c152", "value": "VoiceMod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665d3732-8e8d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785687338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785687338, "uuid": "f0b213a7-9667-4eb1-9d0b-afc585983844", "comment": "Malware payload", "value": "b88d6f11743274a7e6051fe6310fe174", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785687338, "uuid": "8803a82f-2047-45fa-b0f6-dad5f5d254d5", "comment": "Malware payload", "value": "1154c0cc005fb9de3acfa67e89da2e099908784876814c0fd4b8b28173a7cbe0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785687338, "uuid": "1af37949-9489-4896-a80f-639740484ec7", "comment": "Malware payload", "value": "0a877c77808e5ec5bd826fde499935e67bf05d3f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785687338, "uuid": "bfcb821f-a592-41e2-abd4-c14d134adf48", "comment": "Malware payload", "value": "a10d4cb71ae16367bb3f6af7c400c4e467043823a43fa968215c752dccd536e3ad71b284abc8ecc229a534b9e92d82a4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785687338, "uuid": "75d2a4f1-b2d7-4ca7-aada-cc90bd4c835c", "value": "T1AD236C6516857C14AE99C4365C7F2F0CBDAD43E6314492EE7FCA3CF28C4A6AD920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785687338, "uuid": "ae5a7367-766b-4a04-80a5-1ca8204bd46b", "value": "768:Kr9NyXsZztCX9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:0HusZ1cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785687338, "uuid": "3ff54180-2bd4-4ebc-89d9-3351fd611c6e", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785687338, "uuid": "184fbbdb-755c-4284-a513-73f9f9139eee", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785687338, "uuid": "6f9d8eed-778c-42e3-997d-fc8eeb7062ce", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5e107f-8e59-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785665066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785665066, "uuid": "c7208df3-d477-43bb-83a9-97f514f80034", "comment": "Malware payload (Mirai)", "value": "26655d6071cca71b169fe4bc5dbbb17a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785665066, "uuid": "9531cf06-0deb-47b3-a884-67dd8b2405ce", "comment": "Malware payload (Mirai)", "value": "11bd0fb5a8a00f4908e32d16772401dfa2ad8f1cac9e7106268517ae5bde57a2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785665066, "uuid": "94b1e1a9-c429-4e1f-8ab9-4ad1b10bacbd", "comment": "Malware payload (Mirai)", "value": "144f319045a2a1728de7ed4b623a5c3f670a06f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785665066, "uuid": "57192cc1-0190-4b49-bed5-737de70ad6cd", "comment": "Malware payload (Mirai)", "value": "2cbe529009587a05ef178dd0d7f83287af7ac3af43be93cb2fa7e42f320847cf26b744f28c9ad002a95a07c97c030ece", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785665066, "uuid": "38663e8a-525c-4444-b8c6-7b9a73be482c", "value": "T1EE315EED6020915316C9DE22B3B249ADA017AEEE34E88EFBFC655C325C88740F139B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785665066, "uuid": "e99059cd-cfe2-4e4e-88ed-7db75a35ebba", "value": "48:TxoDJAbnrPfJ1Vws0Dl3h81dV1RnIDzF1iecFFY1vexPS+p:TxoDJAbnrPfJ1Cs0Dl3h8rnBIDzF1GF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785665066, "uuid": "ae672b9f-9d18-41b6-9240-7d3ae9b162c2", "value": 1580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785665066, "uuid": "73f7b0ca-2dc9-410e-8252-d85abc1f7d03", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785665066, "uuid": "f9c8509e-92aa-4222-9cf5-4e0c0497fb5a", "value": "payloads.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824fce74-8e54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785662903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662903, "uuid": "be395664-8c8d-4154-a940-b9bee8889699", "comment": "Malware payload (Mirai)", "value": "d04872b265ae67c1d66dc01ad32301af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662903, "uuid": "247d58c7-94c8-44d7-875a-288bfaa14fb4", "comment": "Malware payload (Mirai)", "value": "13a0764c31991c4e1a5ba79e5d2095b33f11df5f5d78232a48e9463a1b7be2d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662903, "uuid": "e7568deb-e784-4cd7-bab9-13e1f0067fb5", "comment": "Malware payload (Mirai)", "value": "96baef16656940d05cf47beba43577d6b6ba1d07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662903, "uuid": "0a03bbd0-306a-4e2d-9f75-764ef08657d0", "comment": "Malware payload (Mirai)", "value": "ba0b772cecc57579b1a5173503b8fc0efb71a490ad563674cef360e10a90efaac90fc94e9ea972cc9e543f37c3c4b43d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662903, "uuid": "6cc2b7d6-f685-4703-a90c-e26960a36783", "value": "T150A3B71E6E629FACF2A9C23487F74A30965C23D127E1C5C4D1ACD5002E3835E995F7AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662903, "uuid": "55986fee-10e5-4afe-a13c-cfd2800533ca", "value": "1536:oVraajlBcYkmGlOPq4RCS/hOIMLWsF3jyJ2hwOHSDT90ZNtbBpvJUTulyH:yr7XGlOPpAIWvF2J2FyDuZNtb3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785662903, "uuid": "9869b16a-cb54-491b-8a16-055d12ae1899", "value": 98960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785662903, "uuid": "6b8b6c9e-e0e9-4c10-a2ef-1ff935fc5161", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662903, "uuid": "2d41dd6f-3617-4109-a849-a390016d06da", "value": "mYH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a274a0b-8e80-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785681734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681734, "uuid": "2d4cd254-bc79-45d8-aac1-42ca42992528", "comment": "Malware payload (ConnectWise)", "value": "130176db1b368a8290ebda3ce17db7c8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681734, "uuid": "cc498375-2a9b-4a89-a270-77143141c5c5", "comment": "Malware payload (ConnectWise)", "value": "13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681734, "uuid": "d10a727f-a87f-492c-b1b4-7fbb4fe1e888", "comment": "Malware payload (ConnectWise)", "value": "5c1ffa4074937594b8fddd76720d7943f4f5ad55", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681734, "uuid": "57123acc-0634-46cf-a8c3-1bbc1432bc5c", "comment": "Malware payload (ConnectWise)", "value": "7470fa13df3e51a0e9fc2d5e5c5f899b5cded2a8853dd90b0de17595d4d1db8d0171ee14d255f5ff15cdedfa124e80cf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681734, "uuid": "89d62715-3fb9-4d8f-a67d-f8897367f9c9", "value": "T1C683E58235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681734, "uuid": "ad4dad24-c97d-451d-8768-d609b10387e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681734, "uuid": "91a1a8c7-7539-4737-a5a9-4acec2d41c90", "value": "1536:Mtypl44jzbHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Ky7ynD:3rfukLdOyWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785681734, "uuid": "870acfe4-3256-4c13-ba50-12b01e2ab4d1", "value": 81688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785681734, "uuid": "1b6e483d-0ccb-4fb7-a4f4-fd0e5a9ae2d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681734, "uuid": "53593108-1c0d-4b17-9bea-e4dacc15da8b", "value": "SecuriteInfo.com.TScope.Trojan.MSIL.31304.12035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b7d427-8e7d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Seduploader)", "timestamp": 1785680413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680413, "uuid": "e81c61f7-678b-408a-93ee-bdb475898c75", "comment": "Malware payload (Seduploader)", "value": "1f2972abda045d02a5c7266180dbcc30", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "not-Seduploader", "colour": "#C08E23", "exportable": true, "hide_tag": false }, { "name": "updateflowch-com", "colour": "#44D08E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680413, "uuid": "f9dea9a8-120a-4a47-9c61-74455aed036f", "comment": "Malware payload (Seduploader)", "value": "16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "not-Seduploader", "colour": "#C08E23", "exportable": true, "hide_tag": false }, { "name": "updateflowch-com", "colour": "#44D08E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680413, "uuid": "f2d69af4-d8c4-45bf-9d48-4e8317a6627f", "comment": "Malware payload (Seduploader)", "value": "078dd51ea09a9d7e841c00378eeb1fb2226b5ffa", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "not-Seduploader", "colour": "#C08E23", "exportable": true, "hide_tag": false }, { "name": "updateflowch-com", "colour": "#44D08E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680413, "uuid": "aae0125e-c96f-4288-aa5e-e6962ab71448", "comment": "Malware payload (Seduploader)", "value": "948ac15dc995b200faeedd62f22cd8c0f73987052b969a968d9ca97b64bb70f4a598f842782bc35c073dbce177500f92", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "not-Seduploader", "colour": "#C08E23", "exportable": true, "hide_tag": false }, { "name": "updateflowch-com", "colour": "#44D08E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680413, "uuid": "ea9c62fe-25a0-4a0d-abd5-aff217e3d7f9", "value": "T1216633E3D5782522F32756F488376A8994104D0443F39AE76699F8AD1EFA26CEC704CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680413, "uuid": "dcdcd684-c43a-456d-ad86-79b4182b9ae2", "value": "196608:bdz/6ety7BYWr27nWfwx9qO7EkJPAWqpq3n7nT:pz/65F2LgOXqbpqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785680413, "uuid": "135d5bc7-6b7a-4daa-8c4f-9b09ed3b6906", "value": 7024640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785680413, "uuid": "cddc75c8-876f-4cb2-a3b3-bd07840b75c3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680413, "uuid": "f4a18f09-0a05-46b3-a780-5da296d86517", "value": "PQLGBHSD.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a10b8ab-8e30-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1785647347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785647347, "uuid": "762934b2-e029-4f02-a457-c1c53040684b", "comment": "Malware payload (SilentNet)", "value": "36a74261325516f07331ce6eb5db3c33", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785647347, "uuid": "32ff938c-e0ad-4b92-a2f3-072ebe17e26c", "comment": "Malware payload (SilentNet)", "value": "16e153644094fbba7ec924680c2f8cb203604bee06f3a77cbddb803c147af121", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785647347, "uuid": "14be47b1-3d44-4d3f-bc60-4798bff9d8be", "comment": "Malware payload (SilentNet)", "value": "4b5b967a4dc6e2b3c1f1e33822c5b597814fe9d1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785647347, "uuid": "08ece851-aba1-4e07-a821-fc75979b9eb7", "comment": "Malware payload (SilentNet)", "value": "2a244e036c43e5080c42a2aef5a314a58ddaefa958971d59e0c2f7b01e667bf8d417d25641e0d3cb44f6865be453a269", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785647347, "uuid": "5a2f05ca-8739-4f2c-a191-b3b0b6eea967", "value": "T10C9312E5F805EE04E4159EB2C58B5797F1488967B1E6B0C7542E008B3FE188BBF146FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785647347, "uuid": "7a8f4783-9b20-467b-b88f-60eefdeae6f1", "value": "1536:IwABuAtvWci1n3d2oH4nNq8tVoRj4v7FqAtd/VpIC/XUgGp1Z+l5avN2rR:IHuAtGen9wREv7MOdpI+XqWl5aVyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785647347, "uuid": "8c2f9f71-0df9-4121-8541-4210ec7f5c1d", "value": 89101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785647347, "uuid": "5a65bb45-275b-48a7-ac2a-d225d3effa80", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785647347, "uuid": "54a05a89-edef-44ee-aa00-b25a6b15fe8b", "value": "vape v4 crack.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ce230a-8eb2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785703230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785703230, "uuid": "b1421966-4cda-46e1-83ae-f3ba81cdf235", "comment": "Malware payload (Mirai)", "value": "4af09feda9882d137c97d6705bc718d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785703230, "uuid": "c785c455-d758-4322-ba9c-96b95023732f", "comment": "Malware payload (Mirai)", "value": "1756d6f4348931af8d3029384ccee8d7281673a627ca753d7c3ea3e7881356d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785703230, "uuid": "7115dc4e-3ab5-4e62-b359-21f21ec9f74d", "comment": "Malware payload (Mirai)", "value": "d275fde856caf6965a6103ab7bb626b4e08ddb16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785703230, "uuid": "4c3f76ba-3995-4fd3-917c-cf59a03b12b6", "comment": "Malware payload (Mirai)", "value": "8fe841626a91fdb3a5ddd29ef0a0c2779d055be58e11cf4ae87b8da5f19949d034a74cbcd1de65feb437aec7a99db9bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785703230, "uuid": "a5d25099-05ca-45ab-aab7-894afaf296ae", "value": "T12A337B82EE83E1F1F58341311056D7ABAB34ED350010DAABF7553E31FCB5A02869AB1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785703230, "uuid": "376cc35b-6147-4c02-8392-f4c6aa198baf", "value": "1536:bcjItMqvZLDWtw9cp650lF8C1lgam4KcmZXVNE4IdoordB:bciMmDWtws6ylFd1Oam4oRXE4GBdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785703230, "uuid": "d44e7481-94ca-4362-b929-e930e3efd300", "value": 54276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785703230, "uuid": "ae1b60a1-20b2-4f40-907f-dfc0c5409127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785703230, "uuid": "357e04b5-962b-4fce-9860-7aeb5ac66d66", "value": "cekizsafu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b360b0-8e4b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785659200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659200, "uuid": "d31ee128-440c-454d-8ac9-da1d28d65b72", "comment": "Malware payload", "value": "132ea19d05ea1a3b4eac99be121da5c0", "object_relation": "md5", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659200, "uuid": "8d6db098-b695-4333-bdb7-364ca287f50e", "comment": "Malware payload", "value": "19056def396417054344b132f421eee153e0c4adb62259d96b54387edc515110", "object_relation": "sha256", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659200, "uuid": "bff11e11-1677-4fac-bd3c-92830f1c213c", "comment": "Malware payload", "value": "88c895419012a13aeca0ac42680b1ec788bd037d", "object_relation": "sha1", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659200, "uuid": "99febb49-dd0a-4012-9257-6b6eaab4b793", "comment": "Malware payload", "value": "2d5305dff442f1e796e31b240647f6e3f05aaa0d847093caadd0ddcf3d9c6c1247f16dafcbf77e6cfbdba00f3ed20a19", "object_relation": "sha3-384", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659200, "uuid": "6e3b2410-1e4e-4e94-a1c8-eca698cb0298", "value": "T1A0D5C73E1CBE123B51A4C6AACFC58827F444E1BB31222D36A4D797998747D8369C317E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659200, "uuid": "5ccae12c-77da-4168-87c0-b8c0f39ba310", "value": "3072:u01y6B3G/hVgHT4sangTAR9uNqMfoJiuLu6bglEJ390S1wcIdVvj8boggbhZSe7d:umy6AVgss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785659200, "uuid": "684340bd-1cca-4737-b517-f2d1ea34d954", "value": 2954752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785659200, "uuid": "61fd790d-b047-452a-a9bf-bc3bbef64d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659200, "uuid": "61ab5609-aaf5-4214-80d6-70293cabd612", "value": "19056def396417054344b132f421eee153e0c4adb62259d96b54387edc515110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab09f3c-8e45-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785656475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785656475, "uuid": "af725be5-fdc0-43a6-a9eb-26c9f7d518f6", "comment": "Malware payload", "value": "44c6bb86ff4ae521019aecb4fc796844", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785656475, "uuid": "1f9b8119-7d44-43da-adcb-84217d15992a", "comment": "Malware payload", "value": "1b9cc917a0939f820484da167ecf80dcc1bf8d13e8f70144d9800800d48504a5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785656475, "uuid": "d60564f4-f866-43ac-b4bb-63e42f84c19d", "comment": "Malware payload", "value": "a666d9542379c0825af7cf7fa3445210758d5bcf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785656475, "uuid": "f6d2a88b-0871-4861-8f4b-8a4dd5815b2f", "comment": "Malware payload", "value": "643dbb2c170914a37c61a72c82c30ddbe326154810752951d5d82915e2b68bd0a65a2ed9e66cae47c625bba22634d470", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785656475, "uuid": "bbb92fa6-cf56-4ab2-854f-e9d717113c5a", "value": "T102C27D956A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C12FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785656475, "uuid": "e24779b3-7ee1-4179-a8fd-c00740418469", "value": "768:sY8vCB+25j6es8Rv9FYpMSUpi+20qUpi+20YQX:sY8l25J5d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785656475, "uuid": "3760e956-420e-4b29-b644-4a48f9404948", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785656475, "uuid": "981c66ae-6376-4834-93c4-c58b515f4867", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785656475, "uuid": "30c4d0c2-5b81-4dc5-a076-ea2a8a90a3d7", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a43ae7-8e11-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785634111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634111, "uuid": "a6cee182-fb07-4243-9cc4-0f761c412d70", "comment": "Malware payload", "value": "b43751c96113fdf46282a1bf5b758467", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634111, "uuid": "23eb2756-4fc1-4b34-9415-aa7a740ca7fc", "comment": "Malware payload", "value": "1bf6ad02a9a9417479c27e67072b6aa54571709e7ef0b9304dfb92bddd1f109f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634111, "uuid": "1677bef9-cc56-4cef-9b08-8020775bff44", "comment": "Malware payload", "value": "fd93f755b2a458feb0410a913f83958123c46370", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634111, "uuid": "ef370dea-e055-4371-8a4e-59aa6b0f9837", "comment": "Malware payload", "value": "e1bb4d3b7a5b894464da28a280bc7f519bd05a67351e8236c2eab164898375cd4a5e02a018a3e64c2bef1abc99c3b980", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634111, "uuid": "e12d339a-4549-4353-b048-181a9ab15cb2", "value": "T139C28D956A867C44BDC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC12FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634111, "uuid": "a9b0f702-4049-4340-8cfa-c92aee485ac6", "value": "768:O8vCB+25j6es8RDZ9FYpMSUpi+20qUpi+20YQX:O8l25JD/d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785634111, "uuid": "bd820a2f-c0c0-4581-a873-cb7a5a81d682", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785634111, "uuid": "d42daac8-2f8d-42ec-b2bb-ce30b48af8b1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634111, "uuid": "abe1e225-e007-44b2-9801-b9576233a8cc", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c82f677-8e7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (CNBackdoor)", "timestamp": 1785679161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679161, "uuid": "93eabe98-8658-4936-bcf9-088c37769e7f", "comment": "Malware payload (CNBackdoor)", "value": "18b77efc3df7f3bb6a679bc1992f8e22", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679161, "uuid": "ff07cebe-2545-4796-8f81-fe696e1f3d23", "comment": "Malware payload (CNBackdoor)", "value": "1d5d0dfa7d49213f59f48704305762a936492c57026336a0ff56eafdf5710a48", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679161, "uuid": "cf253f28-e263-4e59-aa8f-d33e6dd25828", "comment": "Malware payload (CNBackdoor)", "value": "2dd37623bf004afd71de115107557c58c250fb43", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679161, "uuid": "915cb5fe-6773-4324-91f8-c8bf32d25a60", "comment": "Malware payload (CNBackdoor)", "value": "30c36a15999c4f41b0fbafc3103fecdbfcf26a028817e33c0ab7aeef73fbea9fee2a4d94e184f7151e296857ce79fe2f", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679161, "uuid": "753931df-23e4-4370-8c60-83cfa35733b3", "value": "T10C17331CA8BE884AD59C37B04A02D059D70E5F3B980B0C6F6BDB663DD41E4538E78B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679161, "uuid": "785e649b-e2b0-451a-bf61-ca31afb48afe", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679161, "uuid": "e5bcce22-c0af-4acd-b896-3efd57e0fe7c", "value": "393216:bdD4BJwgJfJAQeqKZhSMOZUa+8CGpaahVnTIZRnyxnubo:2LBk1qshIjppVanYnub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785679161, "uuid": "856ab118-461f-4039-a0df-8836454b01fc", "value": 18963456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785679161, "uuid": "babbf77d-021a-488f-825f-3daa031afb11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679161, "uuid": "aca51aef-6dca-4a3d-9c17-3eea65486b2e", "value": "Installer_v3500_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed85a90-8eab-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785700452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700452, "uuid": "09a45208-2af1-43ea-9faf-3be4517f6c37", "comment": "Malware payload", "value": "5348d5b511198874aaf019dcbb8e6a8a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700452, "uuid": "328cb68b-bfb8-4b2c-81eb-c32fc4217265", "comment": "Malware payload", "value": "1f9fa9f15dd3b67c9af0a0af8377fd65ee6fe838ce55c5eb9fc26565449d9ae4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700452, "uuid": "b2344732-7d0d-44b2-97db-5768972d1443", "comment": "Malware payload", "value": "79914831791a91c13b7989bd066ed5fe1b433d8f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700452, "uuid": "3feedd0a-25ed-45ad-88b5-3d332cb67863", "comment": "Malware payload", "value": "ed033b51e239d88313ca2f0450279ec4c7b31b9ea23bcda6dc7b6d6d3e8de2e55ff8c5f651dcd47c12c3b6c6bd9d0cbb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785700452, "uuid": "a696439c-7dd2-48b4-9942-390e40c6ba61", "value": "T19BC27D956A967C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785700452, "uuid": "9af33f10-fd3a-4a80-b6a2-7e3d8c3665bc", "value": "768:78vCB+25j6es8R+9FYpMSUpi+20qUpi+20YQX:78l25JYd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785700452, "uuid": "e3bd410f-41c5-46d6-a614-d443e7fa0f62", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785700452, "uuid": "794f11cd-e6b1-46cd-8e3e-9f9d16984ebc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785700452, "uuid": "399d8f2e-0d5b-4f09-9040-92f157ab60df", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105508c1-8e28-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785643814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785643814, "uuid": "5fc6ddc6-b01a-46d5-8636-b9dd406dedd0", "comment": "Malware payload", "value": "9dc76113759ad1c4db2df3f9bd3b6b18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785643814, "uuid": "17c8243f-af25-4166-9fc0-51e9c9f917ff", "comment": "Malware payload", "value": "1fda8f1674b9689dcbd949babb7d767d13a636e639cd4bea17aeb0efecd1882d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785643814, "uuid": "2eca0cac-c02b-44b6-980e-f005e77fe3a4", "comment": "Malware payload", "value": "895b3f2603dcdb5436d061d93ac1ae189a74f3fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785643814, "uuid": "8dd057a3-5c2d-4672-9286-1b677b64d36f", "comment": "Malware payload", "value": "7a68d64ea172b911b5d6411a1e88f660679a824e8ea64794535bc05bdbf7984792efaa6181d2b8db3e4d3cbdffe14c48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785643814, "uuid": "e4a02e56-70d2-4b6c-a70c-b3c30ffc38fb", "value": "T146286C43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785643814, "uuid": "17cce781-6dba-4124-b82b-39fcc86a9ae3", "value": "fd6f6d07cc33ee9a2b65bda58a07bb94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785643814, "uuid": "59039d51-7416-4cae-bca9-cf022a591c4f", "value": "1572864:9Za7hmguP2nG0/Vyv7UhgxIabc/x7Awby:9Za7hmguP2nUOnAwby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785643814, "uuid": "36e284d9-03a0-48e8-91ab-26667cb7fa60", "value": 97862656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785643814, "uuid": "540b02b4-b528-4a29-9071-a1f6ac6c5e33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785643814, "uuid": "4eb9cb7f-1c8b-4a8d-8ea2-8cdbec25763e", "value": "Rockstar-Games-Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676d3f95-8ea5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785697648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785697648, "uuid": "9afc2fa6-1077-4ec8-95a8-47ad2425a8f7", "comment": "Malware payload (Mirai)", "value": "29851c443170c66e15d3daadba0140ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785697648, "uuid": "da268797-a7a5-4d77-9860-ffcb63f3beb6", "comment": "Malware payload (Mirai)", "value": "2093072334c5b85464a0b733ea4f6abe35d074db34304e0d3b5d18132b09ba22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785697648, "uuid": "aad4a29a-b7fa-43b3-85c1-236e0f6378c3", "comment": "Malware payload (Mirai)", "value": "2ce8222a021420bb598fd9bfd47839f90a0fed23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785697648, "uuid": "e5969d95-f9e8-420a-857d-11a6cbdb3d35", "comment": "Malware payload (Mirai)", "value": "0dcb627362ceb25040a2c171caf0f6ea4f7a565c8e0c9833f81f779622353de246d2c55ae028ef4127b8ad770f968fff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785697648, "uuid": "c408515e-3014-4921-9d20-02d2961c184e", "value": "T16BE45D06EF440FEBC8AFCD30856E425B14ED998712C1AB74A1FC499CB69D7994FE3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785697648, "uuid": "dda1de58-5e6b-4038-92bc-f7cc7a996fe3", "value": "12288:5AWy6uJu23rf3jB/AB7uNRJic7mqNhZlJ88yC3pqo29LewwN1oatIwUwjcs/VQo0:58HhS5LeX1gScC+QHG6lghC/aVu4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785697648, "uuid": "45c7ab3a-090b-4af5-ac33-9f5604ffd721", "value": 661024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785697648, "uuid": "9e585a51-c326-4b24-be56-a4d2c934b21e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785697648, "uuid": "7bc6677a-d43c-4940-b9ec-e2662b233920", "value": "xd.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96e0e92-8e75-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785677143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677143, "uuid": "c704a62e-7fc9-4bcc-b86c-f8cb44efbb9a", "comment": "Malware payload", "value": "fd89479a24e9857e50943d967b88d1d0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677143, "uuid": "f50f8a84-c95b-4514-8df6-aa86bcb67665", "comment": "Malware payload", "value": "21254002acbe3568eedcb75b9872d8e3cf1514a771a66cf393b8f4229f27be0a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677143, "uuid": "694a2ac7-6a0d-414a-83da-866715833912", "comment": "Malware payload", "value": "dfc0fd646d149fca5416d6957ce8aeeb85247dd0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677143, "uuid": "20b1b47d-ff6a-433d-a0ba-7dc12209c958", "comment": "Malware payload", "value": "de3ec40be3ca0f5c49f073f6abbd8001325196546e4f1b9972d2c9ac2d9ca229501b7267a4d3c86959cee9204daf28ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677143, "uuid": "1f603299-a47d-434a-8a10-2857a1746220", "value": "T1CCC28D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324D42AC3D8A3C719C15FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677143, "uuid": "f2463624-8c9a-43aa-9394-390fafe98679", "value": "768:I8vCB+25j6es8Rq9FYpMSUpi+20qUpi+20YQX:I8l25Jcd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785677143, "uuid": "5c5df112-b6a8-4434-816f-f60c60abc480", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785677143, "uuid": "174932f2-0820-4189-912d-f534271b71dd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677143, "uuid": "cfe61206-ed2e-43cf-baf9-9ea28b3496aa", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c1c357-8e7c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785680118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680118, "uuid": "025d8b02-6000-4403-9f0b-5b9e7508e030", "comment": "Malware payload", "value": "dcb6399c2a8ef6fe03d6ca0670268591", "object_relation": "md5", "Tag": [ { "name": "178-16-55-171", "colour": "#454A9F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "letsgobok-com", "colour": "#B15F98", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680118, "uuid": "854ebb99-f7f4-4aad-84f2-45f8afdcaa94", "comment": "Malware payload", "value": "21ab822206407d6bc66d1a2a0f81262e20274368d4eaea3f60ccc2753aaedd88", "object_relation": "sha256", "Tag": [ { "name": "178-16-55-171", "colour": "#454A9F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "letsgobok-com", "colour": "#B15F98", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680118, "uuid": "689e8c90-2dcb-4447-8626-9fc3bdab6c54", "comment": "Malware payload", "value": "9edd377b19f00ec2a849e180c8cc49c9f65dd988", "object_relation": "sha1", "Tag": [ { "name": "178-16-55-171", "colour": "#454A9F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "letsgobok-com", "colour": "#B15F98", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680118, "uuid": "26829654-bdee-47c0-b579-eeaaccfbbf2f", "comment": "Malware payload", "value": "398fccbf2cb60f0673b37a1c2725443db36dd698f96a315c79f9215b02ca5b4bf4b45b7e579ab7c7774a8ac389b7af6c", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-55-171", "colour": "#454A9F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "letsgobok-com", "colour": "#B15F98", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680118, "uuid": "81f544cb-a7e2-4e9d-a8c0-dc04f3114193", "value": "T1BB94293B36998E25C2465372C1C7494087E79A476BABF70F358413DA2D033EEDA4A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680118, "uuid": "1c6eda9a-ee9e-4990-b7b5-a93746b290fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680118, "uuid": "0cc7dbcb-522a-453b-901a-da68da735620", "value": "6144:tQGi6rZvFmr2b3RjFIx0Wm1rYVfnoJZYq:CCrPmrIj40zYVvosq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785680118, "uuid": "5114cab0-91da-4fae-bd1a-c97941f8a4eb", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785680118, "uuid": "7ab8fa0d-748c-4a60-95a9-aa8d9bd7cfb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680118, "uuid": "0d155d42-8e96-45dd-83d7-b498fc7b621e", "value": "Tejkpnj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136e439d-8e18-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785636948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636948, "uuid": "0ad0236e-48d2-4730-8d4a-9c23a249bae9", "comment": "Malware payload (Mirai)", "value": "28868fd3d425b25c984f22855e311c1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636948, "uuid": "322d52f5-6ce1-4577-b13a-db398573d45e", "comment": "Malware payload (Mirai)", "value": "21d8e211fab585677e0cf843c6ec41f0718b8f5ef32aae102d57b2a5e078b0ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636948, "uuid": "efd44170-4f52-45fb-86cb-02227d2daa05", "comment": "Malware payload (Mirai)", "value": "663c38062e1f08fd1b6c924b095d59abf2b79d07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636948, "uuid": "08ff8c62-d201-4788-82b5-ece897ebd053", "comment": "Malware payload (Mirai)", "value": "241e9c5514526d0ffcb8c4ef75ac8af8c46856ee5fec631b045a239fccc7b5e38b2c012944b1a3b2ea7eb861929812e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636948, "uuid": "4b21fd6c-162f-41e6-90b3-908a3407d1ea", "value": "T1B624EA0AAFA21EBBD8BFDE3305D9070538CC544722A57B397674C928F50EA4B5AD3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636948, "uuid": "ae7baa9e-dc55-40c5-a417-9adf95c05984", "value": "3072:ARz+86yRSMqPAnpGl4SpWhVClJH/4Y3WYC:ARz+hiSMqPAElLpWnCX/40WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785636948, "uuid": "1209d29e-4351-4191-bc4d-86c85714ab69", "value": 214360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785636948, "uuid": "ad5ad868-78a7-425a-bb3f-d2dae4f76d81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636948, "uuid": "033caaf5-c000-4245-9273-932a674b0e3e", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a56ddf-8ec4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785711145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711145, "uuid": "1a7726a2-ac24-4f37-8912-3e6a5b2a17f3", "comment": "Malware payload", "value": "df0e74d96afbbb98aa250d778bf3c9ef", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711145, "uuid": "95bcaf34-1f82-4aab-9454-33a3ac9fb8fb", "comment": "Malware payload", "value": "2236e527e4aa90f170150cd4c8622054f478418befd1be1b3d9280c2bcd2ac87", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711145, "uuid": "af71cb18-d44f-4e14-930f-81b851fc3ea4", "comment": "Malware payload", "value": "a1d0b4cda58d74f54a11d93faa06e3f4a95ec1c3", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711145, "uuid": "1d99b0e4-e429-47d3-bada-37856db9757b", "comment": "Malware payload", "value": "c6fb8632ea623efeeab5a8454a18e5e772475bad6ee2ca74a207c4e4e2bfb1b7e2b6a60ce59251439e47c9c42b929e05", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711145, "uuid": "5751a567-79dd-41ad-84e7-0a400f9570ba", "value": "T14AD5239A6CF65A70E47BCBB6CF93F86E742A3B84CA750C4F758C68005E511182C7A376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711145, "uuid": "038bd31a-58a3-46c0-983e-a9fb3ead5c03", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711145, "uuid": "ec6fe546-deab-45fb-a1e8-f6117096936c", "value": "49152:HleNBrMm/65H/Lt93UlZRD1OxyiQwcf+KP9Wj0c/huzlI19+x0GLtn++d3:FezpQLD3UlTYci8f9Wj0Ih6y+BZn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785711145, "uuid": "71531996-09e5-43cf-b31a-0485018b7b26", "value": 2950656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785711145, "uuid": "da985136-2660-4ad4-9ee5-1282e6f0e267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711145, "uuid": "0fc11e4b-6b10-4738-8115-98033ed956e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfbfd49-8e3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785653714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785653714, "uuid": "0fedfcc7-d451-4b55-b9b0-4a8da27fb440", "comment": "Malware payload (Prometei)", "value": "eaa88ee35c44ac3d0392117610f58b57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785653714, "uuid": "144868c4-73d0-41c7-88ef-b2fd775cffc6", "comment": "Malware payload (Prometei)", "value": "24484cc5ae476f2c3f37ea7b68d175cbde32b7e479b93ffce1e7bfbacc7d2e0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785653714, "uuid": "8a9f7fad-7453-4651-9a9e-e4b721cd6f8f", "comment": "Malware payload (Prometei)", "value": "bb92d1fa432c22cb8c2eae9059e5585e5f506100", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785653714, "uuid": "91132ede-3551-460f-af31-b5cf04813eb6", "comment": "Malware payload (Prometei)", "value": "e68dc76b203108a0267839633699327c78037885456e7e5d32e1300a2e23541baedc47420d86f6b8715bbfd29fbb4a3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785653714, "uuid": "bf98cadd-33ee-40dd-9847-a46835cfaf40", "value": "T184A423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94E34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785653714, "uuid": "5acece0a-3fae-4a24-b5fd-f9db19e2dde0", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdK:Fs6pyCC/Ya2hpi6T6N4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785653714, "uuid": "549a24ae-e182-4bbb-b1a1-10a0a3d92138", "value": 449083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785653714, "uuid": "1644abd9-d5d6-4a9a-bfcb-41f3bdef8731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785653714, "uuid": "ffc38c43-19ef-43b5-b379-ebbff79f5953", "value": "24484cc5ae476f2c3f37ea7b68d175cbde32b7e479b93ffce1e7bfbacc7d2e0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404a4920-8e55-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785663222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663222, "uuid": "21245140-bc86-48c2-a366-a46d8f935012", "comment": "Malware payload", "value": "b9845f3cb8bc89e3f3dcf660a1caf78d", "object_relation": "md5", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663222, "uuid": "ac1d8729-966f-4523-a807-05b1dc94fdf7", "comment": "Malware payload", "value": "24f9e1a7d122d0340251828fde0a0c45f69967c14f4a1b2dfe606772bdb0b275", "object_relation": "sha256", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663222, "uuid": "9006bc49-b65a-4e2d-865b-3c3fccd74216", "comment": "Malware payload", "value": "1f61c0a24cffaf0a65fb5c046a8f01cf5fa16ac3", "object_relation": "sha1", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663222, "uuid": "a233fa49-af4e-4026-8a5e-7417f3ddb08f", "comment": "Malware payload", "value": "0e6f33a46c14bfeb7ad8dc3ce08a026d493fd131c4a47cd6a1349894f451cbf75c4e4f05e9dec0ec9db38a7eeff64e57", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663222, "uuid": "5fc3b919-eeba-47b9-992f-814405b53d6a", "value": "T108E6334A03C45ECEA73F83264A9D952AFCB7E41C8809291C3B6171FB3DDA2DD6757602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663222, "uuid": "7609fd3f-5c6c-42a1-8cd8-d519faabd70a", "value": "393216:ItdF8uTB/DO4vqc509j0g27KBVQwZAmGQEvhrko:GF8qK4ykk+7KI2HQvhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785663222, "uuid": "232259e5-799e-472b-bb8b-f0e1421fa9d0", "value": 13991507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785663222, "uuid": "3e80f27d-4e43-4e65-8a95-6c2733406228", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663222, "uuid": "105bfe1c-fd62-41fa-b552-eee084eccd81", "value": "553003097200721800.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cf1fe1-8e2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785646112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646112, "uuid": "aa175d0a-bb30-472e-a021-1291e80ca977", "comment": "Malware payload", "value": "4147313cba5681dd70b8f466740279e0", "object_relation": "md5", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646112, "uuid": "547e07ce-9c7a-4b72-b8f1-9d7ee0f69c1f", "comment": "Malware payload", "value": "25848334ac892d73fed07a04fca9b5ed55cc590fcf4a59c34b023fa35b1dfd00", "object_relation": "sha256", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646112, "uuid": "7ea45a21-ec5e-41c4-b0b5-706b417b1fdd", "comment": "Malware payload", "value": "5b36a4b390cbdb536ba2403723adf20400b109cd", "object_relation": "sha1", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646112, "uuid": "6c49edfa-9355-4584-bf97-faebbf6d5a7e", "comment": "Malware payload", "value": "640aed042fd158148be1e4f412037d562a817bda311b072bb9b8142e75044280f610bcbeb387356c050bd263c131ae17", "object_relation": "sha3-384", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646112, "uuid": "18e9a680-f1cd-4449-b441-4e019ec4c5f2", "value": "T157D523C569F455B6D83BC3728F52E0BDF06DBBA05B604E17BACDBA009E560486C76338", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646112, "uuid": "b561c2da-4197-4051-8038-60bbdbc92272", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646112, "uuid": "248b7e19-9ca0-4436-8161-8fda390f55d2", "value": "49152:7Eyeqy1j1ehCJzwUWIjCX7sKnEhIG5cnBUavXbfOw0f/S69d3qXLolPZQE4YmifH:Cqy1JGczXWICX7sqfBUqiw0iAab8ffgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785646112, "uuid": "bbc87f57-d89b-4052-94fe-84f0fbf6246a", "value": 2929664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785646112, "uuid": "151f695c-9d0f-4804-8c67-e29d4a32155b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646112, "uuid": "d0b944fa-655b-4ee3-b701-17c3041be6af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad114a8-8e9e-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785694539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694539, "uuid": "f7868818-88b3-4ceb-9550-b08b53bcab73", "comment": "Malware payload (AsyncRAT)", "value": "631222ce7e5d47d35734ba11a15e7eee", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694539, "uuid": "7245851f-ca3f-4eed-94fb-3c929df19861", "comment": "Malware payload (AsyncRAT)", "value": "26d90f32df1cd821e0995026c4528b22ffacb0e6c6acfb07eec0fcb3eb7a03ac", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694539, "uuid": "c551f236-a621-477c-bf59-3a9866bdca22", "comment": "Malware payload (AsyncRAT)", "value": "235e8d1826b5d6248edec1b51737c155045f4055", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694539, "uuid": "07232336-c0ad-4127-8cd1-5782dc475b42", "comment": "Malware payload (AsyncRAT)", "value": "5208e59895dacfd591296858b3083820c8c4484684a3cfdb616132675f584aa40f5488733bfa783b83b0e6945b3bd6e0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694539, "uuid": "7ce62878-08a0-486b-b83e-4eae0a26beb0", "value": "T16FC22C0833E4C571E2FD4ABA9833D5008B75E95B9913D76A6FC890AD2E237CD8A14FD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694539, "uuid": "16127623-58a6-4886-83d3-6d58b509cdd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694539, "uuid": "a3c3d421-2ef5-4259-b845-7af8e62dc2c2", "value": "384:KQpwoOiZTWq7HtZARPn9jWH9qbuUszbQxnCJfJBndnjJ1Kc/+:KQpVdt+IIb3BiBncc/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785694539, "uuid": "545f2083-0ed5-4dd4-b704-293e29aa484f", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785694539, "uuid": "5ef649ce-d5c4-49cc-a2da-a437e1c4ae6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694539, "uuid": "860a3490-397c-4e2e-a47d-36058638194c", "value": "SHBETAPP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c7a61c-8e40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785654316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785654316, "uuid": "595d8b1a-4875-4cc8-8acb-512130ace87a", "comment": "Malware payload", "value": "1218b98882dac92568228176f2e1fd5f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785654316, "uuid": "58959816-b35c-4fd3-b359-29ada930521d", "comment": "Malware payload", "value": "27dda028fdd6dff24fae55d159f71aada0a8e9955c3780ae4b2d9ccd9caa5bcd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785654316, "uuid": "814e70c4-3a0a-411d-b45f-2d4c0ef646b3", "comment": "Malware payload", "value": "5877bc540722c0fdd7c995f2cd3f42d00055c326", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785654316, "uuid": "ea3432d6-71c6-48a5-8ccb-529eee85fb0c", "comment": "Malware payload", "value": "b135a4685a84658102af1e898495b38d4885d60ccce42f9e219e974c652b47e781af46892ff97f370f6542d8abe74249", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785654316, "uuid": "ab503b03-192f-4ec5-ba7e-699e47b4b39f", "value": "T166C26C966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785654316, "uuid": "a1f96951-52ab-4aff-8065-afa5bb4bc80c", "value": "768:2m8vCB+25j6es8RNT9FYpMSUpi+20qUpi+20YQX:2m8l25JDd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785654316, "uuid": "e80a2804-5356-41e2-8a64-5da9f40577d5", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785654316, "uuid": "3d7c3e48-474a-45a2-b996-e615173f989c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785654316, "uuid": "32530177-43f3-4069-a7fb-2898480b47fe", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8feb91-8e4a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785658736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658736, "uuid": "7e81554c-6bd0-4827-8708-943a89e546c3", "comment": "Malware payload", "value": "1f681d146b883c0488d2d513e7375035", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658736, "uuid": "93f5010b-5a3f-4982-94a5-1248cb32bd67", "comment": "Malware payload", "value": "285030eeb9fa60d670b1144833cdecec0ba7203659476ac944846a994766bf94", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658736, "uuid": "effb7c9b-69e1-4ed4-97f7-b97ab6d0aa1c", "comment": "Malware payload", "value": "670fc7ec21b2f58ad618b216c2e97b7bee135a0a", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658736, "uuid": "f3f258d5-c5e9-4f65-8a89-0f6b92ba0505", "comment": "Malware payload", "value": "c20a28a68c2b06d2abd24484e6e4d9765fe8662a6edd1afd68d1869d2cb1c75b82bd981af8ec78b8c84002985a57da15", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658736, "uuid": "24e5b9ca-3380-42cf-a925-d8bcf5db453c", "value": "T1DE08339ABE21A03FF423D4B3E11866E96259F454D733CB97112B80DEF8E27116F841A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658736, "uuid": "4ace226b-c9ab-4669-b8ac-0c64d9b0ef7b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658736, "uuid": "f276eaaa-b27a-43e3-b8ce-75896e43d61c", "value": "1572864:4k2um44Hi5Bmzg1nNHG3cv4JW4/KMYAMvJmiftzjPzcsZM2AWUQriXyn:4kTm4v5R9NYJo+sUifljLcs22/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658736, "uuid": "6ee6c06a-0503-4780-8c5e-b12d0d220f42", "value": 80051303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658736, "uuid": "c42f9e39-f612-4953-8c7d-bda3d7c77cb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658736, "uuid": "db38d9e8-618d-4a7e-8672-3ac59e1de339", "value": "figural.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b29f9de-8e9a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785692983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692983, "uuid": "b7ee4170-f8ab-47d7-96f8-d5d3c3ecf1d2", "comment": "Malware payload", "value": "010b4565d3383c084b45a7fe7bd76f1b", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692983, "uuid": "cc32e2a5-01c4-4699-a616-060118752391", "comment": "Malware payload", "value": "2869b20c33bb050c36f74d3bd341ff6c524fbba99a93923aa5cad724203f943e", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692983, "uuid": "1aa30ebf-3bd9-47af-8e80-c913f828b1b0", "comment": "Malware payload", "value": "2d93bed8131abb3829a30135d68e803148f8a5dc", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692983, "uuid": "e308dae7-c55b-4aff-b1b1-c1f0892349b1", "comment": "Malware payload", "value": "070ce1cb822c43879886fe62f9f1b076ce77863b59311882f04731bbb7d782b0edd892d9803aca05c26ce6c003aa1a6a", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692983, "uuid": "f2de5b5c-b928-4dd4-b0fe-dfa389212e6b", "value": "T1C2D523CAA5B20979E4B3C3F2CF47E07D7169374487618E4FBACC68104E929986C36779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692983, "uuid": "c74f257f-13f0-4e08-96fe-b2e351391d21", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692983, "uuid": "d92ec418-68c4-4992-9455-82be9ad25a22", "value": "49152:nHVHvf0bW+y+lx6rFnLVGiUzECU3reDbNS5sHeotKyd0ELf84ZtArPt4JLYf5FL3:nHVHvcbW6IRpv3reYRotKyr8YOtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785692983, "uuid": "b33d55f8-2892-48f2-96fa-69d1986c476d", "value": 2924544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785692983, "uuid": "3e80c35e-265a-47da-9f04-e3125e3b82f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692983, "uuid": "80cdc10a-a5d2-4042-9296-815e734c3611", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f3510f-8e11-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785634110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634110, "uuid": "0d8104ec-d795-4372-ab45-929fd2f0a320", "comment": "Malware payload (Mirai)", "value": "bd4e47f7394893dcf0f9c759e05a0b8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634110, "uuid": "a405cf8e-cf1c-4392-b6c1-1c36e50d4e94", "comment": "Malware payload (Mirai)", "value": "28a16751269feab605a0df2ace7b0023cfc439947ce9b23ebda0675b88bd4dbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634110, "uuid": "4990f276-7d7d-44ac-a804-3ab4e669ac3e", "comment": "Malware payload (Mirai)", "value": "e1e5588d55a9e47e80ee36280315f04ba093dc38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634110, "uuid": "aec83fd5-37a3-4801-960a-aab70e013791", "comment": "Malware payload (Mirai)", "value": "2f56b8384dc110c649c62d39dae1667d64ff19839c130ab8bf131a597a51364c1631bffb0ccccba67f17b8a44d35c3db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634110, "uuid": "b2d2aa74-e89c-44b1-ad1e-c94ef98ad0d7", "value": "T13D43F2722466EBBCF72B6B7E5648B240C8371A32A51B2EEE54511167067FFE11C0CAD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634110, "uuid": "3c2e6abf-882e-41ae-b14c-a4acdbbf9f78", "value": "1536:G10HkpCfuso6bUkL+hSSsVaKCUrB864dxW:GN4Ho6TKZKNVtUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785634110, "uuid": "0439ec49-31ec-4fdb-a772-be7a408953eb", "value": 59420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785634110, "uuid": "3a87650a-9382-4729-8566-af5029cd3c5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634110, "uuid": "67cefb5a-4850-47b3-abc6-ce63bb7fa65d", "value": "zero.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8188eb80-8e54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785662902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662902, "uuid": "e9388d27-e52f-498f-be5e-aa54c8b0d1d7", "comment": "Malware payload (Mirai)", "value": "b8bf8223dc458d1730d667c7d790881c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662902, "uuid": "e7b1ca51-4a32-4ada-a76d-110ddd96091e", "comment": "Malware payload (Mirai)", "value": "28a173f0fbd53a262bdf7eb328531879013006a65e1b8cddbf223fcfb134be50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662902, "uuid": "0c40f66b-c7d0-4592-9c17-5a1f25402b0b", "comment": "Malware payload (Mirai)", "value": "c6f500ea8d4ac3877ccc51ca3b7db1e9586d69f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662902, "uuid": "3ad80005-3818-45a2-a144-aaf326e8fd5d", "comment": "Malware payload (Mirai)", "value": "21536929f2aaffedd4e0a1063fc8ddf26ffcf394b0fc561a92cb269c2261a342ccf2ab5b64825fdadbaa8f3a1e0650af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662902, "uuid": "a6875c69-e964-4265-9dd5-44149917eefd", "value": "T176631A2AF9819F15C5D1167AFE1E534E331327BCE3DE7213EE142B65278B46B0E2A406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662902, "uuid": "768a5a5d-05f6-4f0d-8337-6f348528f04d", "value": "1536:m2nifqkOsgJJ3QpDjorGn1eYiDjAxDimfPBJBtEpaU:+fZy+2Q8Yi43fPBJBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785662902, "uuid": "d155cc86-8dc9-4be1-a899-619504d8c267", "value": 68508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785662902, "uuid": "bab8cbe0-db1e-4034-b1d6-4687d8070b54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662902, "uuid": "9351da99-223d-4856-9789-b06e92429482", "value": "TCIi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c19135-8ec7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785712387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712387, "uuid": "8ec295e2-96ed-497d-a084-e8fcd507ff80", "comment": "Malware payload (Mirai)", "value": "5de80c1edd7f287b8fe18147d1763a9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712387, "uuid": "7bbbf79f-4b55-4432-ad9a-c0b0430c67d3", "comment": "Malware payload (Mirai)", "value": "2a490acd4bd1f94e0f68377566a5e2ab1640af5b7ec8e4410813c25d56fc5d33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712387, "uuid": "6f9a0e4c-da39-46d6-b6ee-7344230d49d1", "comment": "Malware payload (Mirai)", "value": "a2e0019d6da746c3674cc27b68f5b7e82a045e7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712387, "uuid": "a4c369dc-2d95-48ee-bdd0-efe01e78bc8d", "comment": "Malware payload (Mirai)", "value": "e5a462f62edbd9d343511b48bb23c5adecd28713090e0172598dc236056f4bf36de5799cf182ef21c57da731b137cd37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712387, "uuid": "5a136106-f788-485b-b450-c523969137c9", "value": "T112D46C06EF850FEBC4AFCD30852E831B19DD898702D1A678A1FC899CBB5D65A4FD3548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712387, "uuid": "a7f79939-6745-4140-bfb2-9864fd48c62b", "value": "12288:td0u7GoRrfb3h72lWh7hSYAy44BtThSZ/YzeazzHxQNkMeZkJ+I4yTNNSICVXur9:9QNk/zQNkICoi34xhV+Lc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785712387, "uuid": "f68f5b08-6b41-4c81-9e2a-695df004ab7e", "value": 605984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785712387, "uuid": "3dab1a12-e731-4ca9-967a-ee90863456f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712387, "uuid": "4dd90682-0f16-4b14-9a6d-1fdb9c04c09f", "value": "g.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5395409c-8e3c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785652517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652517, "uuid": "19787e70-3ae2-448b-95d2-223eed3052d6", "comment": "Malware payload (Mirai)", "value": "5baadbb01f0ccae2c00849a4d1be8052", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652517, "uuid": "b0b1589e-a30b-4f76-a431-423b92eace4e", "comment": "Malware payload (Mirai)", "value": "2ab69a4ccb50354c271b887c951c7628ec8183c478462dd816acffa316e21313", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652517, "uuid": "a02d6cdc-a598-47e2-843d-40bd74c3faf1", "comment": "Malware payload (Mirai)", "value": "c2a8696839f7e6dcb2109fb555cf614c4f61c62a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652517, "uuid": "26638da8-5fd8-49fc-bd6e-4c43078de5a2", "comment": "Malware payload (Mirai)", "value": "06683f8521b2afce4d964dc1a7457d0aba3d2e4f353d8a25ce6b74b3f6c10b43df6cdd415ec51b1fb2bcb30f390d91d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652517, "uuid": "692a899b-7225-43ed-a5da-e643f601c272", "value": "T15721ED9667D39D17CD540277DDAF6310E322EF84818EB403F31216150C6F31A1F26089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652517, "uuid": "2b069d3c-e04a-4b81-a98c-f7d02855d89e", "value": "24:Ji2tVsgP9qD0at6EPbrzrUlFSy40VzLCkIdsx2BWQIgOpNfe:JltVFFqDPtt7rkFSy4CzLwPIJpNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785652517, "uuid": "12ef2cb3-f99a-42f9-bae9-178f68e29c2c", "value": 1160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785652517, "uuid": "0533c3d2-5b3a-4abb-aa49-12450ec707d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652517, "uuid": "48f7052c-3c0e-4319-b4f1-71f1e9c530b1", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02215cb1-8e79-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785678580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678580, "uuid": "ee4a2a0e-ae62-4136-94e4-01bcad693a5c", "comment": "Malware payload (Mirai)", "value": "cba383375efd66c8900774939e4a7035", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678580, "uuid": "934044b8-3a54-4f5d-b879-80ce4449d456", "comment": "Malware payload (Mirai)", "value": "2b08a2d856b1611e827bb9adc3bec0c46757d362494068eafe0bd1c6c8398019", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678580, "uuid": "ef91a2f7-9b95-4128-887e-e70ddfcabdcf", "comment": "Malware payload (Mirai)", "value": "65e3bd42eaa5843a74e3acab18b497c7e0ea99b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678580, "uuid": "324a2bd5-531c-4fe9-9d4d-8b10d52ee726", "comment": "Malware payload (Mirai)", "value": "c839470547cb4e0c847116fb9ce3c1c5fbc248513c3c2a7f8b12948e6885a4128372a6914010f9762d29eb3fece6669c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678580, "uuid": "834c2367-d8a5-4859-9066-81aff0c1f159", "value": "T11B21ED96A7D39D17CD540277DDAF6310E322EF80818EB403F31116150C6F31A1F26089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678580, "uuid": "1cff622b-c930-46d3-95d5-fe954893f454", "value": "24:JiAtVsgP9qD0at6EPbrzrUlFSy40VzLCkIdsx2BWQIbzpNfe:JPtVFFqDPtt7rkFSy4CzLwPInpNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785678580, "uuid": "96c9a73f-0d4f-4bd1-bbe8-4545cbb1dcfc", "value": 1160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785678580, "uuid": "ac6ac4a4-ea7f-4ebf-80ed-704777148a68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678580, "uuid": "91d6b127-e401-4c84-a078-f535a6a3f1be", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795beae5-8e43-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785655587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785655587, "uuid": "8182b324-d464-4996-a86b-eeed31c96b7e", "comment": "Malware payload", "value": "d2d7bd51e6175bcb8e3aedb67288e49c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785655587, "uuid": "a1bf96f0-e7a3-4746-bca6-aa8d536a0cdd", "comment": "Malware payload", "value": "2b4e4c1a39d8d1c940ea73e4b117db9cd640e134cb4b862843bce12d227eb23a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785655587, "uuid": "64e6c0ed-fd8a-4e60-a6a6-ec0f42e9051d", "comment": "Malware payload", "value": "e43f063e18d6c65a59682323be00798bc919ff81", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785655587, "uuid": "f39306bf-d4ca-431b-8605-208f48938b55", "comment": "Malware payload", "value": "0b7d1095919bfddc590b8e38621d9bb1102f6a3d6eec72aac7d784f35bde4a2b121fca1de428e0fdd623cb0ced1ddd08", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785655587, "uuid": "5240d233-bc6c-49b0-8be5-23b1fdf837c2", "value": "T1BB236D6516857C14AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10872D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785655587, "uuid": "3aba4808-4a11-473b-83c3-fd8df569730d", "value": "768:ZXRWNGxV99GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:zlxgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785655587, "uuid": "def52faf-27c1-4558-a8af-919e74d58e7e", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785655587, "uuid": "b36bc4d0-64f9-4b34-9177-00735215205b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785655587, "uuid": "6e4e8a4e-7779-4c85-983b-439d2e5a2c09", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fde28a-8e13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785634825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634825, "uuid": "f1f337a8-5294-4cca-bd4f-64352c001ffd", "comment": "Malware payload (Mirai)", "value": "b9bae4c61ed64c58ff5081ceb63db469", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634825, "uuid": "8f01f784-a609-44aa-835c-cd0d6d3f8be9", "comment": "Malware payload (Mirai)", "value": "2b84a52a2d4d954bbe37342a8575d735808d520972662de903edeb8e62ea0076", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634825, "uuid": "07268a47-4005-407a-ab72-4aa19abdda7d", "comment": "Malware payload (Mirai)", "value": "a3583127a1ad497010a02dd16d58e949f29ab760", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634825, "uuid": "7c36fa6e-9a3a-4e7f-add7-ddb721352c8c", "comment": "Malware payload (Mirai)", "value": "6114f5bc89230d1bfb4ba9ef77f3d3e3f3c50aadcccdb0fad21cfd05f22db7a47055b20eb95a3a0bdc791a039321300f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634825, "uuid": "88997547-5bca-4fea-bd3b-85966165ca70", "value": "T188D3AEA7F74721D1C86306F407CB4BDD2E6322829F6B98E7BC5F653B197A0DA0502B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634825, "uuid": "fece3973-d374-437b-8bf7-0ea0d8e7c12a", "value": "3072:UsyHPBOg+J6eBAR9cWutBXBduCugbBbq:Upj+fLf/zxbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785634825, "uuid": "7fc6f8fc-cf48-495e-a1a4-8998c8a424c0", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785634825, "uuid": "2ab67172-c5d3-4d01-b030-9c8f93683f8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634825, "uuid": "6637a4b8-503a-4fc2-84dd-bfb77b77b543", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8609862-8e15-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785636016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636016, "uuid": "29bff4c8-2cce-4470-9990-28d6fc9f28c4", "comment": "Malware payload (Mirai)", "value": "fe7fc79a4f76b7315e045113eb0c8ed6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636016, "uuid": "ebe417e5-c81c-4402-be91-74a1f68003e7", "comment": "Malware payload (Mirai)", "value": "2df589b5d6f301f24a0102c34655d145a203c1281034394be4f6f9dbafd750de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636016, "uuid": "6cae700e-3c8c-4c2c-bea3-eb054c689cb8", "comment": "Malware payload (Mirai)", "value": "8e9ce0f04dfb8ccc7e466136e70a63fde4a63d4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636016, "uuid": "47fe43f6-ab16-49f2-bc9e-fe03855471a4", "comment": "Malware payload (Mirai)", "value": "e16bb91bb9b22ccfb7d3e121f9fc9b24852cdd22c859295faf6154337da5238ddd6386d5d4ba75691ee88d3d169491d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636016, "uuid": "bd9330b6-47b6-4c6b-b4d6-e97bc07a3d18", "value": "T15423F1EE1F85C4FBC876E8F14A27A73805661EB19801DC9E75B0D9176AB75E4338D2C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636016, "uuid": "f23e6d5b-049d-4fc2-8e97-7a75153ea13a", "value": "768:TufLsKvA6hQ4H29CmJj7PSuWMMqkq9ZO3RwrK4T9M/ApmJg/s0s9iKuRiKJgGlz5:Kf7Wa29CafSRokq9I3RwrK45M/AE2/sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785636016, "uuid": "d1a903f6-cc24-4413-8691-304276b8ec1f", "value": 48536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785636016, "uuid": "b76abb8b-9d48-4158-934e-34b2b20b9a2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636016, "uuid": "c740f540-755c-4027-af5f-ea32c73d0956", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079884da-8e56-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785663557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663557, "uuid": "aa579e2d-304c-4a07-a93b-44986fcbdd8d", "comment": "Malware payload", "value": "93b3486e4be0def1bc2b6b5c45acf3fe", "object_relation": "md5", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663557, "uuid": "634e9628-7827-41e2-aecb-28a19cbad7b3", "comment": "Malware payload", "value": "2e2788460a1545482e358e9f72367b7db26d84a1e226a745ab4a3c3a9585ac86", "object_relation": "sha256", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663557, "uuid": "fb00791f-df21-460a-88f9-476525baa39d", "comment": "Malware payload", "value": "774a5315487d0701b0be9b5f429ebd0a3f4f3d7e", "object_relation": "sha1", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663557, "uuid": "1b15d20b-592d-4f7a-b09c-cccb95332003", "comment": "Malware payload", "value": "fe1d6e8978a0ba083e6cd0d168b95cb523050d8e48772026516e29f9c722a6dab2ac7c3cd7dc7f3352725d065e0dd9a0", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663557, "uuid": "c85c8ad2-b328-4ff4-a810-67a2b2abf5d8", "value": "T14B33FA2FDD26916FD35E8C74C6035C06DE62BCD79BE0B44EA7904CEA0E76A649B1D302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663557, "uuid": "9991e50d-6cb9-4e7d-a8dd-a44a01ff64da", "value": "0a07d3b5d4c646bdbece10cc7072fcf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663557, "uuid": "917320a5-3914-48b9-a591-5266fe949cac", "value": "768:6TyS+3qNgnFIRCBwSB5wYY+0HXehShVwj+yz:603qQeCBwZY92OEgj+yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785663557, "uuid": "8eea3c6f-b792-4533-9a20-f748e1128503", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785663557, "uuid": "828fe040-340f-4f09-a522-16a3d3c392f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663557, "uuid": "3befca45-3361-432c-a8e0-e6080bb9a49c", "value": "log-2..dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2a45b2-8e4a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785658595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658595, "uuid": "9f18215e-1e5b-4066-9ebd-70cbb78e2d33", "comment": "Malware payload", "value": "bd2ebddb55bd3041ff1e835e3b5b536a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658595, "uuid": "4e773ae2-c956-49ea-a3c7-26bfd1611195", "comment": "Malware payload", "value": "2ef281726742878e79d65d977321ac2cf0c96611206e3077630b455c939365b1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658595, "uuid": "9c807da0-9e4e-4714-850b-c54b489e7530", "comment": "Malware payload", "value": "7022e66e3514062fa0dd40b8c0ceb23c2d314da5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658595, "uuid": "919d8809-fa7d-4ba9-8fb1-830b2d98edab", "comment": "Malware payload", "value": "d9a7bbf74da787025e9581cb40f12a6993e0aafd2e8f9f6b402267872ef4df699da46af0da0852db336f7e68d04b880c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658595, "uuid": "eb14a658-5f05-46ad-9667-d89bcb413216", "value": "T1F0236D6126857C14AA99C8371D7E2F0CBDAD43E6320452EE7FCB3CF68C4A69DA10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658595, "uuid": "d5964378-188e-4e66-9ddb-5c7329795357", "value": "768:M6rDTPjH89GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Dr39cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658595, "uuid": "81b9ebb0-e4c3-464b-aa1e-b6317fc9b1b7", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658595, "uuid": "b7d4bc3a-384c-4117-a7d1-0871356f1d5a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658595, "uuid": "ea7be742-578c-4883-a736-024aafe91cf3", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cee5062-8e9e-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785694516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694516, "uuid": "017b3214-4df6-434a-bce8-76bc41b74f6d", "comment": "Malware payload (WannaCry)", "value": "5c72ba4d786bc3061dce91fd29a523da", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694516, "uuid": "07f8ec9c-ab1e-41cf-8f05-dfbbcc40635d", "comment": "Malware payload (WannaCry)", "value": "2f7cb9e74f3396213418db82f7c723a4c168ace04fc791e7c0eb372fa87afb68", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694516, "uuid": "ecfe6155-4ac9-48f2-ad7e-28eeaf741c63", "comment": "Malware payload (WannaCry)", "value": "29494db630a7b66b92b79795d4488b53e4914c5d", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694516, "uuid": "843a643e-0e62-471b-b0f9-6ca93542b6db", "comment": "Malware payload (WannaCry)", "value": "0e49ac8eeee31798c740384d7180916a6f50bf9342fa785ef082d8150a770c263f28943901f981ef492ef6f2a5f190d8", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694516, "uuid": "66f46c7e-69d1-4fe7-bb50-40b8df3f790e", "value": "T1F1368D1267E94214F5B35BB4DABE87710EB6BE03D929960F2110394E1C33F84DD62F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694516, "uuid": "6b8117d2-2640-42b6-b29a-2cb765cf30cc", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694516, "uuid": "331ec8fc-382e-40f6-9da4-3429ced29cdc", "value": "49152:jninsEMSPbcBVQej/1INRx+TSqTdX1HkQv3oJv7uhdiXfXTG:DOfPoBhz1aRxcSUDksoV/PTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785694516, "uuid": "8e4cabda-1de3-4ae9-aed4-1c1de7220a87", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785694516, "uuid": "84e630ba-84e6-43e8-837d-13c5f7d5e6ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694516, "uuid": "63cc2c68-2e17-4650-bbcd-10bd6b7b853d", "value": "2f7cb9e74f3396213418db82f7c723a4c168ace04fc791e7c0eb372fa87afb68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b904eb-8e13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785634826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634826, "uuid": "7207e252-5512-4964-8b7c-09239526d115", "comment": "Malware payload (Mirai)", "value": "b4eb81e7d911e9c08dea7d16ba35d997", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634826, "uuid": "38afbd89-c31e-458d-953f-6d8027898c28", "comment": "Malware payload (Mirai)", "value": "2ffbc8a866d557a4c5bc38138385f53f76495fdfc2e816c3c03a136fd4766132", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634826, "uuid": "c7b35e12-9c4f-40ff-8fb1-de45be0021a5", "comment": "Malware payload (Mirai)", "value": "80c83732233e3cf9a68e61b3ed41d17ccb4f7572", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634826, "uuid": "0237a0ae-58ac-4ebe-80c3-dc330af0a95c", "comment": "Malware payload (Mirai)", "value": "544f5aecb3b83d2b9a3bee3e3c91119b0def2a4b3a231c3ea3c7b4466ff3ab5e270976efd53a51e7f2476fcf294d6659", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634826, "uuid": "d93b6752-7990-481f-9347-ebeeabb6caa5", "value": "T1654302A325822533C420887EFE1A00D31E5686B945CD75B75211BB88F6C7F8B9EFB197", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634826, "uuid": "d5110b09-26c1-40c5-819b-f1c08b8d5788", "value": "1536:xjsyC2yFBgrpbucuWSpTuXS6qf9MXM+XjciN6iLQ:xjfFT8EqfSMZY5LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785634826, "uuid": "a2ccd531-b068-4757-93ce-1194c2a60c1d", "value": 60068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785634826, "uuid": "ff1e29ed-f4cf-462f-8d1b-9ce9bc84d36e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634826, "uuid": "9f4085fb-36de-4de0-b3cb-90e8567aec25", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786c0159-8e69-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785671906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785671906, "uuid": "0581ccdb-1686-47e8-a3e8-7703329186be", "comment": "Malware payload (Mirai)", "value": "191de2e3cb5580b016607919d43c1b5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785671906, "uuid": "d9ed34f8-09c3-41df-8be2-29abbbf5ff7a", "comment": "Malware payload (Mirai)", "value": "303db05754d6665df202765f03ba93c76a31e69c6fa72c4fc63c7d6addfcd6ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785671906, "uuid": "1d52f60c-bfe5-4052-9cac-e4fca1dd0254", "comment": "Malware payload (Mirai)", "value": "c2828fc28bed09a265530fc5ad538e0553cd7036", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785671906, "uuid": "9c0d2358-27a2-4367-b224-8280e2cfa676", "comment": "Malware payload (Mirai)", "value": "4636dfa87763997689fbc1166f6d9167a3d7909bae2825e97f4a7a16f377e8d4e282e62cd9b7985344a8fa62cd4e3a41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785671906, "uuid": "48315e61-630e-4898-9fc1-c1aefb067861", "value": "T162830896B8814B12D5D512BAFE1E118E3313177CE3DE73129E206F20778B96B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785671906, "uuid": "4a0bf0ab-c1bf-428d-b05f-7c5fcd4f727f", "value": "1536:OjneDl6uCA9Ab2aL3QpjrvauDnYQQMcic3nYT56a7y+50RYSs/hr:bwuTA13AjrvauS3nYT56aW+uRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785671906, "uuid": "b8f40dac-9a80-492a-985a-06a3291c0355", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785671906, "uuid": "71648b37-5667-42fc-8411-dfbeecdb40a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785671906, "uuid": "838f62c3-bb51-46ef-a9f6-533bfc68180f", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1261b8ba-8e41-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785654555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785654555, "uuid": "aa8d69bb-0db9-40e8-8fc6-eaf39fe7a9f9", "comment": "Malware payload (Mirai)", "value": "3d5f27f856069cc310d8b41c5dda009a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785654555, "uuid": "c817b0e4-046c-46a8-bf30-2ebc709ba6a4", "comment": "Malware payload (Mirai)", "value": "311801ec16acd402a73c138229f77e2bbc5ec5f4efc8645220f74b032c68c5fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785654555, "uuid": "ad86097c-9fab-449c-b603-1560bab4e835", "comment": "Malware payload (Mirai)", "value": "dde2f6f92f0db5d1408648e9b13e8598f2fdfb6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785654555, "uuid": "d784dfb1-6e0c-4079-ba1a-3a462a4796cc", "comment": "Malware payload (Mirai)", "value": "f46811a3bc085ab32aadbcccb56a5e197b7ec078c53354683166686bd3f37922a957243e29e02791694c83a71338bf03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785654555, "uuid": "85522426-57c7-4003-a4de-dc7e9ca1bc7a", "value": "T16C531781BC81D903DAD42336BA6E55DE331123DAE1DA3703AE162F5137CAD1F0E6B192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785654555, "uuid": "30fb4ad2-0083-454b-aa59-29a702af187b", "value": "1536:rnkj/klTvurUuBho1GB3ANQwk7XQMYMGrVo/qy:7kj4TmC/0/BGruy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785654555, "uuid": "968ce3cc-bfa8-46e9-863a-b46aefeb0c12", "value": 66584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785654555, "uuid": "824347f9-11c4-4a31-8a16-27096ce48dd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785654555, "uuid": "951eb406-63ee-457b-afc3-a7a60be9de5f", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c126df91-8e0a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785631226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631226, "uuid": "846aaec6-9625-4481-b411-4808979ade40", "comment": "Malware payload (Mirai)", "value": "69cd092182dcdb51abd81a7d88478569", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631226, "uuid": "bffde6b1-f51c-4d03-86d5-efcaab2aa232", "comment": "Malware payload (Mirai)", "value": "3178e838e991d58717ede5115f146b7ff6882aeaada063e0243d50f5c5d85122", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631226, "uuid": "4aba12bb-4cc3-48f1-8141-b33092efd488", "comment": "Malware payload (Mirai)", "value": "45bc1a0f54e590b865325934f610a8b4f5c3d0fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631226, "uuid": "b4c7fc0f-885f-4b91-9ecd-cb934f296d7a", "comment": "Malware payload (Mirai)", "value": "b511e6156e29110962feb16c1caac517cb43b9bcaa1217fa4392917f49d5cd4af082acb14ebf0327e2edb15f48d8bd9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631226, "uuid": "c10094e8-8cb5-4ad0-9488-0bdb8e072e2f", "value": "T195F3BF27724F1450C8A505F496EB9B6E3B2316404EAF5AEBBC7E233E9E730CA15407E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631226, "uuid": "8877552f-19fa-4c75-bd53-29d97d4788a6", "value": "3072:CMgoEc8PCvuE8orM9JzHziRjiPq5qwg3Cth3TJXUZ/qq:tgoEc8Pu/gJzTPCUFCtTX8qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785631226, "uuid": "d1adcc2b-0689-47d0-93ee-a3a7a2ca7940", "value": 165328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785631226, "uuid": "5d5aa78b-5134-4690-af08-444f81d92620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631226, "uuid": "fc8eb182-e991-43b7-9a08-f61221760bee", "value": "zero.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f24796-8e46-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785656950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785656950, "uuid": "7024d5ee-50c0-4647-a890-581f9bca6a48", "comment": "Malware payload (Mirai)", "value": "e50d6e16f2a5443bf1a79040888f0f08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785656950, "uuid": "2adad892-fbf2-47ce-ac56-ef829b3d304f", "comment": "Malware payload (Mirai)", "value": "3419dd8397c7282917e54bc166e0d5cdbeff44ca0b6f074571dad1d09e742886", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785656950, "uuid": "b3d9445a-c4f9-4d63-8850-bc37cbdb4340", "comment": "Malware payload (Mirai)", "value": "bbc0298f4dc18b2118cab202e53c0f3511fd46f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785656950, "uuid": "ad0514c1-e10c-47c7-ab78-8247a2adad73", "comment": "Malware payload (Mirai)", "value": "24d0f1ea6e29b3cd731e883108b3cf911be84177d6134301a182d4c815d5bb96c2cafda7bef7206fab7ecaa8d9427ddb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785656950, "uuid": "ccab27a1-fadd-433b-b284-9af4047037d7", "value": "T165E2F16891DD0221F7FE937BE5EED886B43098E2079BC90134D15B7538BB230DB5E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785656950, "uuid": "04ebc74e-f611-4782-bf71-8dbf4e533291", "value": "768:iIPBQe76Dx/AC2ZAGaozPZgdcPuWYFSUXOCt9UHfw0pdbS/u/b:iIPBb6Dxo7n8aPRAXOCt9UHo0nbtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785656950, "uuid": "0120a23c-7f37-438a-bf70-83aafd642c21", "value": 34148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785656950, "uuid": "47d3dea6-b271-4dd0-9fed-c7732b9e6c94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785656950, "uuid": "f8419514-92b5-4feb-81f5-918ef2638ad5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3227a9a6-8e56-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785663628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663628, "uuid": "e6e4224e-b575-4bb7-9d88-25ed45459bde", "comment": "Malware payload", "value": "ffcca2a80c1ccc7207d3a8e0fc48104e", "object_relation": "md5", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sciter-Terra-Informatica-Software", "colour": "#46F43D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663628, "uuid": "99399856-ff52-4798-b8b7-4247298486a2", "comment": "Malware payload", "value": "34ef24a700926ba1de3366a617dae590fa087fb7a37942bb8ffe51fbe468872c", "object_relation": "sha256", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sciter-Terra-Informatica-Software", "colour": "#46F43D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663628, "uuid": "61f40f8d-b8d3-4c3c-b6d2-39d2dbfcff14", "comment": "Malware payload", "value": "bf9ed1540471faf4bea966462ef08a5c1cc50e8b", "object_relation": "sha1", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sciter-Terra-Informatica-Software", "colour": "#46F43D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663628, "uuid": "142cc098-09ff-4db6-aaea-662309e64d3b", "comment": "Malware payload", "value": "ee3e5312e24ff40d112460022cd98d9e8243a3b26433a46953379a265c89fa59b2b0fe9d69a15a34491f97f9b82e550c", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sciter-Terra-Informatica-Software", "colour": "#46F43D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663628, "uuid": "21bd9fe6-997b-406a-9ed0-602a9b6ae2c3", "value": "T1A2167D5666A901E9C4BAD079CB27C90BD7B2B8160320A7CB12F4579E5F377F05A3E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663628, "uuid": "0fabec6f-f822-4cc0-b8cd-b5c9ecbebee5", "value": "e2527b47c3bfbb25452d04173a96e751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663628, "uuid": "ed0e9e20-9135-4759-9669-b9c63014eb45", "value": "49152:1loM/tz370yjHEhFbPQ6J4frz4Cg6YLXXrvXrSHfj1Bkgxa9BEkCovzWfDq8mbdi:TCy6PCPxHO+xzrtNVxMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785663628, "uuid": "37332aae-fcb1-4441-a28c-dfcf4292f82e", "value": 4231600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785663628, "uuid": "f9b43fc0-43ba-4298-98f8-f2bc34fde965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663628, "uuid": "0cfd2572-c062-43dc-ac98-9f702fedb6f4", "value": "sciter-x.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37acfe01-8e2b-11f1-bd95-42010a9c0009", "comment": "Malware payload (AnimateClipper)", "timestamp": 1785645169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785645169, "uuid": "84bbffcc-ee50-430a-88ec-fd3f7dc0ead1", "comment": "Malware payload (AnimateClipper)", "value": "5c8e68a414254a67111c6167f44ec777", "object_relation": "md5", "Tag": [ { "name": "197b1ec4b9644da7b43669fd4f0ed73f", "colour": "#3D643C", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785645169, "uuid": "0a9c2dc8-049a-4a55-acbf-08a9257938fd", "comment": "Malware payload (AnimateClipper)", "value": "350e3bddcd39098123be338cfcd12ef78a0d6cfabc48a17c6dacf31397880b3c", "object_relation": "sha256", "Tag": [ { "name": "197b1ec4b9644da7b43669fd4f0ed73f", "colour": "#3D643C", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785645169, "uuid": "d8754ff2-2b21-478a-acfc-555cabd52c37", "comment": "Malware payload (AnimateClipper)", "value": "cb5be7c6c404339029a88a7a4ffc0465da77288a", "object_relation": "sha1", "Tag": [ { "name": "197b1ec4b9644da7b43669fd4f0ed73f", "colour": "#3D643C", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785645169, "uuid": "a95fc8ab-1271-4147-9ce8-bada56025f16", "comment": "Malware payload (AnimateClipper)", "value": "4cbfa5d1e5d22b3887b81f09a5214f9524eb26b8fb8546f47016902df429c6fab8d498023e9347c189e3f684b78e43e1", "object_relation": "sha3-384", "Tag": [ { "name": "197b1ec4b9644da7b43669fd4f0ed73f", "colour": "#3D643C", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785645169, "uuid": "02fc501e-dff4-4357-847f-085a84919036", "value": "T17B679D35A3A4C1A8E92FC274CAB54233E6B174451720AACB0355EA55FF33AD17BFA311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785645169, "uuid": "15ba21ac-5311-4773-b760-d8def1f0f491", "value": "8c0ed5311e0eeba51b4c1a13e4263081", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785645169, "uuid": "6b1e0914-dd0a-4798-91d9-da08e316529c", "value": "24576:qC0Pf7dNvVC2cuWnd/ewT96mCTccMQjjf1aeY7Df:qvPfanHT95wlU7Df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785645169, "uuid": "f08a351c-92fa-4f1e-ad6f-164eca8d467e", "value": 31566848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785645169, "uuid": "fdafb666-129d-46b4-8125-51a080a405af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785645169, "uuid": "84db2760-4a3f-4269-9c31-fb45f6c7dbf5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c60beb-8ea9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785699492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785699492, "uuid": "0872f746-348d-406d-ae5c-3de020a700d8", "comment": "Malware payload (Mirai)", "value": "da59b268ef01d47538ed733794366be1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785699492, "uuid": "c0595341-2c16-488f-a865-8e8965e6f89c", "comment": "Malware payload (Mirai)", "value": "35e790ee32623b31fee32c012f415086c892d6f7f3d4d947dda20e90428d25ae", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785699492, "uuid": "605699b1-a09e-47e5-ae00-9fcb0b81bfc0", "comment": "Malware payload (Mirai)", "value": "e82ec8f0ff02391558e33363cf0fe30e52439f81", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785699492, "uuid": "bd4da788-1c0e-4a9f-8686-5c1b5355e182", "comment": "Malware payload (Mirai)", "value": "178e583476c6b4b421c6ec351ce8fcb330370e03f3509d6ec08d494c16b956bdde1a69e01d708e890e5817e6b2863823", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785699492, "uuid": "b52d0d56-d1bc-4f19-aec4-a0efba8d26d4", "value": "T1DEC080F6413454739504C54F33DC819971544CF55DD6F43D58174C71840F55C70057A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785699492, "uuid": "d61d1424-51db-4bed-b25e-f039061fcbd8", "value": "3:6SDtFUSKjJUWu7cy+iQQ3ZN1Ltq286iC8u7cyY0GNIa0dog1VZHevDv:5DtSZJUr7x+lqZNZY96iCt7xY0axdJvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785699492, "uuid": "944d783a-cf28-487b-99c2-e801c42a0894", "value": 166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785699492, "uuid": "28b9d702-8ec0-4d68-802e-7360ce7aefaf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785699492, "uuid": "5c355a69-5016-4cf9-9b6c-2018eeaba583", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9aea9c-8e55-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785663513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663513, "uuid": "e393d208-7e72-4494-9ccd-2147639ace5e", "comment": "Malware payload", "value": "dfc02c8e79ca44f5093fbc836f8b3c39", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663513, "uuid": "d33d87e5-e198-4fca-a429-afbe3889d6a4", "comment": "Malware payload", "value": "374cd36ec5df4d9c611c72ef3a070bd916117dea8fd86f3dac4a893cb3dbaa9b", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663513, "uuid": "3c2d7e5e-d6eb-46b8-af16-9f63ea36abd3", "comment": "Malware payload", "value": "46fe4a3eae631c56b24f611b66c28fd06d27567a", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663513, "uuid": "7b150ee2-c392-4c80-b4e7-bad5111c45a3", "comment": "Malware payload", "value": "99a48d1094845ac04fb2e4455d2db9152ef264d0e1a5f4bcfef4a278f099a2e7d5048f0a79619c9eac3e8f64a781eabc", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663513, "uuid": "699cbafa-25a8-4c8d-bea2-f3d8ffbf10f7", "value": "T192066B03BE5949E9C0D9EA39887B5216BB70BC08473133E32E60BA7A2F763D05E75745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663513, "uuid": "a101e8c5-e02d-4d7d-8a6d-7d5405fdb294", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663513, "uuid": "e1417b32-ee8a-43f7-8e0b-9c5be0b5e6e8", "value": "49152:oGZaP10nhN8PEnIheZwBad1Kr2c/pu6W3W9xXilRSml:oxfDdhWj3SW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785663513, "uuid": "7cb24cad-190f-4f08-9ec0-0449395d824f", "value": 3724168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785663513, "uuid": "476bb137-4811-43e8-96b9-6d5a618acc20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663513, "uuid": "7730f22b-0918-49c7-b717-9aed5ae8630a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d970bbc2-8e55-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785663479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663479, "uuid": "3d2c6942-ab99-4535-a841-515d46cd8e4c", "comment": "Malware payload", "value": "3d393f2bdb67d15602a96a1496a82942", "object_relation": "md5", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663479, "uuid": "3ef452ae-f325-45c8-ae88-5061babf3cd5", "comment": "Malware payload", "value": "3d4e7187f74de912f9d52f5ba6a95bd41868348b16583d72957d732c0ed8f0e7", "object_relation": "sha256", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663479, "uuid": "260a20b4-8c7e-4eb7-a4fd-5ecbea4ced5c", "comment": "Malware payload", "value": "b42cfc33c90e2f2666e6a347969fea05ed09cae7", "object_relation": "sha1", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663479, "uuid": "5fd82a60-cca5-4745-b0de-3da1f4c1c75e", "comment": "Malware payload", "value": "bab0a3c89519b2c1dd6f01ce737164023177877484539835bd4014c197e448fb42d8fd375c43a90155fe9fda184dd9bc", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663479, "uuid": "cd3cdb19-20de-45bb-854c-a34f0ba3f99b", "value": "T1C5330A1ACD16906BE31E8CB4CA434D06EE72BCD78BA4B5CF57802DD60966FE49B3D601", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663479, "uuid": "15b10829-268f-4f79-a70b-a557c5b32cc2", "value": "52ea5ad554ee27678395eb35a79659f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663479, "uuid": "acf104b9-5eb4-43c8-a3e5-ba34262bb234", "value": "768:3oGT2neTPuiqiR0OLBaiaQ5zax7cdjmcoaj88FDA3Qfx:3onEPpqVOtn5zax70jmUj8nix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785663479, "uuid": "2bb7456a-341c-4222-a549-7b75983d589f", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785663479, "uuid": "5183fb04-b413-44ba-9506-4458d3c915dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663479, "uuid": "fb70ba88-5ceb-4b91-9a10-31410773b25f", "value": "text.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8016c3ea-8e54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785662900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662900, "uuid": "9a6e0839-677e-47e2-a4d3-7cae83b71bd3", "comment": "Malware payload (Mirai)", "value": "d0bc1c7b9c20e9d7fd03c76c184b4a07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662900, "uuid": "ac2b2e2a-5549-4618-8367-220654a91fc6", "comment": "Malware payload (Mirai)", "value": "3dcff7e3ded3bf19981d30151dcaf48915e545d569eb97483d70aec1b7db70cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662900, "uuid": "3830bba0-8fa9-483e-bb32-710a35362901", "comment": "Malware payload (Mirai)", "value": "f7ff0c4b0402f715d6dc0e25a9ec4a14a3ca3356", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662900, "uuid": "49f07e59-1000-496a-9cec-129416929c11", "comment": "Malware payload (Mirai)", "value": "7ff9107b209bbd0b367b5c70694a51a8724841511d37a12f4448a01357f9d6caa0f1bfcf2219d5cacaad309f7268a8c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662900, "uuid": "58367d68-99c5-413c-904a-e123371cf888", "value": "T131630855B8939F1AC6D21677FF1E434D332623A8D3EA7213DA056F6633CF42A0E2A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662900, "uuid": "6f9516f6-8ab7-4fa9-a4bf-ef6c6a3a1e75", "value": "1536:qUfzxROOxFIrq+ROyi0hM0/WYkQ5mNT9SNZcQGFEEbBX9n:qUfzx0OxCVZh1/WHQSTQHLGFEEbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785662900, "uuid": "a292dc2d-44e0-4719-9376-f4131e4e57b8", "value": 71184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785662900, "uuid": "083ea52c-31f5-4541-b9c0-127ce332e635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662900, "uuid": "b5a18d8a-d76b-492f-aba9-25d9976b9e95", "value": "EyMl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9175088e-8e79-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785678820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678820, "uuid": "a25b2a74-45d6-47d0-81ba-2163df470dfb", "comment": "Malware payload (Mirai)", "value": "e6019ad71a3c2d1770f686c7bac62cab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678820, "uuid": "6304879b-b9b3-4dbe-9bc2-9818812945b8", "comment": "Malware payload (Mirai)", "value": "3ee803dfc08cd7385b83fa53296f806f37015762c023933647bc60e8d7a209d8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678820, "uuid": "097cc6a8-1b4c-4492-b5f9-b5e7ab518ca5", "comment": "Malware payload (Mirai)", "value": "c3fd5a6a5bf5a4e34a68eaa8668b1ebe45123348", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678820, "uuid": "e5106655-4158-4ebb-8c32-121a0269d1ce", "comment": "Malware payload (Mirai)", "value": "17d43a7c85cb28202a13ddcc62b2e4bf8acf84a87fd59ef69f28f1a4bfb270563bfec325ae810d0774f6773597fe40bb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678820, "uuid": "55cdeeb7-3e37-4a03-a318-d8c574ffcf80", "value": "T18D314FED6020905316C9DE22B3B245ADA017AEEE34E88EF7FC655C325C98740F139B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678820, "uuid": "4c727cd0-a12d-4e8c-8773-abcddfd944ca", "value": "24:TDJ44eltnrPf75z1VwEF0E7G/lft1h81dV5/RnTNI7DzK0NfiecFFYbJvA/xPS+p:TDJAbnrPfJ1Vws0Dl3h81dV1RnIDzF1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785678820, "uuid": "047b2be6-67f1-482b-a432-49f84ae47476", "value": 1486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785678820, "uuid": "93e26613-0efc-4f04-a744-1162df5be02f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678820, "uuid": "9af3fff1-7cce-41d1-a2de-4c1c572ee3b5", "value": "payloads.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4222bb-8e74-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785676825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676825, "uuid": "2c401d44-a5cd-4769-91bf-825e3d39b00f", "comment": "Malware payload (Mirai)", "value": "9189b7c07b337dcf37949fd6ea3f68b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676825, "uuid": "2e2e121e-7eb9-4049-a373-9edfd7aaf607", "comment": "Malware payload (Mirai)", "value": "3f9757d7728c27c681312616b92d50034654cb8f139d56f676c475009c88d646", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676825, "uuid": "a919ffbd-c531-4fbc-a174-6215a2c8c342", "comment": "Malware payload (Mirai)", "value": "203f895c65dc299d64588cd3ff6857a8283c4f1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676825, "uuid": "2101c6df-62db-442b-bd51-0271e0e89ead", "comment": "Malware payload (Mirai)", "value": "69cb9b40e2fa0809cf5a7cf791775e27a1a38cbcc98ab92f2b7e38fc41f2229a3605e143960c6df171802ba9c32a8840", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785676825, "uuid": "c15b9ffc-de19-4b49-a2e8-f5ca837b4fe8", "value": "T15F832A16E6A364FCC18BD07087ABD562B932BC6502203E7F2B98FD752F74F502269721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785676825, "uuid": "e0cf8e47-9936-4f26-b2e0-7c1b7c1b6a09", "value": "1536:2lzFbRr5see3xqoo8XomDR7OCnbNuLPcck0qVcYKorp4E:ob15sTC8XoqR9CP7nYzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785676825, "uuid": "4d912efd-c323-4a2a-becd-90ab520e1dfb", "value": 87760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785676825, "uuid": "a83cae0e-5be7-4771-af85-7b6ef5a7e15d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785676825, "uuid": "d1bc8cf2-6622-4b42-bdc2-2b49659e12e4", "value": "xmr_miner_x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16ae00e-8e75-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785677236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677236, "uuid": "7fdde845-451c-4859-affc-22173550208a", "comment": "Malware payload (Mirai)", "value": "292409d9644234a18929dcc5e7c62ca5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677236, "uuid": "e05367a9-5d86-4ba9-a515-579fb6c55384", "comment": "Malware payload (Mirai)", "value": "3f97e89c7969f3b91d47fa62ef6c6e42bc7c820ab6e798bfdab97149cd923fbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677236, "uuid": "732e0c3a-754d-4085-9f26-1c4a804c77ba", "comment": "Malware payload (Mirai)", "value": "eec21addedf521c864f0e4d670903c0d56c30982", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677236, "uuid": "25aeb7a6-2910-4abb-b4f0-ce13a833d1bd", "comment": "Malware payload (Mirai)", "value": "73c7436bc42162007d4e48706cc271ceb015e76c64a919d153c0eed5ddb962a0d79c2b9df1c845ec9c7d070f225a6c28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677236, "uuid": "fccae8a5-35b5-4cf1-8ac5-02b7bc093d52", "value": "T17E833AD7F801DDBDF80ED77B4453490AB231A3910A830F3A6757BA67ED321A45826EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677236, "uuid": "fa2f91c7-63c1-43ae-9ef9-4e10316a1c47", "value": "1536:ZjJGU3HNqYvQtGuNM6W8FwGXAyy/QKYVZJfC4IpehmFVbVXHtA:pJG8fYtGuNM66X9QNVzDhmFBZtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785677236, "uuid": "a12f5673-d082-4306-b93a-8f44854d1ecc", "value": 82080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785677236, "uuid": "727b2aaf-a5d4-40c6-972d-b60d1890406d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677236, "uuid": "826f61b0-3826-45d1-8c6e-4b4b02171a08", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785b9d7f-8e79-11f1-bd95-42010a9c0009", "comment": "Malware payload (NWHStealer)", "timestamp": 1785678778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678778, "uuid": "46f07866-9fc2-4d8a-8ba4-f8e7139f85aa", "comment": "Malware payload (NWHStealer)", "value": "c7be2421d4b0ecd2a630e4e4b3d3b1ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678778, "uuid": "07473555-4367-445b-afb6-05b73869e658", "comment": "Malware payload (NWHStealer)", "value": "40130f46a64522de4fd9a339f1b6b6656dce39b709a807cbeac4c9562ce3d9de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678778, "uuid": "6bcc2b1d-9da8-485a-931f-266f81767e69", "comment": "Malware payload (NWHStealer)", "value": "f106b6895b70eb29c1437362e6816866b2a865d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678778, "uuid": "0f339c3a-aaa3-4457-8ed3-5f417bec53e8", "comment": "Malware payload (NWHStealer)", "value": "f6b1ce65a82eafbba299d340dd21a46d70f99216070f0e3d1400b2068f536c37332ce1faa2c9984ce8d76f37084d3fa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678778, "uuid": "f66fef82-b29d-46f9-9fc6-108c624ba895", "value": "T1D6286C43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678778, "uuid": "caad3cb4-3727-416f-95e7-99cc4de7671b", "value": "fd6f6d07cc33ee9a2b65bda58a07bb94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678778, "uuid": "f6a432e6-03fd-4900-8fbb-d012be5277fa", "value": "1572864:aZa7hmguP2nG0/Vyv7UhgxIabc/x7Awby:aZa7hmguP2nUOnAwby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785678778, "uuid": "4ceb7c35-3341-4873-b9b0-028b4db1a667", "value": 97862656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785678778, "uuid": "7dadea9f-3dc8-4c3e-9e31-3f4b4c21e061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678778, "uuid": "78093b46-55cd-4ed7-9f70-1dd61bc84cc8", "value": "app.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ff1afc-8e7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785681346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681346, "uuid": "c3ac984f-89a8-4515-81e1-da3c6c7e4762", "comment": "Malware payload (Mirai)", "value": "55a69506a7a8aca159a9bc29877cd46a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681346, "uuid": "3aea95bf-8708-468c-bf37-556f8f06969f", "comment": "Malware payload (Mirai)", "value": "407f81370bad7fcc8988012886d8a36ac39b5e713b840af0783d9147bab34746", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681346, "uuid": "e1dc7161-7690-461a-9fe8-92e845d768e4", "comment": "Malware payload (Mirai)", "value": "8a7c22d0acb0e83231aec6296c84b21872f30504", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681346, "uuid": "ee905285-ee2e-4a47-a898-9f6a0a36f450", "comment": "Malware payload (Mirai)", "value": "3bfd20e4c4d9b92fb30f298101bcdb753e92f66e0c7cd076cdc5afd66c0d8da661d6e65c4f777ac9a7a6f38f8d696f32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681346, "uuid": "82ff08f8-82e4-438b-af81-6f2f48936595", "value": "T16E43F122E263AC70C2304BF869ADD24931FE41E995E2701BE0538650EEBB76751C8D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681346, "uuid": "60e8cc9a-dff0-49ed-8517-363ebe35ddb4", "value": "768:OId1dRYNdmU2XF2fc3Y0Gc6in/gMhP4DaFeWhMugL8mRUhsWErhx7Nf23z26JCQA:OIdC+nv3Y/2CAB88mRU8hxmgcXTn1zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785681346, "uuid": "e29ed65a-0761-45c7-9ae7-5712678fccbe", "value": 57872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785681346, "uuid": "57a67cd7-192b-49b5-8375-f6a06eb1e311", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681346, "uuid": "7343157b-f550-4205-b644-7194de9adf9f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413efb5b-8e0e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785632730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632730, "uuid": "dd2e508e-d524-49a0-af90-567df686cd58", "comment": "Malware payload (Mirai)", "value": "ee6960c4bbccbc8a409319dc7a628b6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632730, "uuid": "15b27939-b416-411e-a098-9a4885fa54e6", "comment": "Malware payload (Mirai)", "value": "409629d29129fcd72a0d48d11773a1c20e81a721c8346427b3c1a1a7da135892", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632730, "uuid": "5f9a2a8f-0eac-475e-8ee2-0012d03c43d2", "comment": "Malware payload (Mirai)", "value": "c91f387e9b40854bd3d4e8c1650a320f5f08ea33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632730, "uuid": "244135d6-2f9c-4177-8bf3-83cbf9292cc1", "comment": "Malware payload (Mirai)", "value": "9fd1722ac81ce05b69c7399501065494145bfb1bab5e3e4081af65acf4252d0c3db8ce625ce771c9a9f59ba0325ddbd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632730, "uuid": "8f9d4e48-aa2c-404a-bb91-f1866f7332fc", "value": "T166230211015C75A09A704473BDED8249218B4AD5E6FF76A81A172E20F8CD3CABF7338B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632730, "uuid": "deec58ae-57e0-45b4-93bb-d8b90a80127c", "value": "768:011vnkyvkY1Ok/1wHEQ2Ctdx9ZoPUaaIuzJPvotDunA+LGgj8u5gSYT5vBUapGs9:YNkyM6O2CkBklZubanztMuAQjQpBUap/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785632730, "uuid": "8996f4bc-0a09-4d4a-b333-152db3252078", "value": 47300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785632730, "uuid": "a0b39921-495d-4667-acdb-e281ff4f8588", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632730, "uuid": "4b6d211f-25d2-42e2-bdef-12b0a8615b5f", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5295185a-8e79-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785678715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678715, "uuid": "162bbb6f-4796-47c9-bb06-3a5545ff68f8", "comment": "Malware payload (RemusStealer)", "value": "7fa874af3b68611e899bd3dc8ecc45e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678715, "uuid": "cf242947-abec-452e-9eda-1b48c3dc40a0", "comment": "Malware payload (RemusStealer)", "value": "41dbfcca18129caecd4a958132d0346b6ca0c30bc8b06abf4e776bd2715e7244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678715, "uuid": "366d73b0-dc90-40c5-9bc1-78482b68cc38", "comment": "Malware payload (RemusStealer)", "value": "71458e1d2eefcb903db2ca9f88ab6ada7a60ff8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678715, "uuid": "5b10edda-24cf-4851-90d7-f44727ab558f", "comment": "Malware payload (RemusStealer)", "value": "0c470e152125787daa60dd3488609db8fe942fb8068609e4a618e7344e1e715c14588de55e37bfedc438757431f295f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678715, "uuid": "f8c00fd1-0f34-4fa2-bb17-c28a608835c5", "value": "T1F826BE07BCD248F6C0AAA33189B652567B75BC084B3127EB2E90BA783F727C05D35B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678715, "uuid": "aca7a0a7-bcb0-4436-8fcc-737986754365", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678715, "uuid": "0bbb2700-8380-4447-8b2f-430b41013239", "value": "49152:WV0tIeHzkUMbNr6PJnD/3muWAywCYNIKYvMBWvVBX7uxWE+RFdfTUpD1c8OggtRx:WROJnDOuHCoVobZE+RqDlgtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785678715, "uuid": "3aa7d33a-b1d2-4da8-a3ab-755ef30e81ad", "value": 4634992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785678715, "uuid": "5ee98252-c686-43eb-8bdc-684b33fabb6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678715, "uuid": "2e29943e-67c4-4855-a3a4-d95c8f2b2087", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f9aa6f-8e17-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785636677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636677, "uuid": "92aba3e6-4a40-4ea4-994a-c7c5e288fa5e", "comment": "Malware payload", "value": "e4b8aabe7d0636beb834053f87aecfd9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636677, "uuid": "d0ce51c3-0c01-46a1-b42a-4867d1c492b0", "comment": "Malware payload", "value": "420dc609a9852388f9bf158e1fb7aa73032fbd7090e8217df1af504d613af30c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636677, "uuid": "2b5dc524-d38a-4104-af84-d037deb6ea81", "comment": "Malware payload", "value": "98caab35ee49bd4e459cdbaaa4b4863e6915ef15", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636677, "uuid": "c8ec2f3c-5c58-41ba-86da-0c9e4f0737a6", "comment": "Malware payload", "value": "a8c1c52d84b135bf203448cd7ec431c1dec9e5a55b50bd265f38f6a70170f49d444977ac079d684327292b7c656c389a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636677, "uuid": "39ad7396-b346-4760-aa6d-cbb2329d6afb", "value": "T13DD02EA2A06341B010928810F6D69800B184D36F4C55C619FA9354302F10284F0C93B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636677, "uuid": "cf9aff8d-4297-409c-aa54-f1031fb98eff", "value": "6:hTNpF5S7x1cnN3FIvCFpAulNXYq9DG+NjVsNXYrkJ:VNrM7xobIOpPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785636677, "uuid": "3a36a669-d084-4e1c-b58b-b7d1b38441eb", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785636677, "uuid": "5e6989ce-7820-48b2-ae6c-a870d373a30e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636677, "uuid": "35b74fae-6279-4b5a-bcfc-d65b57d420cd", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2852a30-8e6f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785674661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785674661, "uuid": "8b284201-ba70-4e7c-827d-bebef4ca61b6", "comment": "Malware payload", "value": "26869cd3e64c67cd34c2db399a38e784", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785674661, "uuid": "f1fff2d8-1069-4b0d-bc41-83d9b5e3434d", "comment": "Malware payload", "value": "426b4376bb5ec406e676bc36a8b7b79b9d731055193c34a64ba0ad941d521d0f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785674661, "uuid": "0e30f909-7466-4f09-8416-aa18fc4e2f51", "comment": "Malware payload", "value": "dbff9d7d3d3dabe95deec74d2823f732520eed1a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785674661, "uuid": "f8230127-1cea-4115-b8cc-7d3de5cf982e", "comment": "Malware payload", "value": "ed380c6963f7ad7d57f3059edc3d1d65fc576389b896a6f9518a235b015e89adf488094f79776ceb3fb5d901707ea040", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785674661, "uuid": "91744d19-22cb-4d75-b85a-e24d17b0e6de", "value": "T117015ECAD130981040AAD4AC2AA75095F831C3C3171B0F79BF6CA83DEB88D00F066F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785674661, "uuid": "7560298a-cb7a-4963-ac3d-babfbad10396", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaoC3nuXC4pWFHXCUHabM11C0rCGD0X:kXCKysE2hi0ziQvZohaoPXnU3mILcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785674661, "uuid": "e35a3fe1-cccf-4905-a1e5-88de24b0bdd9", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785674661, "uuid": "fc7cbdeb-0385-4b43-ad39-16c76250eca2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785674661, "uuid": "aca33056-19f9-4ada-b15d-d02444c526f9", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fac64f0-8e7d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Seduploader)", "timestamp": 1785680508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680508, "uuid": "57af545d-a81f-4797-bab4-68b430d6e935", "comment": "Malware payload (Seduploader)", "value": "50b0b7d854f14594d419cce69a66b517", "object_relation": "md5", "Tag": [ { "name": "dropped-by-HijackLoader", "colour": "#8E2DE6", "exportable": true, "hide_tag": false }, { "name": "mrarmksmsx-com", "colour": "#D98F12", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "not-Seduploader", "colour": "#C08E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680508, "uuid": "222d8363-e9d5-4f2b-b742-9eab0d6c6150", "comment": "Malware payload (Seduploader)", "value": "45e71fb42e9fc51f5d8f6f6b2d5daf24f3b7f3e8850e6de1235dc78c60d7a8f5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-HijackLoader", "colour": "#8E2DE6", "exportable": true, "hide_tag": false }, { "name": "mrarmksmsx-com", "colour": "#D98F12", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "not-Seduploader", "colour": "#C08E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680508, "uuid": "8c221c92-6f3f-4395-9dab-22b929695cb9", "comment": "Malware payload (Seduploader)", "value": "9c7705850f70aa3af850dba47ea5a78de3077f57", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-HijackLoader", "colour": "#8E2DE6", "exportable": true, "hide_tag": false }, { "name": "mrarmksmsx-com", "colour": "#D98F12", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "not-Seduploader", "colour": "#C08E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680508, "uuid": "03ff93dd-775d-473a-b83e-1f3984bb47eb", "comment": "Malware payload (Seduploader)", "value": "72ec599fd0729d012aef0fc799de4a37aba80b36174bd62ddc678bf528ae13738b768e9eabedc8f58ed1cdb518a963fa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-HijackLoader", "colour": "#8E2DE6", "exportable": true, "hide_tag": false }, { "name": "mrarmksmsx-com", "colour": "#D98F12", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "not-Seduploader", "colour": "#C08E23", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680508, "uuid": "e5db3439-a7c0-41a5-8d82-49faa7c4e873", "value": "T1AFF7339BB4046C63C6DD043E953F6B3AF6610EF3760005626463BE9EDD7124A4B9D3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680508, "uuid": "96b012fd-d5a1-496b-9a0e-97c168e1f215", "value": "1572864:pSZm7O3jPaLd4bN4LZAw5GGxITqLAVrPtDJw+CTRbdO8iUBYNzSbBC4P0:A6Cj6d4bNIZAwcGxiqLMtDK+gdO8hBSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785680508, "uuid": "2f2a69a2-8137-43ae-bc8f-933be0810903", "value": 75126316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785680508, "uuid": "09b8ea3a-d48d-43b8-950d-be9bebf49de4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680508, "uuid": "ef66f238-f10d-4f18-964f-19ef7be437fa", "value": "EasySuiteSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2bdebf-8e4d-11f1-bd95-42010a9c0009", "comment": "Malware payload (BlankGrabber)", "timestamp": 1785659964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659964, "uuid": "f90f9881-2c40-4ffb-9925-3c170cea8778", "comment": "Malware payload (BlankGrabber)", "value": "f605e830329bcb2d6f7b9dbdea4f75b8", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "PyAgent", "colour": "#450ACE", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659964, "uuid": "ed1070f1-b4d6-4373-bfc7-c98cb90b54f7", "comment": "Malware payload (BlankGrabber)", "value": "46268916a2daa6d1af68366ec1baf9bb2514a4486395288c9118019f1f49fc32", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "PyAgent", "colour": "#450ACE", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659964, "uuid": "49dcedfe-d0a3-4dd6-aaaf-6404bedee5d9", "comment": "Malware payload (BlankGrabber)", "value": "ea16b84b1479edaa6b359525a8299ed3b6f2c958", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "PyAgent", "colour": "#450ACE", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659964, "uuid": "10ec8572-1698-4ceb-b679-45883c754f1b", "comment": "Malware payload (BlankGrabber)", "value": "5b76cf02a6219f6bf911d0280b0db352d4fd5362f2d6ec17ad75e32d85973e7e54d349f45d5ccf72da10742b8c097983", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "PyAgent", "colour": "#450ACE", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659964, "uuid": "040de89f-7741-4184-b4a6-19efc8668641", "value": "T1CCA63389D36405F7F6F3423DC0C2D5B5AAB2B5260775CACF02A481562E370E59A3EB36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659964, "uuid": "25412039-03df-49d8-8cd1-120fb0a3965e", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659964, "uuid": "1b5fc932-6a85-4e34-a71c-28e440bd1294", "value": "196608:HY8P7C4JG4QHqqNKUB4gKwyB4k72PNmKzQjeH3g/pEDudnpHXOwA:HD+4k9NKUmgwB4k72PNNzQjewKyPHXOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785659964, "uuid": "2bb1eb0c-3457-4ca8-9996-16b4f0e5117e", "value": 10391192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785659964, "uuid": "8f82193b-0157-4117-9f0b-366622f8b0c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659964, "uuid": "b26f0a9d-0348-49f1-8a1a-14f0c070fa70", "value": "ZapretX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da038b8e-8ec4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785711154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711154, "uuid": "1baa3800-c6eb-46e3-8b38-39d6d8f10e14", "comment": "Malware payload", "value": "e7ce22213122e05bf441624ec748209f", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711154, "uuid": "c93f69c9-3354-4505-a0d0-184328e1c0a9", "comment": "Malware payload", "value": "46470c9a7ee889553a1861cc782cf4b938d6712364a25c095ad5b50cf2f826f9", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711154, "uuid": "d332aad4-d981-44df-9edb-06be2ee69c91", "comment": "Malware payload", "value": "98959ed8341204208848014eb9ba686af40ae790", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711154, "uuid": "bcbd41ea-5e06-48a9-980d-37f24a31a462", "comment": "Malware payload", "value": "b401f33e36a9c91239ec160f85dc7e8f27447a246015e8018a0ae250f7be44f212f537b845bc44fa6f1b9fbea8a460ed", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711154, "uuid": "7a729862-4291-453e-babc-c60cf59c70a9", "value": "T1FAD5229DFCB21271E432C3B38683256DB12A774183B48C9776DD5B102E53909AC7E2BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711154, "uuid": "e4848439-5579-4bd2-9d7e-761d68fb477e", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711154, "uuid": "5484942e-cfcd-444e-b0a1-99309f73a7a9", "value": "49152:ZLUrhaiiXCjYucFrKuOdkAxcHW453qj86A8TRkzkr57xa4GOZhrNiBF/OFXN7wIu:ZLPyETrFOdkt/qjgW6kr57xa4hZZkX/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785711154, "uuid": "7db03af6-0be3-4fb8-887e-481839a3fce5", "value": 2957824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785711154, "uuid": "1c5947d0-3228-420a-8470-2f62d45707ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711154, "uuid": "0c59d3b0-4121-4566-b1cb-fc1d962aff28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462a7d4c-8ec9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785713054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785713054, "uuid": "00d2fac2-7730-4b54-8a84-cc2d02359d0b", "comment": "Malware payload", "value": "bc0b91d4a1ae518c93180b337b9b7a2f", "object_relation": "md5", "Tag": [ { "name": "curseforge", "colour": "#B36F62", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785713054, "uuid": "05c3c8f8-1a09-43b2-be94-5f142e27529b", "comment": "Malware payload", "value": "46e7c38344a335e4c6100799372959a12fc17781bee2352ef2797633b657bbb0", "object_relation": "sha256", "Tag": [ { "name": "curseforge", "colour": "#B36F62", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785713054, "uuid": "9fee13a3-1e3c-4a4e-975f-661639566219", "comment": "Malware payload", "value": "aae1ce877d8d26079ea8e19e21b55df9109cebc0", "object_relation": "sha1", "Tag": [ { "name": "curseforge", "colour": "#B36F62", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785713054, "uuid": "302914e2-23c5-4e86-a2d6-12027749c9c6", "comment": "Malware payload", "value": "9e44100e0a98cb1c94c428b73227281bf2f8849a9b8f6bc07468f6677ea634434afe6cbf484801b2a583620a21066c55", "object_relation": "sha3-384", "Tag": [ { "name": "curseforge", "colour": "#B36F62", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785713054, "uuid": "f375d911-e976-4788-aa3c-bf7f998edee2", "value": "T16305336B78F1DE34D543727C3943409ED57D259A3B8BDDF0AA3020D0BD844288E5B9AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785713054, "uuid": "2f22f8f2-a42a-48ed-8462-f27445916154", "value": "24576:sZWt7uS39zcwAd7dR2cvBuUnppKtCSckQt/USj:xt7uggw49vEQKtwhUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785713054, "uuid": "3ad1a415-347f-45bf-b8cf-0800f9b45930", "value": 835161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785713054, "uuid": "631f3f95-5196-486f-8a1e-dac801afc5de", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785713054, "uuid": "0a1b6370-3283-448d-a9a6-a7efb48b6d36", "value": "echovoice-beta-1.0.0-fabric.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d2b947-8e14-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785635428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635428, "uuid": "75a34447-69c1-42c9-aa3d-87aef9e6f9e6", "comment": "Malware payload (Mirai)", "value": "306993c1b784ba238ab3bf35df4dc737", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635428, "uuid": "2000e4f4-d7bd-4044-8c26-21a35d265cef", "comment": "Malware payload (Mirai)", "value": "4744701e8d7db089167a1709509f1f07c46323d85bdb48ba1d96921386507e1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635428, "uuid": "6a1ea481-de8e-4dea-ba48-96baf1f7acbc", "comment": "Malware payload (Mirai)", "value": "cf6c65203bf30c33277f64d7fa43b1480db01c95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635428, "uuid": "f2f8e3d3-5854-47a9-a9d2-8d5cf192d9af", "comment": "Malware payload (Mirai)", "value": "42da4145b9db531359ce0d53b53f721e161412bd846858d5b7f4027125793e2aa7caa6c5cc604e9b9a86f174032993bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635428, "uuid": "82bad90f-a794-457e-9b4a-19048a8654e7", "value": "T1CDB36D22B8391E27C4E0987B22F74766F1F657D914A8CA0E7E710E8EFF255503607AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635428, "uuid": "b416dce9-84c7-4c64-8638-d3c20d5bcd85", "value": "1536:/B9LXhde/3t3H7XL3Tj0IfSLeNaNYfwr8vpdzvKtnnnW+r4eCHtCJmYm5XY8RJBL:JFahbe8v2nW+jIQJmYOoFc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785635428, "uuid": "3caea51f-4707-44bb-bd9f-b0543e5694e7", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785635428, "uuid": "ae11157f-6659-4787-a4da-096d34fea98b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635428, "uuid": "3fba8adf-98ab-4302-9995-5b1a5cd3e539", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4dc5151-8e7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785679309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679309, "uuid": "b099bfa3-9b6f-4453-b438-ce6cf4876725", "comment": "Malware payload (Stealc)", "value": "4f8d31ea9c92ca7d2da3c6438f1c8ea1", "object_relation": "md5", "Tag": [ { "name": "31-77-228-62", "colour": "#C5E2CD", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679309, "uuid": "bcbeedb3-34e8-40a5-8cf2-4198e337dadb", "comment": "Malware payload (Stealc)", "value": "47854afb3cfeb64a85dda148e00e5ca83168f431a28e5c5fb28733e37f484b13", "object_relation": "sha256", "Tag": [ { "name": "31-77-228-62", "colour": "#C5E2CD", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679309, "uuid": "41871bb8-655b-4ebc-bccd-b7f6e530e33d", "comment": "Malware payload (Stealc)", "value": "23039d7c9ae5ce061abef48d04444983d3da15d1", "object_relation": "sha1", "Tag": [ { "name": "31-77-228-62", "colour": "#C5E2CD", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679309, "uuid": "bb0aa75d-34da-4e4e-aa1f-9ddbe6595983", "comment": "Malware payload (Stealc)", "value": "2d97273fd5b4aab671bc5da7197fdf77ee9844cdef2ffc579cd460766f293d3aaf9c76d9ca110000a72b8e7b2fb6dd4e", "object_relation": "sha3-384", "Tag": [ { "name": "31-77-228-62", "colour": "#C5E2CD", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679309, "uuid": "69f7afdb-6297-41e8-a2b1-f0488810bc9a", "value": "T181A5231223E94482D4BA173A89F554576A31FC628B7236CF72D6FDAE1A13EE4F430316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679309, "uuid": "b7ea98a0-02a7-4afc-a2a4-a06d7dd98951", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679309, "uuid": "90bbbf5f-af28-43a1-ba37-4810af4454be", "value": "49152:BmTaEKDOfJ+XPE+b/Ap8miduNrCIZJ1q51SAP:B8PKR8+Lmid4rn1qC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785679309, "uuid": "5eeb4a7d-95f8-47d7-88d0-dc76db3345cf", "value": 2181632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785679309, "uuid": "a3d89e36-b83c-495b-bc50-b53519003091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679309, "uuid": "b54fc2cd-0c74-4765-bdd5-286fa0c7a560", "value": "PhysicianBed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb00bc1-8e4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785660481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785660481, "uuid": "6d1fe547-4e73-4a5e-b27c-860522a04161", "comment": "Malware payload", "value": "6f29fbbcf60b88c97f26623987ae0970", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785660481, "uuid": "ce71f3f0-2f09-422e-a1e2-5858b096bd76", "comment": "Malware payload", "value": "4828e5ae7a7a82ad0fbcc3380cb9d7213a4cbd3ff2911ebb72c8520766d9010b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785660481, "uuid": "79da05c1-983b-49d3-a0a5-36e042883f6e", "comment": "Malware payload", "value": "edc347bc0bed5fa7ef873fbbcfca15867801cd10", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785660481, "uuid": "fa4f128b-bad2-4fbd-8e3b-97bc675c6891", "comment": "Malware payload", "value": "cfd3e72bf003bed3e06e20319f9808b791803761b69216df317d0c808de6e623e02290d65f06adb0c645ae477515ee23", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785660481, "uuid": "54d96c16-ae82-4a05-acd1-0ef824ceae68", "value": "T1AA145B765B63FDBE2B7C388490422E4A4E6C678311549199ABC830FA53FDDD0CD1AAF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785660481, "uuid": "35399ced-ce59-49f0-83b1-76ee53b5d0fb", "value": "3072:bJYSJSwdkFg12nEIkQtKEZ9+1NioD41Ues8pa/97zWXt:ldkFgEBFY7Nik42Ga/97zW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785660481, "uuid": "522dd640-ccc1-4f96-8d52-c1aa3f6f6556", "value": 202933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785660481, "uuid": "5cd43370-bda6-4ee5-b030-d72fa0039483", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785660481, "uuid": "eeb1bc9c-ef4a-442a-b649-fc7df8023e50", "value": "general.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be541aa4-8e3c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785652696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652696, "uuid": "81f857e6-05da-405c-942a-849889fb0369", "comment": "Malware payload (Mirai)", "value": "d56ed677cabd7043c2d8c942bce5a320", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652696, "uuid": "7376e251-dbc4-4d68-af49-a4ee39a61027", "comment": "Malware payload (Mirai)", "value": "49878557d15cec49fd5c1edd1f62456b9dc325fdced8aeeccf058fc0d879f42e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652696, "uuid": "9ee714ab-f106-4ab8-b8f2-256a059bfe0c", "comment": "Malware payload (Mirai)", "value": "6ceeb11821c4d101f04c2d9ce94aa556b539b068", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652696, "uuid": "14e5ca28-2129-4259-959f-5d1954e745bc", "comment": "Malware payload (Mirai)", "value": "478d609ce67f5ccaf0d4fec49b034ce3e4f3e0706b0d0e110162a6e25d1ff9ecdddd017d7ac78d15c9d8e72f7241cbbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652696, "uuid": "22be3d44-b60c-4d9f-b824-0e86ccc805aa", "value": "T13093185ABC82AB15D5C522BEFE0E518933535BBCE3EE7112DD109B2127CAA1B0F77502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652696, "uuid": "51c2b3b5-5ecc-48aa-ab5e-d5ea99ed29a8", "value": "1536:kVn/NW34Fs5jT/lU7Wl4CZx0ESZ1x+0OC6Nasso5AAQ9WlChi2Ei2rFeiZWYJL:sNW34Mjj4CZx0ESL4C6Nasso5AFtEi2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785652696, "uuid": "f67dcbe9-9c95-4d6a-9043-b32574137a83", "value": 96428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785652696, "uuid": "1746be3e-12ca-4e2f-9b40-4f123be37de2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652696, "uuid": "2007c13e-7210-41df-84eb-f04eb25f7186", "value": "nvmsUpdate", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d286e52-8e76-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785677525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677525, "uuid": "55642123-cb74-4a33-920e-9bcb17687c8c", "comment": "Malware payload (CoinMiner)", "value": "28987a8afff75ef1a5831ab3911b76ba", "object_relation": "md5", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677525, "uuid": "f55bb7fd-3f1b-45fd-b94c-5c0360e48d16", "comment": "Malware payload (CoinMiner)", "value": "4b67a337ba1a61a00d4145cad082fadc3a6daee3949f3dbe081680d3a6febe20", "object_relation": "sha256", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677525, "uuid": "368fbdeb-e1cd-4ed1-81e1-88a13595a98b", "comment": "Malware payload (CoinMiner)", "value": "4f6448cff4133a8611f82ae64c063e1789cd50cf", "object_relation": "sha1", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677525, "uuid": "1db480d3-e5b5-4c07-9cc0-8b72b63b0542", "comment": "Malware payload (CoinMiner)", "value": "ae2efd9eeb0d4c8af555270aacc46f94ffec4ad140c083bf81722509045664812cd7a410e633c6b2c23d64f92ae5f22a", "object_relation": "sha3-384", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677525, "uuid": "08bb0855-598b-4e95-a7a2-cdb0e1e5d6cf", "value": "T11C3633C66EC7A5F8C00AC3BC8612F49EB139BB814AB57D0939DC2C485DA6B45643F7E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677525, "uuid": "e18dfd4c-455e-45ee-948e-81db0f13675c", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677525, "uuid": "8c0dc848-869a-4060-801a-328bf920b3ea", "value": "98304:rly2da1/V0yQIcPJLLt0MwsE4Mrc9iSGGY9aHNFoAQGdn/1kf5T01:1UV0fjPJHt0bsEO9FGGYsHOGLkf5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785677525, "uuid": "f41688a6-97ba-4ca5-ab58-b8cd35e703d7", "value": 5222400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785677525, "uuid": "df6085e3-3e4a-447d-8ac7-1703eb452afe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677525, "uuid": "ef8ffc77-b326-4bbd-b864-69ad296445a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0baa82c-8e7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1785679410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679410, "uuid": "6bb943ac-0c04-4c10-8fad-a2c79d10951f", "comment": "Malware payload (LummaStealer)", "value": "535b2a9b271023948496f9577593c06f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679410, "uuid": "10803432-c4cc-45e5-9bac-8ef5d4230e15", "comment": "Malware payload (LummaStealer)", "value": "4b7d75f5c35d8d326af5723fb77c44d769478c90ca2f88e2edfb3e08817fb29c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679410, "uuid": "959b6999-2435-4eeb-b06e-21d8f4a42553", "comment": "Malware payload (LummaStealer)", "value": "66bb29d6e15afb643a88e54e63dbfe5b7c7f85b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679410, "uuid": "bb4524d8-2db8-4879-93f7-c5968659acd9", "comment": "Malware payload (LummaStealer)", "value": "eabfe4c96165467270041028450b3faf53e8ca1e96f7111772073b03be00c4bd490556b2a7313212cc87ef028e0c5950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679410, "uuid": "3159065b-e3ce-416b-a3d8-528b2c19f38b", "value": "T197F56C01FEC748F5E4036E3561AF226F3739B8154B35D693EE043EB9E9B72819823649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679410, "uuid": "e38f35a8-89cc-46f8-8646-fb2c7fc26d55", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679410, "uuid": "8f066498-7c4c-470b-b946-0bd640d30f99", "value": "49152:nE67sgRFV/zl+H4tNuH0k0fOuwf+yDDPRoFS7eNbQQD7P83V:E6IgRF9B+temBeE7e6QDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785679410, "uuid": "b183f4ba-ade4-4ef6-96dd-c39d86ed6290", "value": 3531120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785679410, "uuid": "c6bea727-6a77-485f-8c2f-69e26b639884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679410, "uuid": "755dfabd-78c9-4318-9ddf-eb5f310b6590", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7367c27a-8e18-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785637109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785637109, "uuid": "bf04fb87-c63a-471a-8233-61080e19f638", "comment": "Malware payload (Mirai)", "value": "ed08687f974a1a19e3b8f76d1a7340d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785637109, "uuid": "f584e279-ec27-4668-816d-88fa6c3395c4", "comment": "Malware payload (Mirai)", "value": "4d70c592117d87144a826f81b53227f2756fa93015ea251050418b7f28bfa449", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785637109, "uuid": "673f978b-347f-4148-b0b2-88f259c4b56a", "comment": "Malware payload (Mirai)", "value": "6fd1a3d6e9b4f0b7c90f88371abf3049ff8d5e21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785637109, "uuid": "4b021a9d-3249-409e-ac9d-8c5f76dca5b6", "comment": "Malware payload (Mirai)", "value": "b9e6f96ca02850f3860b641dce151ce8a8c2b1ad1fd916d26a169f83a26fc6b13345114004fefe2a0ca0fcf5d1086122", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785637109, "uuid": "2fe1b1ea-949f-4eaf-9432-0d71246f1c65", "value": "T185B34B03B9C28DFDC046C034437FBA36D925F0EE1639B29B27F5EE266D0EE610A19955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785637109, "uuid": "a598c758-d376-4bbe-b6b7-6a674360c3a5", "value": "3072:vEWK3B33zFmdUXAeJ+4gJeXzAt+lLnuJTjtOEV/YGkYGR:vEWK3R3hm2XAeJ+4gJeXZuxjpQO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785637109, "uuid": "f84d63f4-680b-453b-8d76-764847917261", "value": 109968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785637109, "uuid": "50732c09-df1c-482c-b622-568c9e6c6b57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785637109, "uuid": "a9f3cf59-1d4a-4ac5-8b8d-ca9603420311", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fe2fb4-8e7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1785679093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679093, "uuid": "25e20314-6164-4f9c-958d-1a583cd0de3f", "comment": "Malware payload (OverlordRAT)", "value": "1e3980e87f5c0baa0514e6e6338cbc15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "update-microsoft-data-services", "colour": "#3A1E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679093, "uuid": "fbc96ed4-cd5f-463e-b7de-a50433ae61b6", "comment": "Malware payload (OverlordRAT)", "value": "4f3c97948a9cd189f0c75c7f604dbc675b3d59b1daf197424464a24c3b8e4617", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "update-microsoft-data-services", "colour": "#3A1E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679093, "uuid": "af67608e-f7b7-4e60-ac7d-824a303e04b1", "comment": "Malware payload (OverlordRAT)", "value": "aa4071641df7b352326f837d785a4d73926ccd7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "update-microsoft-data-services", "colour": "#3A1E99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679093, "uuid": "0154f8f5-e2ff-43a4-afa3-7ce5db9d2f03", "comment": "Malware payload (OverlordRAT)", "value": "8df7791d83db5e18acb7e7e76ea279cb8ecb6460d7ea0322b3041606156a919e0680ac0e016e3de3781b486bf73bf5c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "update-microsoft-data-services", "colour": "#3A1E99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679093, "uuid": "d8960648-51ec-4bb4-b0e6-a1c32f503814", "value": "T1007523886A16D902C95597781F73F67157BC1EAEC810E2439FDBADEBB939F181C00283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679093, "uuid": "28c3b1fe-f2ce-400f-aee4-60301ec9c961", "value": "24576:5eA9skmmJSmUapFMWl5VEtDj0BFI7StMlyE5widI2BehFRPjG7CZx0Q05:gUskRD8Wit8B5jEzGVTRPy7CZxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785679093, "uuid": "bcab2b2e-9f7d-455d-9244-bc08109113a9", "value": 1594368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785679093, "uuid": "56bfa998-bc26-42d2-922b-8083259c0e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679093, "uuid": "1ed9ee27-e907-429b-a5ba-dc66866956d8", "value": "FLStudio2025_v50_Win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b730651c-8ec7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785712384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712384, "uuid": "f350f709-9c01-474f-b033-16f6f565b030", "comment": "Malware payload (Mirai)", "value": "73f28226204a2800076d944f77e21c06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712384, "uuid": "e4406fe5-2e8b-4241-91cd-b019d11fe0ae", "comment": "Malware payload (Mirai)", "value": "4f957ced7aeec095681d6140d0c7246983626a308060b1a1df3b55fbd3478da5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712384, "uuid": "4d437ad8-ae34-47be-9bcb-c12d7e8d3a18", "comment": "Malware payload (Mirai)", "value": "6d71e7ac9138763edf954c3bf65dee409f6e1e19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712384, "uuid": "40939d42-1914-4f89-aece-ddf10b34a1b9", "comment": "Malware payload (Mirai)", "value": "8c22be286358e8c97f2a4d4c03fd8e43b649d239070f49bae608efa56f6ba9329389fa8d28bc64fbfb5435544d41478b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712384, "uuid": "59f9cd6e-f9ba-46c4-aa31-6d767e6653ac", "value": "T108058D8AFB93D0F2F5A341F9124FC7F60530A11A9013F6F2EB49977678717622E1A219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712384, "uuid": "c3860aae-5294-4213-b145-fda1f9263e83", "value": "24576:zOqfGWkYLc9hVzh9uhVoXtKZJWPdgNG8kp97jZWOp:zOqfNk7DVzh9uhGCWPbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785712384, "uuid": "53a41e41-2dc3-48ea-ac7d-85ba822f2fbf", "value": 820968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785712384, "uuid": "ab3cb025-6be6-43d1-be6c-4a210410f7eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712384, "uuid": "cdfd3ea5-5e5d-4c5e-82dd-a33d722777bc", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30800c86-8e12-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785634419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634419, "uuid": "1a6221e2-20f3-471f-9d91-20f32e23c503", "comment": "Malware payload", "value": "66f17e49bbe51c35f29da2c1d53a4bce", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634419, "uuid": "f9a6993d-5ca7-4ae8-ba66-2c0e2912a0d5", "comment": "Malware payload", "value": "50a42309a5fb81a08d92811ef90568d4ae67101690f430a1208feba3ca67ef40", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634419, "uuid": "4ede8e49-067a-4e07-bdce-685e22960969", "comment": "Malware payload", "value": "6824b380ed0abdb3c41446b43b0924b07dd7170f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634419, "uuid": "72400c96-2f11-491d-a070-d64242e27567", "comment": "Malware payload", "value": "261aae2ead8358d9bf5e9cbaa726c8a6918e931a68756af4f7b2ff66af7229ab3b3a58935af646ed02ee8de9a58456fe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634419, "uuid": "6e99e77d-49fe-43a4-afbb-b7b67a0fdecf", "value": "T135236C6516857C14AE98C4375C7E2F0CB9AD43E6314492EE7FCA3CF28C4A6ADA20875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634419, "uuid": "83649522-ae76-4ab4-bdfb-fd63d1578389", "value": "768:ATr9NyXsZztCI9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:AnHusZQcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785634419, "uuid": "73f32b60-c826-41af-8a24-31c8ab60b9a8", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785634419, "uuid": "520d1f41-c0ee-4012-ad62-203b1fa90fbd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634419, "uuid": "8dbf6e4c-2096-469b-b23b-f88ebd9a0ab8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beeb5cca-8e7b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785679756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679756, "uuid": "40ec1149-50c3-443e-b30e-7345a1ece2b7", "comment": "Malware payload (Mirai)", "value": "8997a8989351b08e1cc1aa35a4034e56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679756, "uuid": "1c27aebd-2a60-4268-83bd-3c9bd2296b28", "comment": "Malware payload (Mirai)", "value": "515835c80bea56fd93b27658f00c5ad8b642a4f5610ded46c85ce3fd141b3f37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679756, "uuid": "24ba2b67-4156-4fc5-9504-9c6c2e8488dc", "comment": "Malware payload (Mirai)", "value": "7ade56a63678219feded3933f17256408fcce7bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679756, "uuid": "9f40f7f7-5122-438a-ac86-e956db001ba6", "comment": "Malware payload (Mirai)", "value": "df9ad0d3ea9e5eecb6e969a4a5c0ab25c6757fd26fd356d47d2b5fdf5b80c69eb7cf4d2df4f91c96541fe052618f3f21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679756, "uuid": "dd95c7df-c302-43ba-8d9c-8fea8264a2d1", "value": "T17D531782BC81D906CAD4237AFA2E55DE331133D9E1DE3742AE122F1176CAD5F0D6B192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679756, "uuid": "9c39872e-e267-4f7d-9d7a-c6e63f261c92", "value": "768:B1i7lmUGNedIRjTYXrjHPqugnTfqBTnedYaayfW+bDYIQ81LozlyIBNn4DIqFusy:PeGNedojsX/cfqB6YaZBQ81+sTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785679756, "uuid": "be2197ad-a46a-42f7-b59b-94e037b5e69e", "value": 66584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785679756, "uuid": "374ed890-9304-493f-9a9b-0c36877a4107", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679756, "uuid": "8eac50b3-595d-4c6b-86b4-96c82952d685", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5a4100-8e0f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785633449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633449, "uuid": "8d29673a-2cd6-4a8b-85f3-c7ce7032577d", "comment": "Malware payload (Mirai)", "value": "bd87c85a06a65791729a8238a8f7a268", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633449, "uuid": "93f8d27e-c080-47ff-97ba-ab389b81d6bf", "comment": "Malware payload (Mirai)", "value": "52e0c4974427db87b915d5b81785e6a9a014f5626e7adefee0c4a9710edd626d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633449, "uuid": "8f6b6c47-4eab-4c02-b94e-09a256847367", "comment": "Malware payload (Mirai)", "value": "86953bc702ec75bd0c8d0ea32dd21911015155e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633449, "uuid": "e15e2454-e761-4048-a1a6-dc80a0921f7b", "comment": "Malware payload (Mirai)", "value": "5b5cbb84856089e8618f0426cf1ce32c075d02fa7a46b683f07e12cb18b5cfbf59096fb9866126eaa7057196f9996984", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785633449, "uuid": "e1ba439f-c314-44f8-ba76-32ed2ceb54cb", "value": "T190A36CD6E283D4F5EC2241303176FF379E72E5BA2128DD83D7A49663BC62A42D406E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785633449, "uuid": "7247ede2-c129-495c-b8c1-92ada1835a3d", "value": "1536:rMmRqozBnO115B3k7myNqhwN+bYTMIqWBtlgALf5SZ+ZwLjh:wmDg3U7myNq+N+biL5tXD5+Ljh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785633449, "uuid": "94756a3b-3a98-4f5b-9ea7-a952fee6bd67", "value": 100564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785633449, "uuid": "9e17a0f0-76d6-4dec-bf1c-eeb26680d20c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785633449, "uuid": "80331995-8cc6-4762-8b8c-46f49e0feae7", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabffbaf-8e0e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785632907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632907, "uuid": "584b5f03-6a87-4d82-a710-d5c1d40b8a4e", "comment": "Malware payload (Mirai)", "value": "9199b6e117e9bf63cdd0f76973bf22c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632907, "uuid": "8dca4077-f6aa-4431-b5d0-d21e67e96a82", "comment": "Malware payload (Mirai)", "value": "585d6ed50abdf1500cad819da63dc78d2d8afbecb791e5a5d2407817ef083ffb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632907, "uuid": "040a3c04-578c-4932-85ab-1ffb18f2b4ba", "comment": "Malware payload (Mirai)", "value": "d912bea025038058a40b8889f0c9bae82d518c83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632907, "uuid": "5b9b6fa5-7d36-4834-a8f2-d71a1147e194", "comment": "Malware payload (Mirai)", "value": "bf4a561576fc7e1f22acb986e74716cae10100c73f21452385843003ed1f82383839bbd95b8e66cd92cef575bde5a86f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632907, "uuid": "fa35d0fa-dfd8-4da3-a50f-96d02763d93b", "value": "T101F31B8ABC818B13C6E161B7FB1E428D372643ACD3EA71179D186B29375B8970E37741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632907, "uuid": "2891437a-a933-4524-b53b-b187da4021ac", "value": "3072:1hxcCGw9iOqcN+o0RbUf4SD1aZFbdkf28/tq/:1hrj9izQiJUf4SDoZHk+81q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785632907, "uuid": "cde50aaa-f4ea-485a-ab28-c45f71855edf", "value": 162560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785632907, "uuid": "2d8a95b5-7eb5-4601-bc51-91142cb9951a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632907, "uuid": "2896a118-c44e-4957-a1b8-8af6fc0e1a1a", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fe7004-8e4d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785659803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659803, "uuid": "91b15184-1a60-4e3d-8b93-b63dcee7e501", "comment": "Malware payload (SalatStealer)", "value": "0603a9c2cc3efa9e1e6ca5f12d332d9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659803, "uuid": "2d8b57b9-97af-48d1-b7be-5fd50d57b201", "comment": "Malware payload (SalatStealer)", "value": "58786663acbf0f9d7572aa61bb95cac9ca918c7732e9833e4b384c9ddc30c986", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659803, "uuid": "923f4a37-822f-4403-8881-c1881d3ed9d1", "comment": "Malware payload (SalatStealer)", "value": "0c1e182a7179a63bc79b649c42e0d78b11532201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659803, "uuid": "05385716-044d-425b-bf47-32d708b30fe2", "comment": "Malware payload (SalatStealer)", "value": "65308208345cc51e2c63c38f696ebf05c1f3bcc982dd8fbd740e70139dc52871cb2a09b445c75ff9cb9e39db4b399c3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659803, "uuid": "2e81dcf4-a806-495a-9bd0-eb617b47f8cc", "value": "T1D6C66B11FACB54F5F9035831406BB27F23315D048B28DBDBEB183B6AF87B6A1196A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659803, "uuid": "8870c494-e975-456c-b80a-81c93d87a331", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659803, "uuid": "812e6f61-88a3-446c-bc46-7a0bfbcec601", "value": "98304:8uNkNJysdLgpiGXXXwM7GOrp4S3HVdjEaO/:gynpXnJFpTWaO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785659803, "uuid": "b64162ea-2ac7-469c-8ccf-790d94cd2569", "value": 12571648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785659803, "uuid": "b4ea15d3-22ed-42a8-b747-997cd0e92299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659803, "uuid": "c0997fda-9aed-499e-85b4-63df21f27d7e", "value": "Rexil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037d127f-8e4b-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1785658825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658825, "uuid": "0ae29daf-38e2-4e5d-92be-7be1714180c1", "comment": "Malware payload (SilentNet)", "value": "f3c77fe63a8f4f769484d9a2c3f3bde8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658825, "uuid": "a25fdccd-d711-4dc8-bb14-957d6923de93", "comment": "Malware payload (SilentNet)", "value": "59905502be051f29d1309c6ca231d8aa6b1af90025bee5c7f9ea3e35ff037162", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658825, "uuid": "9b40b28b-aba2-4056-86dc-da09ed8b2168", "comment": "Malware payload (SilentNet)", "value": "07801aa5ee5e476b53ecab18457f3a98e311e686", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658825, "uuid": "322a9919-3315-4885-b478-75005a9e6965", "comment": "Malware payload (SilentNet)", "value": "5628f3101789c19458ac654af30d8e92d153c648921919f8aa0f5aa0a050bd21be510d88b45bc732c4b2de64b4d251c6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658825, "uuid": "0dddf90f-b860-40ba-8b82-b4eeda9d83fe", "value": "T13015120D5A34C563D2BBE67668852F29FC5C41DCA63AD413D8B828D2C4CF4D9FE41A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658825, "uuid": "215a2dcf-534b-45cd-b4e5-42bd8feee39f", "value": "24576:rlkmN7/DgaCve3kkm6DulH/Y8Hb3oY4F3z+VuShohJ3TSySJ/I:Cm5gO0kmB/Y873oY4wV+hpTSyg/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658825, "uuid": "51cd46dc-745f-4f22-a87c-01e24ec851cb", "value": 946677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658825, "uuid": "c56609bf-14c1-4995-b8d1-bce46c164042", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658825, "uuid": "bb896e11-276a-4a31-a305-720e6e88c3fd", "value": "KryptonPlus-LIISTA.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdac4ad8-8e4a-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1785658815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658815, "uuid": "bcfc0d1e-6d9a-46aa-8196-0bc8eeebab8f", "comment": "Malware payload (SilentNet)", "value": "42c1ca269797da97da4e4fe7330949b1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658815, "uuid": "f2de2240-6ff1-4f54-8d74-c3ba25d6c0a0", "comment": "Malware payload (SilentNet)", "value": "5aba6510b327b3bbf73924ad522e92c8f8bf1305591f32947baf8f84731d3bdd", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658815, "uuid": "55f3a6d6-fae5-41c4-949b-dcd07b567495", "comment": "Malware payload (SilentNet)", "value": "bdc1ec4881e54177f004169d4b47ef577c90d134", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658815, "uuid": "97e8225b-3453-44b4-9578-59a5651cb173", "comment": "Malware payload (SilentNet)", "value": "fc0f0b33ac1b3df4f9c2b52d9bfb7cdaf63b5ae39e20cdf496c23f85ec113f7d04bcbbbc191a8c65bd74c0fa4e62ee51", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658815, "uuid": "7b25ec18-6ea9-4f05-9b2b-fbb48cf7ffba", "value": "T168950223A69D55F7F9DB83B352108E61FC281FF8D706B41A0FF318926C428994F496AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658815, "uuid": "da6923dd-9ef5-4597-8c59-4dd0b3c57e16", "value": "49152:Cq4jRt0M+I6t67UAPOXlpydpGj3GWXvy/+BLlLyG:v46ND1E2yWXi+BhLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658815, "uuid": "5dcd8205-a806-4c96-b649-f3d4edc8354c", "value": 1911359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658815, "uuid": "4a9e3c90-8b7a-46ce-9d62-6c51c00de4aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658815, "uuid": "df0d24e3-74cc-449e-9b14-306d94b5b147", "value": "dqkis.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e5e400-8e49-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785657972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657972, "uuid": "151b19c9-5712-4f26-939b-42c2f4c4b82d", "comment": "Malware payload (Mirai)", "value": "108ec599e29802681f155e8a4a0954fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657972, "uuid": "ea11fa1a-4eeb-482d-9332-5303575d53e2", "comment": "Malware payload (Mirai)", "value": "5be2aed25e538e836c7bc1fcf4c065294a7ef7dab3ef52288ca2ef4a738151a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657972, "uuid": "a586b2a4-ac98-4ebe-bd1b-40a791e9a441", "comment": "Malware payload (Mirai)", "value": "b3c7f1f277f3237b4e7be71efd21edaad99dcb19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657972, "uuid": "35362dde-e929-46a6-a64a-c12f0fefd616", "comment": "Malware payload (Mirai)", "value": "e3a90fc30e01d00fa772d5b6db010d4cf253ab3078a235d43b7592503bfd9fee535dbea113ba05347554a4ff943bb114", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657972, "uuid": "d03836c8-3085-4b9a-893c-0227838113ab", "value": "T14CF2F1742E99BCE2DA304C32DB30C75A77A71534F9F635A41BB44A21AF9C186A93C583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657972, "uuid": "a1d68d1c-1d7f-4f5f-9707-00853c5fa6f3", "value": "768:inhqf+QwLOyCan8CVLQ663RBP4f7ws3Uozo:qVOgn8mM663Lmzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785657972, "uuid": "2f13801b-16bb-40e6-9669-8aa744b45ae2", "value": 35728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785657972, "uuid": "0b5fccdf-7303-41f5-901b-04a99c40359e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657972, "uuid": "07b07d88-6a09-4c7a-8026-aaf7fbb082b9", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460449a0-8e2e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785646481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646481, "uuid": "da1ab9bd-5d5a-45d2-b2ea-83888688ffd3", "comment": "Malware payload", "value": "2f249e26a69cfe86f4795cc399cd1557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646481, "uuid": "589ee756-1698-4da0-b746-63e691e314b5", "comment": "Malware payload", "value": "5c36d884cc8bb55a906013fadf14f21bf4a10fc57861633bd44d90f800c090d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646481, "uuid": "fefcbe79-9344-462c-8c8c-b13665371b96", "comment": "Malware payload", "value": "4ee79dc8fc824e3cfe578e31e8ee78744cb7575d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646481, "uuid": "3edee2b1-c955-47af-892d-171d85686ebe", "comment": "Malware payload", "value": "17aa73184fb3c2168bda09d1e638b227f2f15c4878155bbbf4283098a07bd566655081af951a0520cead56b507613ee4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646481, "uuid": "12118927-e0d8-43ce-bb85-5f5b7cee72b1", "value": "T13BD622E965D262F4C4D38500628B439A71C1654D82FD5C2A3EC73D022E1DDAF668EEFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646481, "uuid": "45cb032d-e346-47c7-8450-cc1f1cebe6b7", "value": "9d670232a8f9f80188e716f00d9517eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646481, "uuid": "efc31955-dc95-47ce-8e0c-a1f22070fc9b", "value": "196608:kVy9CieIt6ORxq2wjGpyZbVCrPzuWXEngCn1e6NwxlwMn/2oen2FmETbZue2c/pp:k6VevmqhypyZbVKLCn31pNptbIFuYc9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785646481, "uuid": "cf8da6b8-4fd7-412f-b8e0-6a514b40422f", "value": 12907984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785646481, "uuid": "6b6c83a0-b19e-47fa-9b06-4b50e8237fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646481, "uuid": "c7b1c872-f458-475c-84e2-2341008cf3a1", "value": "Setup64x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00263d23-8e18-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785636915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636915, "uuid": "5a0fb787-7a9d-41f7-a73e-1b2f7fbb516b", "comment": "Malware payload (Mirai)", "value": "dae117de34af609ce1c10aa6aa762632", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636915, "uuid": "29f696b1-f141-4904-a825-7c821ee8b40b", "comment": "Malware payload (Mirai)", "value": "5ce18989a7bdc92129e04ccee765ff3b1edcc3f0f7f08dc5f6755958b5a70d87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636915, "uuid": "af12f465-df4a-4948-a416-d32f9de2775c", "comment": "Malware payload (Mirai)", "value": "e03bf38c520709fe59aea4ca7068ecf7557a4de0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636915, "uuid": "1faea67e-3bfe-4f56-b6f1-45a414f3844c", "comment": "Malware payload (Mirai)", "value": "679f74a69cc3881853e1a61ff7af00b0b2c7db870035a0bf350b8a22bdc3bc5772e85c79c8c0585d048d7a202ad16756", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636915, "uuid": "bb84f966-e26a-4e15-a66d-d74cb3b78acd", "value": "T15353F1D9DDEBFC2BC92E6DF981B86F28785840597CC6DBDFA3104A48D528B0DB029065", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636915, "uuid": "ef12e3c6-878a-4ba8-a8e2-9a8f4ee33c55", "value": "1536:11daLQpNtfDuePWu5dw9Jfz1+m5i+1cflqJAzdw:MQpN5oSk+P+y8ezi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785636915, "uuid": "1d5122fb-9da0-4fd8-bf50-e06cb0a3f727", "value": 63044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785636915, "uuid": "8d729002-c8bd-4273-9640-29b4240c6eef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636915, "uuid": "98852e93-c41e-4cc0-a2e7-dd03b1200404", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d0f64f-8ec4-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785711181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711181, "uuid": "d0ea2416-6b7d-41b8-aad1-0861756b0ae4", "comment": "Malware payload (CoinMiner)", "value": "c395bd554be042ff13206a52bbef11b3", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711181, "uuid": "d3ee13f4-9468-40dc-a56b-14c7229f2fb2", "comment": "Malware payload (CoinMiner)", "value": "6106d8452e2cbc4281303e007a37c427ce397d7725b4f90143307c18649c9445", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711181, "uuid": "80b7af15-5769-40d1-af1b-63345a24421e", "comment": "Malware payload (CoinMiner)", "value": "fa47a0b31aa995823f088d0b2538a1b2248664c5", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711181, "uuid": "d6f23dc5-8928-4aa3-876f-e014439e54e3", "comment": "Malware payload (CoinMiner)", "value": "ed70160cfeb1adae018b58d5e1ca0e57c622b845cdce3417181645276df1a41ab77a2f9b6ef16a5d463cd10d87d3ba4e", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711181, "uuid": "080aac4e-1b7d-4176-99d1-8f33bcdadd70", "value": "T1813633823CDBB8F4D097C7B98272647EB175B76A4A79BC4739C86A0C0EA3E50543D781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711181, "uuid": "e3e60964-ecab-4b39-ad52-1448db78a573", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711181, "uuid": "5dbaa8b2-0bc4-4776-b282-99e119042144", "value": "98304:Oj+BaspIGj0cBs7Z7lkTi/i2A0hCdJjeXykCfg7A7oxafj3er:OaxR0cCNl4iSeUHY7A7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785711181, "uuid": "334f9424-dc8a-4601-b5f3-031bed479d61", "value": 5238272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785711181, "uuid": "f8aeeb8a-5a5c-4b33-9530-f266ef5a2951", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711181, "uuid": "0a4e8af4-acf2-4c58-ba97-f7f284a6b842", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525796a4-8e0c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785631899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631899, "uuid": "81f5b3c4-bbf9-456c-b152-220e089ffd85", "comment": "Malware payload (Mirai)", "value": "dbc3cc5020fddf990ef1f20dcd2b052b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631899, "uuid": "8d2ded64-6151-40aa-a217-d0f340b900c8", "comment": "Malware payload (Mirai)", "value": "61bc9a3758c56d8cb261853b8b9feb686d5da08402f83564089c09610d3c6cef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631899, "uuid": "c408a556-112c-41b7-ab4f-f3285f192c00", "comment": "Malware payload (Mirai)", "value": "de036af9da7029dafe9ff29717335afde6e4be72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631899, "uuid": "018d7dc0-5a57-4562-96b8-d14c159b6a18", "comment": "Malware payload (Mirai)", "value": "f506ac1c66be77f506819efd4b04d641b3cb07eee4ab19a7e25e072508c2521ee7cd37b50ce1a4f6c1aacd61bbcfbb12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631899, "uuid": "a346619a-65d1-44b2-b936-8a326e95af04", "value": "T10543E11814B8583AD6710439E53C1B4976FB83B485CF231B325A0964A5CB7E9A6BF983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631899, "uuid": "a00463c6-98ed-4a15-8bc2-e4d8e64d41d8", "value": "1536:NkdFpMP267Fhi9pZBIqCZHprpSAqVxo/FvBzx:N8f8B7amqCwAIxYFvB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785631899, "uuid": "fc89fa89-58c2-49d5-8fd7-0f7ec947817e", "value": 56556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785631899, "uuid": "295bd90a-7a2b-485c-b5bd-91ac8351ca05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631899, "uuid": "43cb2410-038b-449f-b9a6-f29b55876a4b", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38c1d16-8e42-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785655255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785655255, "uuid": "378a66ff-5d0e-42ca-89a7-145b68dfb5f6", "comment": "Malware payload", "value": "9d30d5793bd0366af0df74c9e3d00fc5", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785655255, "uuid": "abc8eeed-fbac-409e-9688-6a3a96baa621", "comment": "Malware payload", "value": "6230782e1c843f6ccc0727a26c039dfd0965cddd6fc6cbf19bbeff0639cb33cb", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785655255, "uuid": "398c46e5-8e6b-4d4c-8d25-13bd502d939d", "comment": "Malware payload", "value": "407ec9d1a9ce7f3d11c8364e0ca591b2b704dcf2", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785655255, "uuid": "13867755-bce3-4659-ab17-8438f29c5d99", "comment": "Malware payload", "value": "15b86ecbdbb4b5f3df6a008c4d765954ea5d3f092e2c6863faed5d4ce044857ba5955a23a3abbf8a7db82f44f4a5f244", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785655255, "uuid": "dc72dffb-ff3d-468d-a0d0-85eaf0643849", "value": "T113066B03B96948E9C0E5E739C86B5256BB70B80C8B3133D32E60BA792F757D09E75784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785655255, "uuid": "c1aad252-7bc6-4d42-b445-faccf8333b2c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785655255, "uuid": "68271d5e-c48d-42fd-a1c7-4eb0948bc409", "value": "49152:jXXfexCpXzn0VJGVgLvqrZeM2VNow6HmQV:j/c1XNowQVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785655255, "uuid": "ea7fbbff-df49-4832-9278-958088216cb7", "value": 3721056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785655255, "uuid": "39dd449a-acfd-4f1d-9ca9-51da06dc3577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785655255, "uuid": "6480352d-649d-48f6-8610-301fb271d28a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edaf48df-8e0a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785631301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631301, "uuid": "1eb15b3a-f3f8-48c7-8f60-66d977726bb7", "comment": "Malware payload (Mirai)", "value": "c7e79791d415c7a7f2968dce6c6bf48f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631301, "uuid": "7b2852e9-fa9e-4d21-93f4-8f6fa307ce2d", "comment": "Malware payload (Mirai)", "value": "631edb65012fe8dff1eb511edc1660fc8cede0bafe531f507cc491654e47fd6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631301, "uuid": "c433b325-8ff9-4438-8a58-b74cbb102008", "comment": "Malware payload (Mirai)", "value": "0d250e3b3ddda504c8c68c638937bc7a1e19e4e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631301, "uuid": "f5d4a8a4-88f9-4133-a2f1-d52356e1bb89", "comment": "Malware payload (Mirai)", "value": "2ce8897482b44e688b75e61a4f492f35c7ae94329509fb795da3f401fa6baa9bb211c9f1edeeb3bc596d3484359c2f22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631301, "uuid": "02aa993f-c714-4c14-986d-3212489f9083", "value": "T1B313E0A3D6FD6E81C56102731E3E1A26AC2AD50E91419CEB7BE0247B20D7B1C7E0598B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631301, "uuid": "abe74b1f-3633-4bec-a2e3-8b182ca54625", "value": "768:XCkO5tOKfhaFFTnUqVcLJCLUD5KG0HOdrLG9FUfAnd4YCbEnbcuyD7UkWykkAe:XRO5tOK0ZnUqCgif0HELG9FUoOJbEnoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785631301, "uuid": "f83f83d1-00b9-4a47-940e-8be15aa94e9d", "value": 43928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785631301, "uuid": "b0322aa5-7051-40b8-aa0e-18fedf83d492", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631301, "uuid": "c10241b9-d7b9-4f00-b1c2-bfa4fb2c10fa", "value": "zero.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87de229-8e14-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785635614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635614, "uuid": "d6ac8de4-1ded-4a33-938c-6e3b0d157d68", "comment": "Malware payload (Mirai)", "value": "005f779a9116d7c06b92e4dcda352136", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635614, "uuid": "e9aecad5-1c05-45fa-a5be-8ce5719de879", "comment": "Malware payload (Mirai)", "value": "6364e72f4838a6e1c487a15f8b373a950d0830fa94a275cebf247dd4820da676", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635614, "uuid": "b6986d31-828a-409a-8445-357dd559ec72", "comment": "Malware payload (Mirai)", "value": "5610a0d1f77309fe1c46b295a82466ad652bdd73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635614, "uuid": "ed945aff-3439-4cac-b2d2-20172a6b17e0", "comment": "Malware payload (Mirai)", "value": "dfb19ea7103dd8e9934c04516b170629afd2c9a4b7ca134716eda2ec9d9e0b5700c2188ba8ff8325f961303f967536bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635614, "uuid": "266508a6-3abe-46c6-9cde-a0bf975284c9", "value": "T18A145C46EA414E13C0D7137AB6AF424A333297A4D3DB73069D286FB43BC279E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635614, "uuid": "f00c9796-b590-4f1f-8e46-f478f55663ae", "value": "6144:fyL4oAzWZvkRlqaHjp7VcKBTLCMBkL93JgM/9Auug:fy89zWZ8RlqaHjp7VcKBPBIfZ/auR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785635614, "uuid": "78a47967-68da-4ef2-922d-669c777fc240", "value": 201623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785635614, "uuid": "5ec7121a-b51f-4fb7-a9cd-c321443b0945", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635614, "uuid": "df7caa24-a2bd-4a93-9d8e-401ed0a74b99", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8ef264-8e93-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785690036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785690036, "uuid": "746ecad6-8810-4b82-a271-7354b54139c1", "comment": "Malware payload", "value": "ff8e4f13150260971e020e23d6c0ec3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785690036, "uuid": "54752f5f-117c-48b9-b0ae-4164a934c554", "comment": "Malware payload", "value": "64ea5b0da3027ae98ca51084a388dc1a4314f4c1485f723f4f7bfed0171b7396", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785690036, "uuid": "e1722959-5c58-4d32-bc38-dddcca1b5875", "comment": "Malware payload", "value": "d2f200389157c30047022f7245c34de74187fece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785690036, "uuid": "1e884456-0847-463b-9983-df1544e40449", "comment": "Malware payload", "value": "d129e06465643ed9fded736a9c59dfec3d2aa9a80e0a16023285eb1acbb15c5aca05635572abf46f210614cb7f0d7c77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785690036, "uuid": "0e3a6571-593f-40ab-9ed3-1b9ea7e0f1b2", "value": "T125666C13E9124D6DC088D73448B5265B7BA8FC6A87357BA71DB2BE372F517E04A32780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785690036, "uuid": "767147d2-481c-4915-b82c-1573b0e3fcdf", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785690036, "uuid": "646480bf-5167-43d6-ab21-d36f85f1a269", "value": "49152:j0BF+qFPmVAqX/gvhVqR921zheI6EpY9t3y/FICzIrMNwSRwZJ6omf0eMYsuv6KQ:j6JVAtEpcsd9qP3NKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785690036, "uuid": "7bd6a869-6e1d-4c35-95c2-77a6075c7c74", "value": 6500288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785690036, "uuid": "319dcd14-7f93-49f6-9055-d6e32599e529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785690036, "uuid": "987afd48-0f22-4fb3-a630-f7264f3b5040", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace6a38a-8e46-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785656962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785656962, "uuid": "948d2f11-bed4-48e9-ba72-d86d6f152c83", "comment": "Malware payload (Mirai)", "value": "0d0411fc5a0966f374dc36882afd76b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785656962, "uuid": "85099eb3-729f-4b06-9322-0b3069f8af1a", "comment": "Malware payload (Mirai)", "value": "651b82e0f95ee250abcf550bd18cb5d3bdc7406c8abac68c0b85f94a333b5606", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785656962, "uuid": "22d291f8-8aca-4588-829f-776eea638308", "comment": "Malware payload (Mirai)", "value": "01f48c73f1afc5caa0c6be472c65b718e9865ff0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785656962, "uuid": "a42a1fba-e9ee-414b-9bb6-8c5a6dbe1d92", "comment": "Malware payload (Mirai)", "value": "51eed545d84101d6a74bd380210a5dedb768012d7318f664d8577c71ba6e1a3bafa1aa16393e5c8120ddd0508be15643", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785656962, "uuid": "bc91b037-061c-4ac1-9c50-6ee9997e203e", "value": "T18D536AC8AA43D8F6FD5241712133EB378636F139112DEA87C7A9DD36AC52900EA5739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785656962, "uuid": "c08e6624-b361-4cd1-a878-03b7225e1f81", "value": "1536:KhberOEn3VfK+naUZGxt9V82YMQ73EFTwVfudVFUHWdI1wubjariXY:KhELn3VfKpJVA3qsudVKHWYwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785656962, "uuid": "ec148011-66f7-4c93-acd7-f69d22ec296c", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785656962, "uuid": "3ecbd1a5-b0ea-4233-9f8c-d27d0ba7ac4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785656962, "uuid": "eaf35f96-40a5-403d-b142-8aae281ab5ef", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84dda892-8e7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785679229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679229, "uuid": "106a1426-ccf5-4c7e-871e-530ed517ed83", "comment": "Malware payload (Vidar)", "value": "3f7e9b7820cac7f9ac66585305963e37", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679229, "uuid": "c23ef370-c471-4ce1-a9d7-961cc0cd642a", "comment": "Malware payload (Vidar)", "value": "6569e21744a4f1d363c1a393ad75471072c8a17740b08c202b66af0a92cf961a", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679229, "uuid": "a1d78117-9c4e-4f5f-876f-d9c4c6405e4c", "comment": "Malware payload (Vidar)", "value": "dd7b5e35a5cb5aeb89d1e91ae7e6b2bfa1d3b01c", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679229, "uuid": "4be66bd5-ab69-4f78-8e65-ef50b8184a68", "comment": "Malware payload (Vidar)", "value": "ec2527d8ed0f4bfb45f28b9992c68346f9e9ea4ab9d31151e52c673c950b3377e979b3203211ad0ef7ee34a3af8f8d56", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679229, "uuid": "d3655d9f-0df3-4509-a07a-b841b3118841", "value": "T10F37332253D20661F87A1B7964F910339134BCD6CFAA82EF73E49ACB1E73A569435307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679229, "uuid": "ac379b38-172b-41ca-935e-cb971a741934", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679229, "uuid": "6ffff18e-1b73-45d9-b0ac-48674aaff78a", "value": "49152:NdTeiaHKGz7VOfbNfwejyvkMz7X4zeE+xoSITAd0AM3ejTDt:ToKYVOfhfZiJzE+gAuAM3ejV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785679229, "uuid": "86d7b1c7-78cb-4ac5-83ac-54609eb868c0", "value": 23068672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785679229, "uuid": "c2727e8d-5ef2-442c-9fae-f79bdac0a2fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679229, "uuid": "3f463b1c-01e2-4521-a262-97ce656fa2d8", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56ce56f-8ec7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785712381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712381, "uuid": "32090c6d-2308-4315-bce6-18eaa7587eed", "comment": "Malware payload", "value": "52c186266d0cf6e2ef02d372739fe830", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712381, "uuid": "2f273241-7d0a-4ac9-ab1c-57d50d5a80c9", "comment": "Malware payload", "value": "68f1d97aa77845a936ec0d51bdcf605d97e10e7866fb5438ee49793c286d352f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712381, "uuid": "79757d20-f4de-41f8-aea5-d6bf0c6164e0", "comment": "Malware payload", "value": "4a6ad101422ed2379df58a7cb4ac96bd879cb15b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712381, "uuid": "313dec0c-2dd7-4597-ab8f-e72c471428bc", "comment": "Malware payload", "value": "0e05380fcdf1d5fd54fefde9129e487b78669f81907b8f3dc4ff1effda091449faad263a3f166a62b8abddbc85282325", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712381, "uuid": "f3a6666d-7277-4cf8-b1f0-6254129d96b1", "value": "T11FF08BED949640323F0D543775194C562602086F24B95BDD224ED9639E0CFA8234EB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712381, "uuid": "abd7d9ce-3626-46a8-a774-8e540714cac9", "value": "12:ZsU9jWijWr5jW2FFl7jN/OQrNaQiByTERE5YXmY6uYCYEeyH:Zp9jWijWr5jW2Fr7jN/VsrByBYXmYRYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785712381, "uuid": "2dabc923-9d54-4fea-954e-c35cf4f4a501", "value": 531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785712381, "uuid": "702ea781-905a-453a-8f13-6fe3bd1c88cd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712381, "uuid": "fd2a3ec8-d9db-4e43-9f6d-6395bd558d63", "value": "realtek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0831120a-8e0b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785631345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631345, "uuid": "a1d38fc0-b235-4dbd-8e4e-37042625c7a6", "comment": "Malware payload (Mirai)", "value": "649defd344c72648a14a3c062e673927", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631345, "uuid": "44442536-6f22-4dfb-8b95-7c0081151416", "comment": "Malware payload (Mirai)", "value": "69e9c7d448f0171c34feb8af04e09d576ab33b105b4c57efbd72aada686401a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631345, "uuid": "f9fa814b-dc7e-426d-adfd-81adca366136", "comment": "Malware payload (Mirai)", "value": "86fa96ff0c97efc2f96872d0af29623b074c6403", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631345, "uuid": "fd7d20c7-d37f-4e7c-a247-20ecbecf5994", "comment": "Malware payload (Mirai)", "value": "2f30063c7bbc9c621ddf0bbd13cc8510a4a8c2976bf6473e71bce72b1b7cd4d584e4860ffb980cd5d4a2366fc41838e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631345, "uuid": "8d345675-4a9b-4e4f-be8d-2fecbadb99ec", "value": "T1D8A32B1DD783E9F0C9420AB0115FBB379931C8E12230ADFBE7E47ED6A961781A456E1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631345, "uuid": "ed345403-9ad5-4c19-abf1-752306e03859", "value": "3072:Uw5rY9IfnpLUuZY7rrrG4YHLJnlAcDeBbyKDOhdP:Uw5rY9IfnpLXY7rrr3YtBDNrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785631345, "uuid": "0553042a-0734-4905-9499-cb8baf5e66d2", "value": 98948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785631345, "uuid": "85407103-6d2f-49f4-bd17-7b8d662a1d2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631345, "uuid": "30f13f03-5412-46ef-8609-0fd550a6bd2a", "value": "zero.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7282ac96-8e78-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785678339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678339, "uuid": "efca799c-ef3f-4731-9006-3703b17cc028", "comment": "Malware payload", "value": "bb09cd1f081fb57108b5fbfb092283e6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678339, "uuid": "f6444074-4b86-4e04-bfac-d07ec9202eec", "comment": "Malware payload", "value": "69fa699e29b2db4aaca4b800ef7533957a14edfa8b1486f68e9b0cb82c2dbc89", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678339, "uuid": "58c564ca-99c0-4703-bdea-f8440495f6db", "comment": "Malware payload", "value": "90fbb332282e07ac8ee6a5153ff3191eb2dbbd9a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678339, "uuid": "0fb44dbd-63a2-4cd5-aa55-f6a99a4baf89", "comment": "Malware payload", "value": "d7a13bab5bd3e0e99645cc89d5f2511f1215ac2dc3c32057c4dfa859fc9064c3a4f2df641f75458d62c4907cf94192c6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678339, "uuid": "6db27326-8063-424b-a5a8-c6344b2ba545", "value": "T1D1236C6516857C14AE99C4375C7E2F0CBDAD43E6314492EE7FCA3CF28C4A6ADA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678339, "uuid": "f1371927-b095-4884-a693-1d10622bbecb", "value": "768:lr9NyXsZztCO9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:tHusZScr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785678339, "uuid": "4c07795e-d981-44d6-8211-49974ad7972b", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785678339, "uuid": "b9321ef0-9528-4337-a252-482c8572ef2a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678339, "uuid": "3b4b4554-772d-48d6-825f-727c95135dec", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba29f1ee-8e55-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785663427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663427, "uuid": "e899e47f-246b-4575-ba27-a527ae9a75a2", "comment": "Malware payload (Prometei)", "value": "f16b974ea92a57f1b959af6d1df8b1c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663427, "uuid": "c560732d-d658-4083-a687-1624ab3c9ec9", "comment": "Malware payload (Prometei)", "value": "6ad822effb96e4b90677e7f9a2cae747394ee70fbbd5de30f4a4999d61a75eba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663427, "uuid": "7368e284-cc54-4803-9766-20949a4fcbea", "comment": "Malware payload (Prometei)", "value": "b4293d209281ec6dd8f4ba13640e1cc169854060", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663427, "uuid": "dec2d3c5-e089-4b26-99ac-32fc7f88eb30", "comment": "Malware payload (Prometei)", "value": "8cba53cee5d51a42041dfa6ca9f9a1cadc767f3d3e4401a96e0e73277c92f2183c9bed9149fd3f8109f69a8bf9c4f52b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663427, "uuid": "32cb9ab5-a266-49cb-8bfc-74a039e20f32", "value": "T14DA423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663427, "uuid": "e1e6bda7-2779-4117-8217-f7bc09e61093", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdG:Fs6pyCC/Ya2hpi6T6N4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785663427, "uuid": "6054b1a7-c659-4ad7-8249-6536941fd0b1", "value": 449061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785663427, "uuid": "f2789838-4dc7-4d47-845e-88f0df54cb0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663427, "uuid": "3299775b-cf67-4c0c-a33a-190a458ed334", "value": "6ad822effb96e4b90677e7f9a2cae747394ee70fbbd5de30f4a4999d61a75eba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2337698e-8e06-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785629243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785629243, "uuid": "c180a3de-01d0-46d8-a408-0974328371ba", "comment": "Malware payload (WannaCry)", "value": "92d7549c8cf73bc0f29cea5ba8991560", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "honeypot-xore", "colour": "#2B0331", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785629243, "uuid": "29287cfc-9908-475e-aa5f-65e543bdd434", "comment": "Malware payload (WannaCry)", "value": "6b465dc7cc21ba92d848425f8eabae3dc9f72d873d92a7b18639fd79814c7b1b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "honeypot-xore", "colour": "#2B0331", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785629243, "uuid": "4f406779-822d-4a9b-ad6c-4414bd31ea60", "comment": "Malware payload (WannaCry)", "value": "84385c351cdf4cef52b816d5864431f29c615db3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "honeypot-xore", "colour": "#2B0331", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785629243, "uuid": "ed001481-5638-4a36-992e-892b65909c25", "comment": "Malware payload (WannaCry)", "value": "335f90d8d935b14cf76a5f562518be235fe7fd5d4ffa8230b2daf10a7fdfa26f4f402dcd3c54c810edff75cb49968673", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "honeypot-xore", "colour": "#2B0331", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785629243, "uuid": "e0349fdf-0c95-4a49-bc24-3521a2577d0c", "value": "T1B636235A757CA1FCC10A6375B4778A2692B73C5A22BD9B0F9B548B220C03760FF64B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785629243, "uuid": "fccda2e8-3da8-469d-9b19-2e94ddcfd7f1", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785629243, "uuid": "23ab4862-6322-4e89-8d7b-9ba34f5b8aa4", "value": "24576:RbLguEQhfdmMSirYbcMNgef0QeQjG/D8kI:RnUQqMSPbcBVQej/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785629243, "uuid": "107fdcc0-0e54-4ebf-8029-febe437c1896", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785629243, "uuid": "180bb0e3-dd06-447c-a68c-4aa190e4a1ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785629243, "uuid": "41fbd4b2-5c7c-472d-8c08-231e2bf44bd7", "value": "92d7549c8cf73bc0f29cea5ba8991560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c4ff6d-8e10-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785633749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633749, "uuid": "13953fa0-7513-4ad9-b220-abee8db56593", "comment": "Malware payload (Mirai)", "value": "e5fa023db639e70cbdfa68149fc7416c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633749, "uuid": "9ce4bf40-9f35-46c8-a1b1-80975f1f7ded", "comment": "Malware payload (Mirai)", "value": "6baeb67d22fa275bd2426180e5fe051ac1831c050db47d8fb89640813d4f4afa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633749, "uuid": "b7dbd0ea-b017-4b56-a8ac-54bd3ba4e5e5", "comment": "Malware payload (Mirai)", "value": "8b59412e0b6d3c11e488a503971ea173493d66b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633749, "uuid": "b7f45065-f6d2-4c07-90e8-8b5e0efa868d", "comment": "Malware payload (Mirai)", "value": "7c7762fa1198d8f43e284b95d8f3811e71d6995f2c95b5eb3f3ac8d76b2d87ad9002cb238df4be56c59bd10afb40cc03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785633749, "uuid": "8e085d99-69ed-42a9-bd3e-37f84f65216d", "value": "T16283F682F8828A2AC2D4237AE66F658E3761B3E5D2DF7517CD204B123B8511F0D67E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785633749, "uuid": "d479613b-0a5a-46eb-83ce-5058e4983641", "value": "1536:z3MBXt7eC/zU+8Ij35OiKgjwMn7E/mEvsBrSlLUuwB:z3MBd7e4zUI/wqSRAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785633749, "uuid": "54176af1-60a6-4912-87b6-d3a1d722828f", "value": 83396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785633749, "uuid": "f66d53c8-d31e-4cc1-9ff7-d8df6b9b85f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785633749, "uuid": "504a49f6-3523-492c-9ec4-aac75d44fea1", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee68d680-8e0a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785631302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631302, "uuid": "a305743a-74f4-4cca-83e1-393987e2af46", "comment": "Malware payload (Mirai)", "value": "08287f0ca3af805842739aa50af9b8f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631302, "uuid": "c015ef6b-314d-4426-8ec2-b1e94aeecc9f", "comment": "Malware payload (Mirai)", "value": "6d987d86a194619f432a0e317c0bc4490fc3d25113ab3880018a4da7cdb5f3de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631302, "uuid": "9d359b4d-0bb9-48c6-a6d0-b1cdd6f19a63", "comment": "Malware payload (Mirai)", "value": "06284449156bb67999acf067f47dd0048a68519d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631302, "uuid": "a3156403-cbc4-4d43-a235-c3559c71b7ff", "comment": "Malware payload (Mirai)", "value": "ee112fc1054f0ef841bbaa50f81ca487fcf769611690f7b4ba302824d27da02f6d5a0859958d5400b345a6e97f99ed12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631302, "uuid": "6dbc06d4-2c0f-40d9-a97b-3337d1d230f4", "value": "T1F223F1E4801294E38DF11D3DEDA805C22E94B3F19A1F707527BBE151ADA209F7AD6892", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631302, "uuid": "e66a9606-0b7d-4984-bb22-93d490fe92b8", "value": "1536:rkjf1IqoN8F9rahm7QstqeRS++LzD53IPXDdLV:rYt9oNA17LQek+Kf534DdLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785631302, "uuid": "4c18e3f0-2c43-469c-9b40-0e64e5d99b13", "value": 50056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785631302, "uuid": "2701d5b2-ff82-46be-b3e8-2a27568eb5c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631302, "uuid": "5c59b473-c056-4dea-846c-07018d2f4374", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c93540c-8e3d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785652935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652935, "uuid": "464b73b0-1400-4716-bb22-91f5b528e31e", "comment": "Malware payload", "value": "710e73380d065196dd75f885595483c1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652935, "uuid": "6451bba2-ada3-4690-8165-e4f79f909d1f", "comment": "Malware payload", "value": "7069263ef617b58bbe97b46933854f2a13d7bcccbac771a74b531fff07e43bd1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652935, "uuid": "b50204d7-8b4d-4606-9f44-e0a9c411fd52", "comment": "Malware payload", "value": "90733b9b52fa2887e5268e21787a76b7ceac062e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652935, "uuid": "bf3072f8-abe8-4eb8-9cd9-98f748533d11", "comment": "Malware payload", "value": "a2defff423e9af247fb557c174833300de2a424dbf723f1751efb8556d271cd6a213273a5457b7a1bacbd924a6109157", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652935, "uuid": "8266ec15-1764-4efd-a80b-88f922bc5112", "value": "T1E7236D651A857C24AA98C4371D7E2F0CBDAD43E6324492DE7FCA3CF28C5AA9DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652935, "uuid": "d557c256-586a-4cf2-9273-b98dcd976043", "value": "768:UXRWNGxVL9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:olx+cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785652935, "uuid": "df037256-5952-417f-8ee0-0ea796bf582b", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785652935, "uuid": "fa1bc132-f76d-49e0-a79e-7469ba21f040", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652935, "uuid": "2916b73c-6553-46b9-b2ff-cf3d6b7a2b0e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307c5f91-8e73-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785676081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676081, "uuid": "5a9a46bf-6caf-4772-a732-b29ce6cb512b", "comment": "Malware payload (RemusStealer)", "value": "f3ca8dae4ea1332aff145624a1a1b452", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676081, "uuid": "0e927c1a-5d88-4603-ac8b-ccefa9018b11", "comment": "Malware payload (RemusStealer)", "value": "71f17c5e06548f128eb4f0cfafd247cc79894331f996c383fa5c2bcddfe9c5b8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676081, "uuid": "92d14349-d25a-4743-a3bf-ca26e5a83184", "comment": "Malware payload (RemusStealer)", "value": "9d8da374ef6eb7d66464420db904f6b66f1dbc83", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676081, "uuid": "b809bcdc-042f-410a-b676-237594f2e31d", "comment": "Malware payload (RemusStealer)", "value": "b3ba9416dcb501bf33f40af88e5e20a0bfd5856642b43788ed13efa9cfe8adb901bd05b3dc59ddcbfe7f6bf273e5e1ac", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785676081, "uuid": "3a86349d-c9f6-4256-96ef-8673512790cb", "value": "T15BD523E7ACD3A884E085C7B40267766F317E3F8699A14D6F758DF980AD33B205E39052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785676081, "uuid": "408c4a78-4861-4c8c-98e0-c3bf4cbf09ff", "value": "6a368102586dffa13aabff685459b467", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785676081, "uuid": "4a155a20-e425-4f2c-97fd-1d24eec33f46", "value": "49152:syuV1hXhq3eb2JEaXfrvndGJJUJIVajUndqvm3DV1CrNhdEEfWpVmnwXYc:SVBq3A2CaPZGJJjaonZTV8phdmInS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785676081, "uuid": "1df6ba2a-4d72-420d-9715-c6e21e8fd8a1", "value": 2941680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785676081, "uuid": "f24aa20b-7ceb-4787-9a51-894c7514ef48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785676081, "uuid": "bfcfb69b-bfb8-41a3-943a-aa3b2089d9fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d9e808-8e10-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785633699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633699, "uuid": "3dcef0d8-8653-43e4-ab6a-fddcd0bdb6c8", "comment": "Malware payload (Mirai)", "value": "deef52143396eea1d61cfffc2e152961", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633699, "uuid": "b2ea6d8b-1abb-4721-b55e-45c8a880bf8b", "comment": "Malware payload (Mirai)", "value": "7218d0523a4d05c52557f93febc58b45b67fa65a91e62656a74724d3ad87772d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633699, "uuid": "4788eeb0-6478-4eba-a954-18f0d5691507", "comment": "Malware payload (Mirai)", "value": "863d2f2e873886a1e6ad173ce48c3ae7461faf9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633699, "uuid": "86b1c913-3a8a-43ca-8022-c09b9d21292e", "comment": "Malware payload (Mirai)", "value": "4a82ae6ca79a759e0ab46c79c47c036e0b582aba40887778f412f590b750f7a8d021deef84245ea892488566b1c7e31c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785633699, "uuid": "77b49604-26fe-4736-8aaa-a34f231bad38", "value": "T1B4D2DF500442E9B695306475ABEC85C3738F56ACE4BA78672A800FA0FF61587ED7D7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785633699, "uuid": "817e4c36-bf26-49d1-ad71-e3d2088ea930", "value": "768:GPaCwwwmXkzedefht4oCydLRzc0s3Uoz7od:2cpmXkwyCFyd5izsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785633699, "uuid": "a3395ab9-85e9-4495-b8a8-b47769065954", "value": 30920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785633699, "uuid": "e0b177ec-5fa7-4ef2-bfbb-fd0172cdf6ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785633699, "uuid": "76a8077d-2d29-4084-8f3e-94b814ec1e74", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7cf2db-8e40-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785654223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785654223, "uuid": "531a4484-3b3f-48fc-b549-4c80029b1917", "comment": "Malware payload (Mirai)", "value": "df70c864d45ebd669e4195fc893e36ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785654223, "uuid": "2b53e19a-2bd6-4263-8ce9-604f07a524e3", "comment": "Malware payload (Mirai)", "value": "725cea7ff1e9ff01093dd31f0cd10d0bf5de671905120aa1647d1ec0401451c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785654223, "uuid": "67beeeca-44bf-4fc9-8afa-216e4844d85c", "comment": "Malware payload (Mirai)", "value": "fd5df1fccf60b585036fed16580783cc4bf6dc7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785654223, "uuid": "c5c153f5-b2f0-4552-885d-5f0fe5772c26", "comment": "Malware payload (Mirai)", "value": "fb9add0aafbc7a207bb71d008e7eb173866f62c29fc39b3ac0bf67d2659554136e417ad9a45c4b3ab2365a412f489493", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785654223, "uuid": "0f7b4903-acb4-4e74-a654-116d128760d8", "value": "T1434112591FD01F33DDA6CC36464A2B512ACC842BA16A23966374DD60BD3EA05E7D38E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785654223, "uuid": "448ca0c7-7cd8-4707-bb38-18b325ca9380", "value": "24:mNBj3HsSimpH4/ixZuDa9mGt5NJL4mmlZ9bpe4g+/qc+UTK8WKUlu/eTlQwFLCZ5:EQ2fnuDS3N6df9++SMTLWPkeTBFWXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785654223, "uuid": "1e23beaa-dc20-4f33-8972-f8313b5bcdd7", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785654223, "uuid": "c4b7e856-339f-4926-bdcb-c39d10ee5c0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785654223, "uuid": "892473ef-19d6-4fa1-8ea2-823a395271a6", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccf2b52-8e4c-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785659566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659566, "uuid": "16246e8f-226e-43df-a4d2-34332e2ae3db", "comment": "Malware payload (SalatStealer)", "value": "699a48056ea661dd446df61d4b107fa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659566, "uuid": "28cc0b31-be86-4879-ab22-cc3f150a81c5", "comment": "Malware payload (SalatStealer)", "value": "7261c4276f44e0ac3b2ef43ba4de223ce1278db20286750608777f41df0d68fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659566, "uuid": "e1537455-508a-4095-80a0-81492b3157ee", "comment": "Malware payload (SalatStealer)", "value": "61a93e1deb3b225f54f8cb915a88c38ce5578d44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659566, "uuid": "3daf7607-4b4b-41bf-8808-e592da1f0004", "comment": "Malware payload (SalatStealer)", "value": "4892263096544cb780c1fa060fb11efc73ade544ac8714a76733ed596b0960fe0e9d2c0580f9867e8a5938e5d9de78ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659566, "uuid": "7413a3a1-dd16-4de2-892c-bfc5d88d6c40", "value": "T1C9C65B11FADB95F2E9035831016BB37F23315D048B28CB9BEB547B2AF87B6A11D66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659566, "uuid": "8f919daa-d6b0-49ca-9167-f80e0e8e2cd7", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659566, "uuid": "2f36186f-1abb-4dad-ba45-b8245aed2f11", "value": "98304:tun+uBu7zmCvjkqwntcKNGAr4tG20CzEc0:juK/jl4cKQ0Ht1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785659566, "uuid": "8d7a8ff5-4b06-4f1b-8bab-a59efbc2b7c0", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785659566, "uuid": "66c7cb7c-f71a-4375-b23a-1f72921fa01b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659566, "uuid": "c1b6448a-dcd3-4033-bc99-347e09005c65", "value": "Zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c9c4a8-8e54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785662901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662901, "uuid": "18f1301e-81c2-4fc1-86d1-37607e5e63b9", "comment": "Malware payload (Mirai)", "value": "d72a33996fc35f53177fdaf239d3e023", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662901, "uuid": "a5573c8e-6836-4aef-8932-d9018651dabe", "comment": "Malware payload (Mirai)", "value": "7322f4ca795a8da60dfa55ade3ba04cda3338a9ad1ce3b2b45f5c09ea47c296b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662901, "uuid": "d2afa782-747b-4e0f-b805-85b6e04c4760", "comment": "Malware payload (Mirai)", "value": "e5d30e3b560da76a70396c3fc319eb37f80c62a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662901, "uuid": "d42ac9b5-5f39-4c8f-aee1-ece54fc4f1aa", "comment": "Malware payload (Mirai)", "value": "8bb39d18e69bbd6ce167c801253d1649ca84671eb818560cf99ddb387af2202a84a40ac00778ec0dfbab21eff98642ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662901, "uuid": "8481916d-7c4e-4c5e-9a8a-904ad3637c06", "value": "T12383182AFD419F05D4D526BAFE1E534A33532BBCE3EE7103ED145B25278A95B0F2A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662901, "uuid": "714ac208-8c6a-4d6e-a520-3f90db08ee80", "value": "1536:0GnhnV96WCNfeM+8Q2B+wBWjqzkRSNMeIpUOOJ0WMdlU0iPdFhq64Mf9:fnHCPYEsTROMeIpUOOl9hdFhP4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785662901, "uuid": "23bc1c22-e990-4b78-80aa-f42502a7a3bc", "value": 81472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785662901, "uuid": "06430994-3054-48dc-bc90-7bc71c4d7c80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662901, "uuid": "d93067b6-d55f-4937-8956-c3c6c4b836bc", "value": "DQ0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9f8a06-8e17-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785636750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636750, "uuid": "dc44e80b-7384-4c3b-b7c9-336fdaaf62ee", "comment": "Malware payload (Mirai)", "value": "0aa6b428b61c90d4295fa729ff95baea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636750, "uuid": "3c40f69a-08e5-4ad3-b070-ffdae089012f", "comment": "Malware payload (Mirai)", "value": "736e09c587ec9320b96517f32378c1e8770ad15490d72a5113a8a62040a82166", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636750, "uuid": "d62dc49f-b0cf-4105-9575-1c3ebb7d990f", "comment": "Malware payload (Mirai)", "value": "bfda8a99beadc4704f768604c08be7f7f4226422", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636750, "uuid": "0e25c13e-c0fd-41dd-9b42-9c72f770f99f", "comment": "Malware payload (Mirai)", "value": "decea1797975b142eaa070f660c9abbfdc0fa528fbd6dc88ba058f4ab9b6fddd0311559c1a288e41f06aac3e0136828c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636750, "uuid": "e914e7d1-c525-4920-bf61-2b866da52fd7", "value": "T16963B61AEE786A26C5D0217604E34911E97263ED1BBCA68F7EA72C0DDD15360303DEDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636750, "uuid": "c6e8596f-6339-4e64-8b65-6c464d796c0e", "value": "1536:ULDN+d8b7oiAENci0npZ1PsJY2hEEeFCu0cRlDd:ULxOENcX1PsJYQc1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785636750, "uuid": "2311a592-cb8f-479d-a0cf-5b4747ed56c0", "value": 69004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785636750, "uuid": "5a45882d-95f4-4569-adfa-ded133b549cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636750, "uuid": "b874fed2-496f-4007-991e-24de4ef452dc", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6a2281-8e4c-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785659536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659536, "uuid": "968c7506-9fb7-4837-b5ec-383ca0243cb3", "comment": "Malware payload (SalatStealer)", "value": "8b74529e0f62f2ec1d5d37758fc5d4db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659536, "uuid": "7aa31597-2ceb-4acc-82a6-fdef3f88cb68", "comment": "Malware payload (SalatStealer)", "value": "74b3cf6d93a3afdd46589c02250d99d4165b5a025acd60b62e4bc3fc4970a2a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659536, "uuid": "08ff0410-c26d-4e2b-8cce-6e229cd771c3", "comment": "Malware payload (SalatStealer)", "value": "714575e8ddca56881959ea77028eb85e2543d736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659536, "uuid": "e88dd2ff-8f73-4848-a9e0-e43634276538", "comment": "Malware payload (SalatStealer)", "value": "1f9deba9fbfeafacfa5b52ca0a71bb979d02e9b073dd58f5532f183239a6b2ad6bf93bfde9db8f8e65224ef161a3ce6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659536, "uuid": "f2c4a3b0-75c9-4f16-b424-b6a38ce1d124", "value": "T1B4F533849E51149ACAF3EA30D8918D0C6873CB6E9735644253E40C6FF2BF67365EB623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659536, "uuid": "ab7b7e26-5654-44d5-b8ea-9a4cf8c7e66b", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659536, "uuid": "376f0e77-e098-4268-a51f-f74f239938f0", "value": "98304:c+Hs8b+bFxxenJOsoxBux1XJ4xNEn1gGCewB:3KbgJ1Cux1ZUq1gGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785659536, "uuid": "04c1cb8d-c7ea-4a05-b7eb-b33ccabb77a8", "value": 3594752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785659536, "uuid": "00b38560-1170-41f8-91d2-0ad19c10bb71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659536, "uuid": "e76d5104-e9a4-43df-909a-8f5c38dac236", "value": "Zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e703ea-8e4b-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1785658828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658828, "uuid": "98d41c7c-5725-42b9-a94c-c673e96964ba", "comment": "Malware payload (SilentNet)", "value": "9e4a468967aec98a6064eaf4497ccd1e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658828, "uuid": "de991a2e-83fe-4911-91bb-341feebff93e", "comment": "Malware payload (SilentNet)", "value": "7560fbc39eff3b64611d038a17cd7e09054fe0ce0159096709252d8574fa0167", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658828, "uuid": "30613163-8e91-44fb-8fa1-4eb363103b33", "comment": "Malware payload (SilentNet)", "value": "a48ff188fbd3b4dda39f3f7e299a23092530a33e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658828, "uuid": "f40c2d27-a5b2-47f8-a0f1-b23d5795d884", "comment": "Malware payload (SilentNet)", "value": "78c81d6d9acac481d038959f173913f851369f96646110a677bbf6d0deb7c16508d3aefff9b79025d40dd24a9cdf32f9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658828, "uuid": "43e7eae3-b408-498d-892b-31bf51f676d8", "value": "T1DCF3020A2F3D85D4FC0B53F6D4881B8BB47906E0ED4B9D1939A84BF24CA256B1F7861D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658828, "uuid": "186b3820-f1ac-4c7c-9762-21b2f9355c1e", "value": "3072:QKgyuBdkhULgimydLq2DElhLyWGUVdRred600CmodG/vgRufCqlCTx:fNuQh2ZmydLq2iad6ZC1MgRu/lEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658828, "uuid": "5cc58a61-7178-4470-a42f-7ee7dbe3ee88", "value": 166310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658828, "uuid": "f17c6484-d484-4ddb-92b7-a2db9756e9b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658828, "uuid": "6e613552-624f-468e-8af7-2fe502af04b0", "value": "MeteoristAddon1_21_11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713329fc-8e7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785681343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681343, "uuid": "8f837d01-dc0c-48aa-a3c8-b57dfa5f0deb", "comment": "Malware payload (Mirai)", "value": "54f1b40f4e5ff75ffed8d3f65225e7e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681343, "uuid": "fb1e0a3c-f6eb-4da0-9ef3-3e108197155b", "comment": "Malware payload (Mirai)", "value": "75902d91593c074f65590e4b0098d73251b5fd67326f927aab091df798c346a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681343, "uuid": "d0059428-0600-4bde-bd61-ff9e5aca5dea", "comment": "Malware payload (Mirai)", "value": "acf84f6c68affabfec8cb5b646ec1f4856870046", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681343, "uuid": "652c6aa2-e12f-4a28-bcdd-725c621558bb", "comment": "Malware payload (Mirai)", "value": "0dd9f3f1f6e110bc505ae17d8de9b202af2ae3499a197f7c9f0d0cad1d9339aa045f2157c44f27f6ca627a8b50c64ec9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681343, "uuid": "630a18fe-5fd3-45c7-b800-8d68dea9f611", "value": "T1C9E2F1B812DF95A3D7A45CB4ADE8C1C237870630B2D7737E53289990DAC811379F828B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681343, "uuid": "e2e5b881-f1d1-4b5c-8fbc-4fa178b0f244", "value": "768:wXp9dqfwgWjizlx/00/2vgdZsvLZt9DuStTCwOuXOs3Uozw:GdqfwgWwx8NssvGluXzzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785681343, "uuid": "2686bfe1-3fd1-462a-a0bb-c5350cf842af", "value": 34040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785681343, "uuid": "00b3f495-5296-466e-b6ca-fea871b45452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681343, "uuid": "d8c05cc6-48fe-44d7-8e01-f81340829f54", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11729d03-8e83-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785682900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785682900, "uuid": "5bfcd5b9-312b-4fa5-b038-342be63467ce", "comment": "Malware payload", "value": "96be0b244580204791528ea0417555e2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785682900, "uuid": "37bc5816-388d-4494-b244-a32ae2efcfde", "comment": "Malware payload", "value": "75ac27f46332584b7c8ded625e75c6a019d7d90575f622922596ec0590db92ea", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785682900, "uuid": "90fa8b23-18fb-46ee-8b4c-7cab57edb737", "comment": "Malware payload", "value": "25326df0ccc267e8acd18abad2085b5dfb8b55d5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785682900, "uuid": "7198bc08-8586-4f40-812c-406efc2f7366", "comment": "Malware payload", "value": "a4597a9223373a8d4d4a09c2512c44b2e2cd0648b57fba386a0b68a3890601f6410505a364109818e700360df930d82b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785682900, "uuid": "c2aff0c7-8c11-481d-ab33-2e35fc0edde7", "value": "T1DF563351DECB85A4ECF1F93A09907B679327E499E6171F4E668CD23460AE2C0CF418F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785682900, "uuid": "5fb5a1ab-7d4e-4841-9eba-3526edf0e586", "value": "98304:mDuSAtcuo4KFMD62nftlIqJqjT1568cpia/SdjzizMIAy5b3qqZ5:46qJlMu2ftlbqjTjzcpiXdjWzlAbq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785682900, "uuid": "ce66aea8-b690-4590-a426-88c8ed9c523d", "value": 6328682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785682900, "uuid": "3f6ad66d-4cf7-4e80-8b1b-19f7b125299a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785682900, "uuid": "5ee35b96-baf3-4abe-a592-dcbb1737af5f", "value": "75ac27f46332584b7c8ded625e75c6a019d7d90575f622922596ec0590db92ea.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a15ff98-8e7d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785680445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680445, "uuid": "cb557d7a-d9bc-4407-8397-75c44b75742e", "comment": "Malware payload (Mirai)", "value": "afb22a91ddfcb002ac587ad1505479f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680445, "uuid": "42e2b321-c912-40ea-a988-6d65de132488", "comment": "Malware payload (Mirai)", "value": "77e333ea73a0d3ff2052566169f3bd976ae4b0677819f25933d8f3ad83f6e4e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680445, "uuid": "2f196f28-7927-4053-923d-0b54c2380fed", "comment": "Malware payload (Mirai)", "value": "c6ddcbdf056eadf59ccb7a191a37fc0319bb0784", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680445, "uuid": "a89e463f-3e1f-4be3-a9dc-52310b397f0d", "comment": "Malware payload (Mirai)", "value": "53bceca143ddf35195d4407d4dc8a220c692371b6891bad6914d8773b2576b3d868e897bf5d29676dd542ffaca34d0c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680445, "uuid": "f10cb324-b3ac-49f8-8380-449a32849a87", "value": "T1B8F33B46E6418A13C0D6177AB6EF424533239B64D3DB73069928BFF43F8679E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680445, "uuid": "a8dcf170-869a-47df-9e90-8b8fb1cb1d38", "value": "3072:8vp4kmPbiajBzQSrSTa49U3ymR8B3pK9bye1M/9r00:8vpWDiajBzQSrkN9UVRm3Q9bygM/9r00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785680445, "uuid": "6a44c91c-c237-4b20-9eed-a476189ccada", "value": 158563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785680445, "uuid": "ca4851dd-43b1-4eeb-92ee-e377da504194", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680445, "uuid": "6dc6d6bc-9bd4-4150-95f0-2df01671167e", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c1c4c37-8e16-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785636076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636076, "uuid": "0e518d1f-0b1b-4b09-9e5d-431b195b7909", "comment": "Malware payload (Mirai)", "value": "2850bed410f3ef5bdd143567666c867e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636076, "uuid": "ced02c0f-fb93-4e93-9c9f-e27fd2ada86e", "comment": "Malware payload (Mirai)", "value": "78238dfbb4da6c6d8c04ba930deea29807c11d25e30bfd07e73d363603e57648", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636076, "uuid": "0f790558-8358-4c2a-883f-29c92fe9054f", "comment": "Malware payload (Mirai)", "value": "e1dcdb4a96cb80bb4f5c18a5a252698130a9c0d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636076, "uuid": "35d8dfe2-50ef-45ab-9ad6-ea39f5af87bc", "comment": "Malware payload (Mirai)", "value": "d635a25583ed68dd238be20ecb897aa4e199b1b3c6d8bd6e729f742838a86865f663a88b79319d37f97dec8774247a1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636076, "uuid": "7b67eac3-71c1-492b-a4ab-a467a97edae0", "value": "T1DBE3E71E7E618F3DFBA9C23447B78E26965933C637E1C585D1ACDA001E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636076, "uuid": "45222e3b-e5cd-4eac-9e71-b18ac4d3c0c6", "value": "3072:6F+6uk9hckUGXZy9q/uleW0AJsPQDLHFwLH6EDq0Rp6+P+po5C5DB1NjHm1X8AfV:6F+6uk9hckUGXZy9q/uleW0AJsPQDMH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785636076, "uuid": "9152dfb5-50de-49fa-af74-b3b9e3e46170", "value": 144696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785636076, "uuid": "106db3d6-f5b9-4f8a-a804-47d35874f3ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636076, "uuid": "1008973b-805a-4906-b66a-41c289273424", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e11053c-8e14-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785635355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635355, "uuid": "9b852378-3111-4410-9fa9-9c2d239c01fc", "comment": "Malware payload (Mirai)", "value": "89d6c46a455a89547ad989f25018ee2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635355, "uuid": "03cf2c7b-f798-4f76-a8f3-5228b3ce8d98", "comment": "Malware payload (Mirai)", "value": "7861050378c2366c6ce197e14d464dfec5ad7e7a15aed97fba99e2a9bb870e91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635355, "uuid": "52c249a1-c48d-4b35-8adf-fe358c55bc69", "comment": "Malware payload (Mirai)", "value": "a39f9b2e5ace6b871a40e2b2ab215172b1a9d68e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635355, "uuid": "2b82c649-1725-4244-b318-2ab5ed1d4f7c", "comment": "Malware payload (Mirai)", "value": "3065968dde1bd9ffc492d7da168c16724e06c019c05e5d559097ee2895d73481d603d6aff34c344120348825c2960103", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635355, "uuid": "0be3b74e-5bb2-4f22-91f1-dd2b4ab9c9d9", "value": "T195041797FC00CEBEF41BE37644570A057130B7E145926B376663796BDD3E0A92823E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635355, "uuid": "8ef8c371-7b16-4fd5-b5c4-6ff706fb9c81", "value": "3072:YNvHE8TimUgvkth2a8iHU6luxOg8AooVsjbioLSqRty4NODVp2:Mhimk2a8iHU6ox+AoxLly4CVp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785635355, "uuid": "d2cf4e42-a75e-465d-9539-7efc3165e9c6", "value": 176480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785635355, "uuid": "0590390f-06bf-4f0c-9352-eaab9708e12a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635355, "uuid": "19bc8ee3-491b-41c0-ae04-6ee2e856ed80", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268fdc1c-8e0b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785631396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631396, "uuid": "2a064f12-f933-4882-a6d0-3860c79999e5", "comment": "Malware payload (Mirai)", "value": "d39891972c4aae814411b4e56cd284d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631396, "uuid": "626e3750-4443-419d-b828-849f786fc805", "comment": "Malware payload (Mirai)", "value": "7948a099bfa5e5ffb60a1c94a64cbbae5b2f359a0a61159f39b54973b8f9bcff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631396, "uuid": "ae268f6e-97d2-454b-97ed-6dc827d00369", "comment": "Malware payload (Mirai)", "value": "743cb34ae6af3ee2db8d46a819df6494e66986a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631396, "uuid": "c676cb12-6885-4a8d-83b6-e9f2ff65b723", "comment": "Malware payload (Mirai)", "value": "099cd2756b4de51bf97212a904b15f5b241888b2a2f2af8572053429826c1ccdd1bcf269e80ee2dcc5e972589251518d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631396, "uuid": "c00ebebe-fc39-4013-ad44-1b032f4df8bd", "value": "T1A813F191F0501CFBD2BFCA202741DADA37B98F962B6E65F27580FF54C60152A26482F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631396, "uuid": "d692f44e-b638-4756-9695-cfd7e056439b", "value": "768:e6tQngu7T7t9yzKJjSiUI8e3H3nSj5Zkc4e5VFEiYsJie8urJJorlAdLqV0n04ux:rtjuR8aS/2H3IR35VrXJie8ufYlnV0na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785631396, "uuid": "b5f93bcf-bed4-49b1-85dd-b88360f29114", "value": 45244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785631396, "uuid": "46993fb8-d39b-4998-ac2e-c319bf42290e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631396, "uuid": "d3d12990-6f6c-4d95-8f46-23a436023f96", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233083b4-8e3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785653724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785653724, "uuid": "e6cf5f75-ccf4-48db-9811-09fd1dbbd433", "comment": "Malware payload (Mirai)", "value": "8292ee844dc7ff9461ea8e327cc06685", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785653724, "uuid": "628365a0-a9e3-4cc9-a215-00dc9f28c406", "comment": "Malware payload (Mirai)", "value": "7a3e260d7dec64aee8169ab40edacb787462470fb6e1ba47119b022fd8143501", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785653724, "uuid": "914171f0-09fb-4ba1-a3e3-d90bfb5737cd", "comment": "Malware payload (Mirai)", "value": "7a1c9d5408fd9c3ef1fb6afe1aecffab51dc1c28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785653724, "uuid": "de1d9219-2fc9-43a4-9482-eadf6846fef7", "comment": "Malware payload (Mirai)", "value": "abdf2e2b375bdc79b5555454c8a883a027d4644961027004e8bbc2f00f837fb039ec5e637ee8cded565b3c91238d2819", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785653724, "uuid": "1d36736a-3807-4a02-bebf-b70cdc400fa1", "value": "T1A4F33A49ED812B11D5E626BAFBBE5189335307BCE3FA7111AE104F3127CA91B4F36A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785653724, "uuid": "bc6013e8-1c81-41e4-a6d6-ab3de78dd177", "value": "3072:S8zMKZT9IYYSlM3W94QkHcI4Wda+HJ/wan4E8KhUNqFUB2S+gUuu:S8zMMYSlM3W94qI4WUgNwan4E8Kh3m2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785653724, "uuid": "16ce8411-df2e-4b11-82a2-0a12a56c7462", "value": 169668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785653724, "uuid": "5d73e117-6afa-4638-9e19-82ad51ce814d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785653724, "uuid": "1832b114-1b4f-4950-aeda-b151d5b9067a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdf05ca-8e7c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785680240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680240, "uuid": "184592c3-9187-4647-9eed-1788fd9e7446", "comment": "Malware payload", "value": "37453667ac9b1878750ba7f7acac3dd7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680240, "uuid": "7c4dc5e0-129a-4fbb-91db-cf3156c93ba4", "comment": "Malware payload", "value": "7ae8d79fffb211c7400154dabf3ba54fdb9ec3eab9dee67d023eaa25092a6ec5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680240, "uuid": "a1dd922b-1ae7-4453-a64d-7aa53fe2a67e", "comment": "Malware payload", "value": "779e995985e3ffe156a36862493bb6473cb6efd0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680240, "uuid": "57df167c-029b-47c5-a82f-f79cb2028f79", "comment": "Malware payload", "value": "c58986a9a25079a356cf75ac9a4237e1c3c9d723c4b05b81c318d33387deb1a4f512978113a12ba671e9795cf61de16e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680240, "uuid": "355ea1eb-3064-483d-bf6e-3f256b80b02e", "value": "T1DA236C6516857C14AE98C4365C7E2F0CB9AD43E6314492EE7FCB3CF28C4A6ADA20875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680240, "uuid": "c9053453-b1c4-4ca5-a8e2-00c4c8a2593f", "value": "768:L99NyXsZztCQ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:hHusZQcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785680240, "uuid": "925c3b6e-7d80-4ac6-8c27-351fc866809c", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785680240, "uuid": "4c3a62e9-1677-43be-9188-db10aa5b93fe", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680240, "uuid": "ec0631f3-b6b6-41da-988f-00110f764b1e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9e39e4-8e2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785646122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646122, "uuid": "81ce3251-6177-4b33-8932-7444a25f27d3", "comment": "Malware payload", "value": "74745cc988d8b512d070c9d9f1ad403b", "object_relation": "md5", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646122, "uuid": "c5be1f24-a6b1-4a9e-93b7-4b5f1745c205", "comment": "Malware payload", "value": "7d90b60e49f1589f7b076a6be149399d2d342dbf96fd30168e817ad9351498f8", "object_relation": "sha256", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646122, "uuid": "39855889-1c7e-4285-ac90-f1221a8dcc27", "comment": "Malware payload", "value": "545beea382ba9e41b6408455c8ca4020db97d162", "object_relation": "sha1", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646122, "uuid": "24076c2f-ac7d-4d75-a843-44252a14b079", "comment": "Malware payload", "value": "6d710e2ca8ea73f4556ef8fecd4bea839ee15e25682e5b4afa90ae4fc258c42c5cb8ae96752ed087d7e8f7c5aca16ed9", "object_relation": "sha3-384", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646122, "uuid": "500d4445-f758-403a-b9c5-2465cab28cb4", "value": "T1ACD5234CFCA50170F876CBBB5797B0AE712977808AB48D5632CC67201D629287DBB379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646122, "uuid": "f80fc5cd-5bc2-4848-8706-f7cb682f53a3", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646122, "uuid": "1609acc6-61a2-4c5b-a772-986425cefd22", "value": "49152:55urFHgt+nKCsFEUuNBmAnT+es4MPyypLJNzFSVY9t4QDsl:DiFAt+nKCsFEzBmWI/PyypLJN8VYPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785646122, "uuid": "994347dd-969a-47ee-946c-57860e0655dd", "value": 2984448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785646122, "uuid": "a0709807-c464-4702-a7b0-4112951cc86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646122, "uuid": "1652b4fc-2a03-44b7-be6f-9ff3d69457fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a1678a-8e16-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785636326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636326, "uuid": "f9c63c1c-04db-4e8f-9459-31a86c9c5042", "comment": "Malware payload (Mirai)", "value": "f8e85cd9815e053b13ad568a6b479db0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636326, "uuid": "82abf790-cb8c-4f83-a2a4-972671409bc6", "comment": "Malware payload (Mirai)", "value": "7f49a17645cd8394dca58c67cb6c5ee810291f51111c632d67fb5d9c82bd1820", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636326, "uuid": "3d03bbe4-3608-430a-b409-5682738655c0", "comment": "Malware payload (Mirai)", "value": "4229b4f1c749e030bbf7f5cb847c82a2a19d1ad9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636326, "uuid": "3b8977f0-9929-4bff-b3d9-4dda3095ac5d", "comment": "Malware payload (Mirai)", "value": "49d4ffc72cc5af20766e9f2ee93ec4e1612e5d1874130c90df2e9a05b966334276071b264186728f23545893594fd04c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636326, "uuid": "5579c659-f249-4f78-9355-d855a5e24cb4", "value": "T100C33CCAB802CE7DF90FD5B644630D0AB935A3A156C31F26625BFDD3AD321A4BC12D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636326, "uuid": "b0f23773-b4c7-4ca6-bcc3-fdb6d4806ccd", "value": "3072:WNU2AOGhTyN2r1YUgBUqzh3H1NWxM/R/bw:wUTOGhTyN2VUFV3VNlR/bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785636326, "uuid": "729ba148-90a0-463f-878b-ea3ecbe26e13", "value": 118728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785636326, "uuid": "81a46185-71c1-4d20-b761-4bcd5edbb364", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636326, "uuid": "97ef4679-d101-4c6c-abb0-ab559c0342d0", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f04ee4-8e72-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785675774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785675774, "uuid": "9f6a5afd-b0c3-4f7f-b26d-338b35b6b70b", "comment": "Malware payload (Mirai)", "value": "b655d673cc2563cca8aab1f5739bc3cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785675774, "uuid": "1f3f279f-2a7d-41cb-9c82-f8f1622bc92f", "comment": "Malware payload (Mirai)", "value": "82bf3b4f90f617c0ed61d79e84dd2bf0672c6809993864d9e1c5a17125b60904", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785675774, "uuid": "760a7cb4-408b-45fd-99d1-15f4e34567ce", "comment": "Malware payload (Mirai)", "value": "a74f83f1b8da0944efb9d619025f08607f086d80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785675774, "uuid": "e66b6d00-dedc-4763-95c3-18baf45e10fb", "comment": "Malware payload (Mirai)", "value": "72f5d8210caa7bd5dcc452a039c69121ed4b1cf901e6ba3c05218be859f502f9af6690c6ac0e92cd6bcb15d0c87b51dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785675774, "uuid": "ad04dfdd-d2ba-4bf5-9ca1-428d990090d2", "value": "T10B539E73C63E2E54C19582B4B8709E751BA3F54082975FFA1A96C6B98083DECF6093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785675774, "uuid": "f4437236-c803-4326-b37b-c79c0c5bffcd", "value": "1536:3LwtVRCFOcpD5k/KloeemSyiCSY5T+8zs/nz:3LQCQcptkillSyiuNDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785675774, "uuid": "a8701a8f-fd4c-4468-b5e1-a1f5de9dcec6", "value": 64908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785675774, "uuid": "7a9c46c4-0a02-4947-8579-760f53c63879", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785675774, "uuid": "7866a659-7d7f-44db-828f-198b6a8d6f88", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a72a8b8-8e76-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785677493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677493, "uuid": "0809c34b-18a1-4f40-b934-93baad4aaac7", "comment": "Malware payload", "value": "2a76642e27222609fe79e0ac037a75d7", "object_relation": "md5", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677493, "uuid": "49552dbe-3785-4716-aec5-924aae182347", "comment": "Malware payload", "value": "83dba12b70e10ff9cd75ec1ec133b9f520988d5351e8c60d59abc078bfb04109", "object_relation": "sha256", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677493, "uuid": "ef664760-2fb8-477d-a6da-2217ca50417b", "comment": "Malware payload", "value": "b7a0fab021e9689c3147fc93c916411177209e24", "object_relation": "sha1", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677493, "uuid": "9f2914f1-531f-41ee-8f3d-c93a291c3c0e", "comment": "Malware payload", "value": "9ed5a35e2b7f2b650f0d9cae766953fe11ffd3bc5d8f16d84b32735161ae14179b15e19e7b85fe0bd8cc5aca6f98af79", "object_relation": "sha3-384", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677493, "uuid": "d481718e-4be4-4f0b-b8d7-2849767e2e83", "value": "T1B8D5229CFDF21530E833C3FA45836AADB12937808AB14D5B66CC9B546E636082C7937D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677493, "uuid": "b2d3ed3e-8c55-4d6d-8b25-77b52574049e", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677493, "uuid": "f6122562-ad72-4697-a037-e880967e6bf2", "value": "49152:+/9TXohz3ZQ1AuwxNtmDf7er4kQ7dS3ZEXOm2f8q/fGNrRZDW7CG9lA8fvRpBB5L:+/NXohzBDmDvs3WXOBBG1LD0/DfBJIUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785677493, "uuid": "c5da56ec-be35-4087-9519-77f01292eb5b", "value": 2948608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785677493, "uuid": "c3f57660-60b3-4a31-b4e6-3e520f59e432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677493, "uuid": "02745110-2fb0-42a3-aea0-4c0bfa1af49b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9a6217-8e14-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785635596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635596, "uuid": "6a62b012-88b8-4e7d-823e-44110405c6fa", "comment": "Malware payload (Mirai)", "value": "3adc827f1ef0aac9d6f1e8d8bb0a14e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635596, "uuid": "545b32c9-cd37-4174-838f-c07f143976dd", "comment": "Malware payload (Mirai)", "value": "85938a1944c69e21ae3034e69ae7e6bee123204d15ccbf4bfdd9e90ea2ea2730", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635596, "uuid": "526eb9ac-cedc-42ab-9100-9877a7d0b270", "comment": "Malware payload (Mirai)", "value": "4f0ebb49b8d64a083f71ae33051334ab72b8e33f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635596, "uuid": "59070fa8-9ed9-40d2-92b8-028e75ceb63f", "comment": "Malware payload (Mirai)", "value": "c9092fd687263bd64afe07097b4f1fc929a94b9ac372afe3245ee294087b77f1fc239d8f159a7ca13f8cfb61e34afd4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635596, "uuid": "0f5222bf-a3cd-4fdc-9429-4797dcbe415a", "value": "T1A7630259EB4634DBE9206AB2C47CD8A65B798B4C72571F930F4C87A8C978E132D1D80F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635596, "uuid": "63458d98-ee90-433c-bc3e-7dcc7ad6bb4c", "value": "1536:ptMg4w5mHHtAP5DKEQZMbZyJC5OJKPcRq2/LUQrOr68ON1z:7fF5mHHtiM2bZWC5yKPcRqqLUYY69Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785635596, "uuid": "5152eee5-8b99-4f53-a230-18886e579c9c", "value": 73080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785635596, "uuid": "c21b1ed4-88e0-4000-9b34-1364311e08d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635596, "uuid": "9f1258ef-cc05-4e1e-983f-dfd13bb782ba", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bf6f34-8e49-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785658052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658052, "uuid": "e60b07ed-a774-4ce7-aba1-158539472b00", "comment": "Malware payload (Mirai)", "value": "0903af52678b5ab90b9f1a8ffed2182c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658052, "uuid": "5a107bd6-41ec-4a6e-b5e8-0281c7de8d14", "comment": "Malware payload (Mirai)", "value": "85c6051e686c2d34b070b4b56b55fab7796a7647f8c226b84fb329bbd5dca200", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658052, "uuid": "f8c775f9-e8a8-49d7-9b12-cf64820447ad", "comment": "Malware payload (Mirai)", "value": "59a21af703241604531cabb4763fbd4a1a3e6766", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658052, "uuid": "738acb32-798c-4867-9347-0ed564b6500e", "comment": "Malware payload (Mirai)", "value": "c3b8c550fffb81f39ede0e15ed397b178322956d321316bac8595f973fc11cf92c82cf66e64b0d6b0c019e1c7a204b08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658052, "uuid": "62c377db-1e1b-4161-8b2d-a805915b946d", "value": "T1D1A3B91E6E218FBDF769C33047B78A21A39833D626E1D685E26CD6105F6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658052, "uuid": "cabacf69-af78-4c5b-8d3f-d8b5c4e8a8e5", "value": "1536:CZptTNWMjWpanmFq1SMLHnnHzTVp461rZlOyeC1f6Mds/RdV:0xNWMjAani7c46xZlObMWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658052, "uuid": "56b4d27a-8140-4f8f-b948-8cca1ad431d7", "value": 97740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658052, "uuid": "b4c9a203-3cfd-481b-8b90-a32c3f3351fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658052, "uuid": "6184902c-6457-43ad-9f1d-e899f6391f71", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1c74ff-8e3e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785653414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785653414, "uuid": "03ac6670-47af-40e3-8387-2c8248a57446", "comment": "Malware payload (Mirai)", "value": "f1813effbccaaf3c96a3f09d0a4aeb78", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785653414, "uuid": "2bb2632e-70e8-4081-8f24-43ee62d009b8", "comment": "Malware payload (Mirai)", "value": "86bbbe0a3fb87277af1d30253ddb96552e3d0bfca787d85ce31a457b8d97e604", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785653414, "uuid": "329d51fc-6ce6-4cc1-8da4-345b2dc88806", "comment": "Malware payload (Mirai)", "value": "1f6ecdd88a8082c5200eb13ab7cb3f4da035e0b9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785653414, "uuid": "767ceeba-bf3d-420f-bc68-e46b245bf15a", "comment": "Malware payload (Mirai)", "value": "afbd783a6dee357d1ad6b1141611a4fb6479b21f7ba55a6aca95836493e2e3c4517bdc368b25daea37084c34dc7e2c36", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785653414, "uuid": "0d286d9b-3538-4194-a85d-9a4a9bdf069c", "value": "T18801CCC9D5548500409DC8AC29E71458F431C3C7158A4F68FFACE538AB88D04B06AE84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785653414, "uuid": "7cd6794e-79d1-4dd2-a13e-492f1898a91e", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaKCrONFCAEFECczWNCMpkjCwVJXX:kXCKysE2hi0ziQvZohaKrFRBbshkjnXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785653414, "uuid": "c28b2e14-c5cc-4a1e-abff-a71715f6c84e", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785653414, "uuid": "9d5ab694-e63f-4f10-ada5-b99295696688", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785653414, "uuid": "6ee7812e-a302-4f59-a95b-c27f4f991972", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d59273-8e49-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785657989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657989, "uuid": "abe15bc2-f65b-416b-bb39-6a15c318573c", "comment": "Malware payload (Mirai)", "value": "a320e4890c1cccf4a90bfc3ec07c0153", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657989, "uuid": "1d47dd6e-56ca-4148-b944-4ae133179ab8", "comment": "Malware payload (Mirai)", "value": "86d2f13aba7fcc47dd90a7accedee5fa0b73dd807d175a1bd90ed982b646ed9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657989, "uuid": "75314d38-1e2d-44ca-a2a1-6b58f70b818f", "comment": "Malware payload (Mirai)", "value": "7234981ae018cc5371637b0d5b897b76eab5f7b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657989, "uuid": "bdcf1102-4a5f-41da-a012-addb1da3c9d0", "comment": "Malware payload (Mirai)", "value": "9ae2e69e6e5e64bac81c5211edf45c5ad18d0c86c26846ce21fc3b62fdd808e905689ebae0dbe815cd647dd8f4ec66dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657989, "uuid": "6a860456-a346-426a-8284-bbe7de587eb7", "value": "T1F4733A81BC815713C6D012BBFB1E428E372653A8D2EF72179D22AF21378785B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657989, "uuid": "050122ca-f8ff-4f53-8180-2119735ce28f", "value": "1536:mqnmOM9C04Q7bDA/WxNZGOQs7/Y7W10j5ha1vzs/h3:mqnW5jEUZGOQWqWw02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785657989, "uuid": "95b649b6-70aa-4539-bca5-3dcdc9b0ead6", "value": 75652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785657989, "uuid": "3c5be60d-2e3e-4f73-b563-ee73d822f405", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657989, "uuid": "98510e08-9eab-40e3-89d7-7e088efa7449", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec4b1d0-8e28-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785643812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785643812, "uuid": "a895689c-bde6-4942-86b8-dabe3e47b616", "comment": "Malware payload", "value": "abe3e98cdbbeea0a79478eb613079265", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785643812, "uuid": "9fddc5cb-2181-463b-be52-f53ed177a3d2", "comment": "Malware payload", "value": "86da9c301a25d0d818aa7a862a9329dbacb398cc16e285a9b8e4a1044a889a67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785643812, "uuid": "c68d73d5-754e-4319-917d-20b97489f0d5", "comment": "Malware payload", "value": "fba06fc50b964d7b03612fa0303560d057cfab26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785643812, "uuid": "b55ab490-1c05-4a29-a245-4e3215f285d8", "comment": "Malware payload", "value": "20399c4303753d6a5ee188f692a175d5d9c0d264d50c6553badc78b8d6751addeb4846df3bbbffafebf3b422ba692404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785643812, "uuid": "9270418e-a63f-46c0-bc4b-5a6b25718036", "value": "T136C623FA46DA52F490935700648B439EB481B94D42FD4D293ED62C42971CDBF228EFBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785643812, "uuid": "092edf8e-102b-4c20-a2f6-d9a996656a98", "value": "f827c7a199f33f24481268807e7a70c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785643812, "uuid": "0503262b-4ebf-4918-83a5-3dd99f0084c1", "value": "196608:pSAq2J4EL6zUoO8htTSuQfRx0FwqsxPyYJ9DziV0LhQwau+X/ZxgB:cvELUUoO8/0/HFJ9WYQw4X/HgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785643812, "uuid": "4fc069ab-1bee-4943-b716-4077ff20a0a8", "value": 12012672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785643812, "uuid": "914d3ecc-3051-42cb-a2b2-33f39b31d9fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785643812, "uuid": "1f2349b0-7777-4953-b890-9278e2b56069", "value": "Aura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867b1183-8e15-11f1-bd95-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1785635852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635852, "uuid": "c12ef7c7-40a7-4617-ba70-508d32d8dba1", "comment": "Malware payload (Joker)", "value": "d69b7cb1d24db0b23de76539a2265037", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635852, "uuid": "652ade76-8e2d-40a1-b8a2-aed083ca1ad7", "comment": "Malware payload (Joker)", "value": "897a5c4077216fd9bb766b6a0b8fbd1c8af9c6a7550fabc74643363bdb477ef1", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635852, "uuid": "b392fbad-bb71-4742-a4df-3ff2516388d8", "comment": "Malware payload (Joker)", "value": "e6babbaad27a7f6bdc904bb2dcc85998503c32f9", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635852, "uuid": "3bd16f74-95f6-4ac4-9d78-c73e8a276a44", "comment": "Malware payload (Joker)", "value": "30ed241e112667e2b0965a62783eba551f768363a6586c7b013fee2a04733627222ee8fab910e10676fc0ca8903f7c77", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635852, "uuid": "4d4f704a-3930-4a64-9167-131a92495ee6", "value": "T197C7020DD90CD937DDE6F0BC8E5E069370263D155691C15A3825B20CFAB3AE44BA6FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635852, "uuid": "6b6bf72a-ce11-4f38-89e2-f81e6ab445ff", "value": "786432:ELLfRBOXuLNA/Dub2IS5tTVoMwX89zXGsSxc/QQyp+1RrLda6dyQ1OyaubhD7F:ErrOXuLNAuCL7w8xyp2Lda651OYbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785635852, "uuid": "93432e07-82b0-4276-ab79-f92d80082658", "value": 54759938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785635852, "uuid": "f41cded5-b565-4c7c-b96f-04cea97151f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635852, "uuid": "8e5a91cb-14db-4ff6-98a5-523e43165561", "value": "AI+File+Cleaner_1.0.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc2d5c7-8e13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785634952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634952, "uuid": "e8cacc66-5df8-4522-bb3c-7f2e06a02b58", "comment": "Malware payload (Mirai)", "value": "02fa135a4e092d843554640629e09e42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634952, "uuid": "9e5c93eb-610b-4223-be46-5837906487e7", "comment": "Malware payload (Mirai)", "value": "8aaf628e5e59c2260fc05f3528fe0c2699f739db14a0e6264f45dca4001a8377", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634952, "uuid": "ffbcf567-f0db-4527-a886-1b21c3c6435f", "comment": "Malware payload (Mirai)", "value": "c6a63fcff6ef48282ae94704bac7480409effcd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634952, "uuid": "0a738672-4819-43c5-b63b-1f4c7e9875b6", "comment": "Malware payload (Mirai)", "value": "6e916196432a960b0fa410fbd7588edcec09f1b4a4426c25d2bb1e5b0e2aecdc879da5df8d7c7c59b2b53f693b10a524", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634952, "uuid": "758ae697-caeb-4ddb-a07c-f4602cc720ec", "value": "T152144A99FA0F6D42F1C7D2FCDE4D8BD13A1730E3D7368A656D0203EDDAA39995980902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634952, "uuid": "ec6d54cc-a1bf-4d4f-97ab-486a3c1ba3c6", "value": "3072:aM7gUMBfJfSQSf06/bzxNczlG7xhOuUKoA0zW7BymxZd6tPMxR+Rjq:S1ZE2zl47OKoA0zW7B78tPu+Rjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785634952, "uuid": "5fd885d0-a4d3-49c3-8b94-0f1957091880", "value": 202648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785634952, "uuid": "949d82fb-74e2-4a32-836a-e18024c60f12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634952, "uuid": "4dae3843-c37e-41cc-834f-4a775e3b278b", "value": "zero.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8091ae90-8ea2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785696401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785696401, "uuid": "808dd1ec-df51-437b-9959-2099f3be6209", "comment": "Malware payload (Mirai)", "value": "0f26a48d0535575bd674c3f71ab52d80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785696401, "uuid": "16f44219-cba0-44c0-8aa2-8e0176ae6778", "comment": "Malware payload (Mirai)", "value": "8b7fcb7a8ca318bbaefb05dec4c4c4910811658e8987ab0360d63548c0990103", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785696401, "uuid": "5b66b3d7-0018-4c92-8077-997f4d054db3", "comment": "Malware payload (Mirai)", "value": "162fdaaee2fe937b2860573ae7f2fe70dd681db2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785696401, "uuid": "e720b00b-3903-48f3-98e9-748688c52f25", "comment": "Malware payload (Mirai)", "value": "5544a1a5643fa8e206a5bf0aca91963696c1554e5a4c7ffb4b5dc6ce1a9ea5d863d29c4ccc6bceceec29ae14bda1b57f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785696401, "uuid": "6d0f8f3f-e986-4696-b0ae-8d150ad7fda5", "value": "T116B4DF63F6B05ED1C4020A741CFAD2340755F39213D26A51E7FEC9242C8B6767E9EBA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785696401, "uuid": "0c49aad2-e371-4dd4-9b0d-645517f68e65", "value": "12288:a1ldFi74SaKs6Z6ot38pzwe36iHmJD/GTY8pBP/C:mzF+rZT34ziiG1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785696401, "uuid": "8b780a23-5083-4ef9-9c45-e33a92d22f51", "value": 529072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785696401, "uuid": "9a54ce38-584c-445a-976b-2ca16f4c9f44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785696401, "uuid": "2e9605f8-b47e-4912-abd5-3c0cd198bd51", "value": "xd.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022bf50e-8ea5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785697478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785697478, "uuid": "f16032b9-aff2-4687-84e1-e1beb7d6a7c7", "comment": "Malware payload (Mirai)", "value": "fa3866764ac0c9f005a6ccaae129949f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785697478, "uuid": "6a37638e-84c2-4634-a762-84e949495c67", "comment": "Malware payload (Mirai)", "value": "8c19a8ace6a6cbeb8d68c82a270659fb03160f263d15cd31db6e6317a148fee7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785697478, "uuid": "cd996c28-7f28-4427-9689-fd665c2cd5e5", "comment": "Malware payload (Mirai)", "value": "c56c63ff80d54ac836458a83adbbdfcdd162126d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785697478, "uuid": "af055d0a-508d-487c-a7b0-42e70a62f537", "comment": "Malware payload (Mirai)", "value": "1d66e6fe78512f30743373b0de0e243066b56985fa9262d573558820850c5ce9d7fb237ca3ab3d7465aadf1616e885cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785697478, "uuid": "8676067c-479b-4da9-afc4-17bb3b77a4b0", "value": "T19F631981A8D1EE52C6D96A76FA1E059E332253BCD3DF3303CD144A1527CE4995A3AB0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785697478, "uuid": "11a4ada8-ad5b-4580-b0b8-21bb2fa2e4d2", "value": "1536:WwCFj8VbIZvTx5xD7/mHmv8YQi9VefxOUmtGX:XEe85x7/mHm0iXefsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785697478, "uuid": "6ed49446-f0e1-4465-b44f-eecf5e71a8cc", "value": 67056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785697478, "uuid": "8313420d-e49a-43c7-9174-3c8ece841e19", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785697478, "uuid": "2dd9dbb5-d308-48cd-b68a-89f5327d5aa7", "value": "xd.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a3bfa6-8e4b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785658836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658836, "uuid": "9c21f6fe-2d89-433d-8722-4f332f594269", "comment": "Malware payload", "value": "3faeaacc8d555544b28720fbdc38cdf6", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658836, "uuid": "2c6c6e4b-3589-4bcd-b14e-a4ff1760d5f7", "comment": "Malware payload", "value": "8d95c6056dd4d5da0276b9c8a8cbe0e0d0f34a719e1077c4ed810511ed81dc3f", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658836, "uuid": "b792656e-848e-4d0b-8820-0aba5730687c", "comment": "Malware payload", "value": "7afc9340d055d1ffea798cef09551bda3459e04a", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658836, "uuid": "a847e946-b094-4959-bc67-8ab11001fc7a", "comment": "Malware payload", "value": "1c25acf28fe202a6ea41c9da084b1e81cb2c50b0feea7063232fe6009d0fcab99d50cd31de4c27c39a070ea5aac57762", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658836, "uuid": "77d859f0-fd8d-486c-889e-653435762a6d", "value": "T14808338053A58619D1CF6FF8616F0BE7BF268CE0A63D907F47664936F4A506BC24C24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658836, "uuid": "64895bbf-6c9a-4805-aa17-9990fa5e58f3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658836, "uuid": "63b52ed3-1767-40d7-9377-5aa273ee9f12", "value": "1572864:wLdkiO7pHdKFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7B7:w2P7VoaABZVPArg/bXeB7B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658836, "uuid": "77141e10-fa92-4ff4-8a1c-4ea0fd0cf1a3", "value": 79952049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658836, "uuid": "36cee886-f2a2-416d-83eb-4c1a24a6b0fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658836, "uuid": "3bd4dd51-2099-48f1-851e-24db9870f8a0", "value": "launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e672751-8e13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785634899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634899, "uuid": "ca0aa3c3-4d5f-4409-ace3-2530a4bbe6ad", "comment": "Malware payload (Mirai)", "value": "4440f18cc9fc01560eea0c0c1adb6acf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634899, "uuid": "fb80201c-f904-4156-b614-cb984e06bd40", "comment": "Malware payload (Mirai)", "value": "8f847d78922ffdcfe6e7373d8a0227d9d74544c55472d1dcde203ba845bbd896", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634899, "uuid": "d651d904-92dd-4ef7-b35f-5309455a966b", "comment": "Malware payload (Mirai)", "value": "bb5f51e126ee96abc010b922c0bb5ea7940029fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634899, "uuid": "3b5caea9-7e7d-4479-9b83-47420c73efcc", "comment": "Malware payload (Mirai)", "value": "a6da4abc42ddd60b9b0b9bcf59826f7257e2ede63c244d84b143419ba6bc841c775aeb792915f45a31e1aec6b2100f5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634899, "uuid": "544a9e90-df6b-4e6d-9db6-1b7378fad9a2", "value": "T19C830214A7BE9D0AEB6EA3787C69500FA448AA6A1FEDE733EC4277C3D0408571334536", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634899, "uuid": "308534ff-48ae-493d-bbc9-d331c6664ffb", "value": "1536:2WNkuzbxERZqg254Y7D9gMQQWTtmuQKKOH5v4K1FdD0OJsSQrL:7kkxhfbSTTl5l13D0OJSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785634899, "uuid": "87bd10bb-8ec5-4979-a895-575bac701125", "value": 81864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785634899, "uuid": "667c713d-0c8e-4d2e-8448-5540e2e59f2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634899, "uuid": "e47f5aa0-a3ae-4b36-961b-33817cb77693", "value": "zero.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78d98c3-8e6c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785673328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785673328, "uuid": "d27e7904-599e-4f89-82a8-08309b8aec7c", "comment": "Malware payload (Formbook)", "value": "14ce9da0dffe44f88a5e1ca82b5b25b3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785673328, "uuid": "2d2cea50-10dd-4394-af4b-aa787aa23b7a", "comment": "Malware payload (Formbook)", "value": "956be196929073e58a92f45d7f2d6fb682d8d284f76616686e12cbf4e5319c56", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785673328, "uuid": "e1aaa546-4988-4648-ab95-6477643225b2", "comment": "Malware payload (Formbook)", "value": "82314eef73a346e574065435d1a0c103d0e01c4f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785673328, "uuid": "0b31e456-3f5a-4a90-babf-f125e55b2d25", "comment": "Malware payload (Formbook)", "value": "fd330a3c153e3902b574fd5c3b63b90edd4f26c29561c1379ae5e79472c1c0665d0ae534b5c143a397e151e2142276e4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785673328, "uuid": "b380fffd-34ce-466c-9b2e-dd2134cdc7cd", "value": "T1AA0510A661C2BFBC7CAC1726EDCFF50CD019D9EE824E89483059F2CD0695A4BD44A9F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785673328, "uuid": "2773209f-23da-4a0b-a922-958d72c69ef7", "value": "768:o4KfrHwZFCZwZNFCRANFARv1ofcvNNfqZKf4KFAFjVrAwRHKKFHFHRLNRojfcHvC:yF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785673328, "uuid": "6d849aac-6677-48ea-b511-520af5858bbb", "value": 841006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785673328, "uuid": "246f653c-d3a3-4da6-baa1-479518a93add", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785673328, "uuid": "bc2d09dc-0019-4f4f-9a6c-2b9b959aac8a", "value": "Factura_Electronica Banco_Sabadell_pdf_BS350698.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370a1830-8e7c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785679957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679957, "uuid": "1e43e583-df08-4ecb-a006-0570a56dd8a7", "comment": "Malware payload", "value": "565842f545172e27051d6bb88fd20f3d", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679957, "uuid": "cff5c152-b30e-46dc-9599-1d7724fb3cf3", "comment": "Malware payload", "value": "958dc001a63fca55299142f9c54dc8a15c15544ede95f54397b8e1efa871d889", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679957, "uuid": "0c6aa0c0-6de6-4a65-aa7c-5fe30b1fb6bf", "comment": "Malware payload", "value": "6e868bc5c773022d26519987aaf8b64051c57288", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679957, "uuid": "f650ff41-9409-41e8-a5fd-2a4826fbd08b", "comment": "Malware payload", "value": "ec87a881293ab1d6d1524b12965cc34e071654df90a1f89e06f8c41747e3659cd0ce03c84fccce4543841294e60bdfe6", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679957, "uuid": "63e8eab0-9bca-4415-9fc3-098b67f58de0", "value": "T193169D03BDA545F9C1A9A7398967A216BB34B80C4B3173D32E52BF752EB63D09E30744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679957, "uuid": "7218952b-8633-4d8f-81ec-49069a3ffbe7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679957, "uuid": "1e580086-4ceb-4b50-8b84-dc4cddb7ef37", "value": "98304:MztYKSvsVgDecCZ/s+KKOdDIIjUy0xnTcHCF2W:Mh/SvgRlR6IIjZ0hTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785679957, "uuid": "ab4dd10d-336d-429c-9a52-3d2a73460015", "value": 4339576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785679957, "uuid": "aed59c18-1711-47ca-a54a-4fbb7e0dbc07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679957, "uuid": "8c79ca08-e96c-4a70-acd5-17efe96c22d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb1ac45-8e11-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785634037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634037, "uuid": "f5dfe811-97a0-4c7d-8b2c-5c2e5e07954c", "comment": "Malware payload (Mirai)", "value": "f7e9661e0b26e3494d3b61dc74e68887", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634037, "uuid": "e0011c80-1378-4319-b866-319b3c57aefa", "comment": "Malware payload (Mirai)", "value": "9651658cdd06bf43195524fe79ba39488d96c971bc5c3ac822f2a6abd9f33855", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634037, "uuid": "a3f03535-ad5c-4eb4-be5c-b83902596fba", "comment": "Malware payload (Mirai)", "value": "8292bb3bf68f3c8fbe166db729717c0c8765d4de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634037, "uuid": "373dfe71-5ee1-4e8c-8cc0-f71041cfefa6", "comment": "Malware payload (Mirai)", "value": "ca0938815686b2ff62037878aac4d5a5c69434c37fa550e14dc0c32b66cb46724e606e8b5e3fa5c967edd5cf18c40878", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634037, "uuid": "ad6ab264-2951-45b0-b85e-1040599da176", "value": "T1C2E36D22CC356E9CE036ED31603C8ABA172394E4540B9EBA3967C3714057DD9F996BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634037, "uuid": "be955c7a-8e33-407e-a114-84f8dc21459d", "value": "3072:9HdzG5SM8ZpZq1YgDMkiiCaykjMWiuU5RWoyo40Y7:9p8SM8ZLq1YgDMkShkjM5P8oF40Y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785634037, "uuid": "a375557c-c6d5-4650-bf0a-df1efc3de8dd", "value": 150208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785634037, "uuid": "71de8566-2e48-4436-95cd-c1b3879edadb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634037, "uuid": "d88207c1-8de9-49f7-915f-728b6482edd0", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098d465c-8e0b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785631348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631348, "uuid": "dd2eb367-910b-455f-855a-3f3581421511", "comment": "Malware payload (Mirai)", "value": "c168971c0cc3517ff3cc94c9ebc324f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631348, "uuid": "82a6664b-d948-4dc1-baf9-d0b9caec347b", "comment": "Malware payload (Mirai)", "value": "9699025026d72bc780f108afe1749ef36fc109b91d90a9225bbd0e6e90102fcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631348, "uuid": "a6f0d5a0-93f1-4a8c-a9a8-22c8a6754794", "comment": "Malware payload (Mirai)", "value": "3ad0e98c99fb77abb96a97c4a5ac909ab6952334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631348, "uuid": "7dd004ff-c1b0-4daf-82da-d0843775a282", "comment": "Malware payload (Mirai)", "value": "17bd8f5e350e309cd61280192a29ef814445714b75ff1ed47453cd914515b9fbccb885644bbb3974267ee48e924802a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631348, "uuid": "806d218e-f752-4c41-996a-7a1e318fb858", "value": "T11FC31946F9824A22C5D713BEFA2E118E331217B8F3DE72229E205F2537C651B0EB7955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631348, "uuid": "aea39d64-36b9-479b-9637-5baddda9fe61", "value": "3072:PpHd8lUqfrzzpFZ3TOzCajrROPzfIDETq9Z:Pp9QNfrzd3TO+a3kLID19Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785631348, "uuid": "7fcdaf92-f6e5-4938-9631-12e6be5ca49e", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785631348, "uuid": "3b5553c3-bfc0-4d52-800b-ee0427fb98a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631348, "uuid": "d600b7c9-bb33-4edf-a7e1-f8e29982405e", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614fadd7-8eab-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785700214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700214, "uuid": "a57edad5-e335-40da-9d3e-878ef70894e8", "comment": "Malware payload", "value": "d643efa94609f81116f476e3186815b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700214, "uuid": "d69e9943-c336-4eb3-95c9-ac14abd377c3", "comment": "Malware payload", "value": "976286fb575cf6c6dcfd50695cb538d3d764642ea36122209d11d104d0ca5182", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700214, "uuid": "deb377a0-7864-4484-bd03-1106f27d10e7", "comment": "Malware payload", "value": "6c7fcd72d3e5a6984a2b2d2cd52fa409e6c48b08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700214, "uuid": "b1ad6e82-092d-42b6-9761-2e3ec73aae0c", "comment": "Malware payload", "value": "89b884611ceda2ed23e8a26eebe0b8995864cb0b77b8bff80b36ea19fc9a1072285718562263bf948e3d4570c6cda06d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785700214, "uuid": "f91b874a-1d4b-420a-833b-5096efca53de", "value": "T178D5012BF66154BCE96BC434438ED572EA39B4250225BA3B7BD496203F2AC718F1D712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785700214, "uuid": "25085260-7691-4ff9-b2e0-0b7bdf512b38", "value": "49152:sx+H3Pv2kvxObfy+qdlFm5NNUgn1A5JUMt6oE5/p7SEi3+/xQaSk25s3nvLO:pH/+kvAb0lUvmMy5qUVkf3xQa52+3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785700214, "uuid": "f7965c86-5582-4c64-90d4-a7152409f2ca", "value": 2953928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785700214, "uuid": "c26600c7-a613-4065-a76a-9c892c280db1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785700214, "uuid": "44aa7db7-2dce-4d67-bf02-fa274b6eaecd", "value": "systemd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f4edbb-8ec7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785712386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712386, "uuid": "69766792-e421-4fa2-a22d-78860eae398c", "comment": "Malware payload (Mirai)", "value": "038aac342016e6d0a013e336e39c909c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712386, "uuid": "558a0433-33d5-4753-b4e5-3291f7293548", "comment": "Malware payload (Mirai)", "value": "97b72577f7b3cea01e2a992a345f56a197a859700a7a781a77204990f64f1c35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712386, "uuid": "936b9e16-1a24-458c-8162-1bd18cfc2b47", "comment": "Malware payload (Mirai)", "value": "43faf054a368e95696fe7df5b72f519627f794b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712386, "uuid": "bd1275eb-c186-403d-921e-6531c0cf792c", "comment": "Malware payload (Mirai)", "value": "9cb16461c1348dcc03ef096b67d1c012433251aaad6d683b72f72b35d34b06404a810316581fe8d37967617eb57827c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712386, "uuid": "231a5ffb-ea48-49a2-ba98-99134d43152d", "value": "T143D47C6377228FA4E361D67005F387259AA521B30FE254C293BCD2147E11A6D2D6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712386, "uuid": "190dc1a8-9607-4942-ae3b-d3e08e53a657", "value": "12288:x15AD44DxuWmdndeG86N1ejG4PI/cmYTS/hB8pQu4BD2/:xg44DxuWmddel6N1wA/gTS/q4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785712386, "uuid": "881248f5-c1c0-4baf-8117-d3ef799b9582", "value": 604576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785712386, "uuid": "11261d63-6d2d-4c01-88b5-0c9a9ea1ff38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712386, "uuid": "64dd950b-48a5-428b-85a1-2d32360e5818", "value": "g.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef25144-8e4a-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1785658818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658818, "uuid": "fd9832e6-44a3-43a5-823b-ce2e84a1db94", "comment": "Malware payload (SilentNet)", "value": "6f9d0d5f118c665014ea6df12767c91c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658818, "uuid": "507cb86a-011a-4f63-afd0-2eaaacb3889c", "comment": "Malware payload (SilentNet)", "value": "98aad308c5253ec6205279bf56efeb83919dcc9584b125734cefb0cc48ad1c43", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658818, "uuid": "8ce0e5e7-af7e-41a7-ad7d-07fb09968731", "comment": "Malware payload (SilentNet)", "value": "abd0a1ebf5cd15fd94cf59a2cc92d9a345a816f4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658818, "uuid": "8f4ce58c-be57-49c1-a7bf-0a58fb148909", "comment": "Malware payload (SilentNet)", "value": "b021fc57af0c9d5839461c065aeaf783977219d0fe34ffc6d98651eb468342b66792bbc9e56de1c8d2369d2512f03170", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658818, "uuid": "3025ed16-17f1-4923-92b2-2cb2768ef70a", "value": "T1D5C40127D84CDC3CEA4F3774106F0ED3A01D62A890C9962B16B2D79B1562DCB5F2D4AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658818, "uuid": "b97f7fd3-23da-4ffe-9e66-3a9d100c9355", "value": "12288:/zEOw5Er/aofzzbe3NhCu5Jm+yfHLrT6Ndpm6unL://QZKPq73YLGSZnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658818, "uuid": "8936561c-82a2-4256-8276-5d1d64326da0", "value": 564115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658818, "uuid": "c3121db9-269d-4fa7-8cd8-f00d7c23b33d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658818, "uuid": "72ef6881-96a7-4466-8b03-73dc3a92db0d", "value": "horizon-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997a3665-8e7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785681411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681411, "uuid": "99a93c63-cbfd-4f21-801e-f660221cb96f", "comment": "Malware payload (Mirai)", "value": "d53fa689a88061e8a274c95a7494d757", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681411, "uuid": "6b901ca1-332f-47a3-bd10-a634d586baa1", "comment": "Malware payload (Mirai)", "value": "992132cce0a25055e5d6edc69fa4ef834e6b867a9eb156dfd76757fdaa528b08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681411, "uuid": "095ec976-bc4b-4b35-941a-1d2c7caddcc7", "comment": "Malware payload (Mirai)", "value": "bf60d9f7385ea861679288b4010d45cd0ab7c36a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681411, "uuid": "9d0a3baf-b41f-402f-88e7-37556155d4d6", "comment": "Malware payload (Mirai)", "value": "a417c312fe296094a31067b63dab064e62e2abadb02c9712fb7f96c9411cc1921adb6c766de4d3d12f09d07d977a430f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681411, "uuid": "014b7e93-9bf7-4706-af9e-152abd0fc6e5", "value": "T1DEF31745FC414F27C6D612BBFB5E428C3B2A17A9E3EA7103DD255F203B8A85B0D3A651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681411, "uuid": "718af2c1-7831-4102-8c03-6fc9b12454a2", "value": "3072:oe8lFShubUaW9Ew4Thsy6zWRO5EZ7Jd6hh1Pf:oe8GsYjGw49sy6yA5EZNAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785681411, "uuid": "576a04aa-c823-471f-acf4-fbf874be625c", "value": 167512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785681411, "uuid": "187dc2f2-741c-445e-b8d9-31523ad4f319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681411, "uuid": "c2444916-1ef4-44b8-89f9-0e8be7173d2a", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a37ff1-8e4a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785658584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658584, "uuid": "90b17bf5-2edc-4662-8d33-e5bf40304075", "comment": "Malware payload", "value": "958c2f22ec77871924613689f9fcc305", "object_relation": "md5", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658584, "uuid": "a1f1c423-b182-4d48-b943-60671cd9f911", "comment": "Malware payload", "value": "9ac536e4a7d70a59672c164569a89c36776f08c5bcabec27eff2c4f0aa1b9d47", "object_relation": "sha256", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658584, "uuid": "df63d2a1-8958-44cc-8751-f35d72b002a6", "comment": "Malware payload", "value": "17110e2d546a2a610c0c052e3378ce6a23fc4c3e", "object_relation": "sha1", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658584, "uuid": "c9f50dab-f213-4201-9409-766d8d4a6ac7", "comment": "Malware payload", "value": "bfea634e3b67dd45f7771134f84d469e9f237712582d4e17e2004776ceb75d2e5285351ef010c4d73cf71bcaa1fb83ce", "object_relation": "sha3-384", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658584, "uuid": "e21bd037-8c09-4412-9fe0-c694efee5012", "value": "T196856D53A245717EE5BB0E7A8826E2551C3F7AB11B0DCC4AA7F4094CCF399407B3A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658584, "uuid": "cc71447d-de9d-4df8-87a4-7baad33244e5", "value": "1f365d4e2c37b47fb208b089b5f61d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658584, "uuid": "3969bced-5d59-4b04-a5b7-6c7bd8688f04", "value": "24576:lbDyoBz/qLX2QfaWmapyBWZzgGKLWdAVQF1dAcFQU2:V/tC+cvcWZDAcaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658584, "uuid": "4165d54c-40f0-492e-8c36-6a040654175d", "value": 1809920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658584, "uuid": "14ffff4e-5a9c-4a2a-922d-413cd88ee04b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658584, "uuid": "c9d56ea0-952d-4d54-b573-8a9975800022", "value": "9ac536e4a7d70a59672c164569a89c36776f08c5bcabec27eff2c4f0aa1b9d47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06c3859-8ea2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785696562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785696562, "uuid": "79df4d77-7b5c-4151-b210-80d12b4a7e50", "comment": "Malware payload (Mirai)", "value": "f9a3568c14432836e0ec5094712c7a43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785696562, "uuid": "1b75920b-ea34-4b5e-bd0f-f3181d2e3002", "comment": "Malware payload (Mirai)", "value": "9b272fcffe76786a28735e9f4f1d17d8eefcac68ae15a8f8dea05e07ba9f8dca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785696562, "uuid": "a72cbb95-9aed-4f73-81e2-e90df779b6e5", "comment": "Malware payload (Mirai)", "value": "b3060422f53d26e41f1baaf8453d17fde7863090", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785696562, "uuid": "8be26f67-ca33-4ad6-927d-39ff7c82609f", "comment": "Malware payload (Mirai)", "value": "39ce41ca77737a4e01da4df963e1017ca9c08705220f78509f43a35ebd1d666bf13a77cb30b5d1ddd32894d4c7e0cf4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785696562, "uuid": "875f5543-188e-4184-a872-88d8bbf2d9a4", "value": "T1DC631982FCC1D902CAD4237ABA5E55DE331563D5E2DE3203AE122F51378AD5F0E6B192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785696562, "uuid": "a5bdeae4-4388-4684-99ae-8439095e583b", "value": "768:wsQ7SmH4ISy1wirLextskYOIXqsrRyJo0zj4rISb0weHpU8ovowaWCBNnqmooOR5:ZO4ISyOYLe3IXnrRCzjmqW8oqwmgRaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785696562, "uuid": "233700d6-e04b-4a53-96bc-930f489d0a1d", "value": 67516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785696562, "uuid": "bae61d79-e192-4e09-914d-e5993acdea3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785696562, "uuid": "ab4f0dbc-c3cc-4870-9b57-339f7b852c02", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1caa52-8e71-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785675327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785675327, "uuid": "8b8b0758-5f47-4af6-b2e5-792986f82005", "comment": "Malware payload", "value": "11818d22a2abc292cc13045c790cb695", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785675327, "uuid": "39f81ffe-6175-4187-a441-925c33e37d99", "comment": "Malware payload", "value": "9c0c712eb0969125e49ae2b43154bac9efa4617445de55696cb2bbad70fad02c", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785675327, "uuid": "3081b52d-16fd-4222-9abf-a34061d96382", "comment": "Malware payload", "value": "c6fef90a07eadd6a82d6fc16e84c1bfb2a397959", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785675327, "uuid": "cd601cee-a5d3-462c-85cb-695b834a468c", "comment": "Malware payload", "value": "e949a47a6d1976263215022754894e0a3aa5f1b59362d73c2cda74e638bb45ce4aedd284f4a9b9f55e58a57215b63750", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785675327, "uuid": "6dd2bdb2-c95c-470b-b15b-0a276335c06d", "value": "T170F57D13BDA948FAC1E9E736886652227B71B8088B3173D31E52BE792F727D04E35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785675327, "uuid": "b7e6fd5c-8f9c-42cd-862d-6499e4ac87f8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785675327, "uuid": "26aa8cfd-02d5-42f9-8063-b5f63e086ef9", "value": "49152:4WasX1W8FOCHpn8dnBfK49yVLFqynwm9D:4q5qrfKWYqaw6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785675327, "uuid": "e3a73e1d-c3c2-4fb0-9b6e-e349050e0dae", "value": 3628928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785675327, "uuid": "2b4004e3-e481-4a19-950a-80405fdad6d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785675327, "uuid": "49628714-7696-4b9b-8cbd-43209dfcd987", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c68617-8e14-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785635312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635312, "uuid": "72fda800-1e1b-4215-9e12-9d1d49922f9b", "comment": "Malware payload (Mirai)", "value": "7d936fab5bf40ac4d251814d723c8fa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635312, "uuid": "1f8caa83-4d00-407a-930a-963b12191a20", "comment": "Malware payload (Mirai)", "value": "9c5d705f07e17a4bf809d384c67630ec197ac11335747e068424067fde56a9d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635312, "uuid": "5067a817-af92-4505-9890-0a3a6e48c733", "comment": "Malware payload (Mirai)", "value": "d40e19637020b972b09a7fec9acc4beff2e8e364", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635312, "uuid": "5d9f037e-21fc-4cf9-b50f-48432b04a11b", "comment": "Malware payload (Mirai)", "value": "33c225bdbefe362704f43f3cb83193f61a2495b7570c91296572c0a9b5fdaad4ec499dd4da9f45af5d74ef732748a0d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635312, "uuid": "34365a6d-6e3d-4dea-b291-30a500b7e4d9", "value": "T143B36DC9F647D0F5EC5705302176FB37AE72E4BA2328DA83D3A89A327C21641D456B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635312, "uuid": "2db6ebf1-8ae5-47bc-9cc9-eb180d9f6de4", "value": "3072:7EqQwKemz+S5OCXUBta7ecz2mRsfJCmBD:4qQwKepSM5n3fJCmBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785635312, "uuid": "bbde0f58-6f8f-4c02-a86c-74a36595c8c4", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785635312, "uuid": "bfcce594-0a11-4cc0-887e-1c4b4091d71c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635312, "uuid": "ffc9c4f0-7a58-408c-9f44-7e74f7378b7d", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe7e41f-8e6b-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785672939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785672939, "uuid": "53ab8a54-3c94-4de2-b6e1-1b06ed28f1bf", "comment": "Malware payload (WannaCry)", "value": "91269eb3c084956392ddaf6a60139fd5", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785672939, "uuid": "0560dbcc-9556-48bb-b33e-d365515c983e", "comment": "Malware payload (WannaCry)", "value": "9d769ee6c8365659c7a703f221caab25f1a972bf1324dc3623d08e2eaa5b4856", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785672939, "uuid": "d7a705dc-66d3-4208-bafb-1dff5c1e979d", "comment": "Malware payload (WannaCry)", "value": "6e96fe30490bed142959566daf8be3f66bd3645c", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785672939, "uuid": "1e3ddf5a-55a3-4479-b9d9-80360164cae5", "comment": "Malware payload (WannaCry)", "value": "86baed87c919a3389e3d4d8eed4724a83abd2f92747ac74129e301a35382c78f4d1923b22137d081ef0205ff95838693", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785672939, "uuid": "88a932f7-ac30-43eb-b8f6-7a19fa0c2a90", "value": "T14C366C01D1E41A60E6F24AF62AB9DB10933ABE46995BDA5E1221410F0C73F1CDDE6F3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785672939, "uuid": "620f2042-3f67-4825-9344-c339c56edfc3", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785672939, "uuid": "90b50c40-a014-4e94-8dff-f56d93109f97", "value": "24576:jbLg+bLgurgDdmMSirYbcMNgef0QeQjG/D8kIqJASk+RdhAdmvnY:jnXnsEMSPbcBVQej/NAARdhnvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785672939, "uuid": "7899f4ca-c14e-47d4-975f-2e9134d3299f", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785672939, "uuid": "4f001502-b85a-43da-b6e2-5e550c5c550c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785672939, "uuid": "7bacf395-c780-4150-8fa7-2e7d8e209264", "value": "9d769ee6c8365659c7a703f221caab25f1a972bf1324dc3623d08e2eaa5b4856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb3d6ce-8e29-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785644318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785644318, "uuid": "53845d3c-a8ca-4b72-be18-998b3c4728cd", "comment": "Malware payload", "value": "39b4f5819162dba980e5c97a9db27b5c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785644318, "uuid": "101be2ae-dc3a-46b0-a3cc-cdc35401548e", "comment": "Malware payload", "value": "9ec139883216be1269eefe88c2abd5cd2320b6d20bc3353094bce34a1eda4a32", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785644318, "uuid": "a56c924c-33bd-4eb3-af73-7edc7aedcbf4", "comment": "Malware payload", "value": "fd70aee61f5cdd0ff5ea74c54df95716c4030af9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785644318, "uuid": "bb23654a-1dce-433b-bf33-58446433ea07", "comment": "Malware payload", "value": "9c8e717985cb4b25488ef0d981cf704122a7fcd32486adadf441ab31d14ef95c50310ab87c291414cc52118beca545fc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785644318, "uuid": "264ba870-2985-428d-ad12-d1e535695265", "value": "T19905D007BB3B9197D27B8234446B0747FA79386DAB2496DB073002961F773B4A639723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785644318, "uuid": "8033f777-4115-4587-9775-1b2ddf542d45", "value": "71c1169459da47de7c406eb8164291b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785644318, "uuid": "676ec7dc-4f1c-42fb-b07b-fe3730038794", "value": "12288:JuY/lb/ehhFZLQKDDyKMPe15GNwMwJoHEQxUgb9Ni9Ji:JuY2hhvjDGISwJc5ighN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785644318, "uuid": "30e43c34-5c64-4098-aeec-aaab2ec3cee8", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785644318, "uuid": "a6fb8182-b5ae-4635-9bda-df09870d2b5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785644318, "uuid": "b7227fa7-3f0d-41b6-8ffe-7a1075c32815", "value": "BestLoader.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6579879-8e7c-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785680144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680144, "uuid": "0739b67c-1239-4e1a-ac5d-1bc686073821", "comment": "Malware payload (WannaCry)", "value": "2aeec37ed59e17b59bcd67547bf0a453", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680144, "uuid": "29515ec6-d601-4ca8-996f-61ffc7f91024", "comment": "Malware payload (WannaCry)", "value": "a08521395145577e6227ece283b7fb0f0ee05c02ef587a7b4ea84284bc374722", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680144, "uuid": "ea663718-13b4-4e79-85bb-6c9aa1e5217c", "comment": "Malware payload (WannaCry)", "value": "a94b66b681d5adb6976dd11a6bbc6d65bb96a690", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680144, "uuid": "11e292ba-3293-4ac4-b9bc-d28fac5b06f1", "comment": "Malware payload (WannaCry)", "value": "a1b58d81b6533ba9a1ac904b3d9000ea91c78dc96f45cd7418ef1e3bb516519d94d7306bcd20075a2deb3b902f2da628", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680144, "uuid": "69fc4241-fbad-4b95-adb9-5eaed7e978f0", "value": "T1AC360246BAE8C97DC03A5174CCF787267371F8A60BA2470B6390D32D2D53764AF92AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680144, "uuid": "18042148-9fdd-4822-911f-ba374a058b32", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680144, "uuid": "fef39e37-9e7e-4541-9df3-24f3014f3b1e", "value": "49152:jn4nnMSPbcBV7/1INRx+TSqTdX1HkQo6SA1:DonPoBB1aRxcSUDk36SA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785680144, "uuid": "947281c1-8ad9-45a7-b96f-4a0602e38ddd", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785680144, "uuid": "44b99cb9-396c-4948-9730-6c7d78ceed25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680144, "uuid": "db065c10-4830-4ae7-a6f7-51593c5376e5", "value": "a08521395145577e6227ece283b7fb0f0ee05c02ef587a7b4ea84284bc374722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd140df-8e0e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785632969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632969, "uuid": "f34ad823-4c81-4fa9-9086-1f76d8c357a3", "comment": "Malware payload", "value": "b53d3736a5a8de6518193b8b712d13ed", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632969, "uuid": "1982804a-a730-4c13-8aa1-c4d3ade3e40f", "comment": "Malware payload", "value": "a10994395ee8391edb37a4472ce34744946598a30b8d656285d09fa57faf480b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632969, "uuid": "1576783f-0c2a-4d94-b71f-5cc8e07cb84f", "comment": "Malware payload", "value": "0a35464cf5c308b05b39d73a47549771f33ee786", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632969, "uuid": "d9d6c488-8d64-461b-8a3c-9c1ef78597a1", "comment": "Malware payload", "value": "aec5e1f413d88cf4419549ccb5a1af86508daecbe542001e2c04271f1c142fefee442ccd65c4b9593f2e5af59f9fca4e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632969, "uuid": "cdd5b73f-d9ab-4b84-b39a-71ef329bafcf", "value": "T18CC27D966A867C44BEC94A3E4CBD2B0D6DF5C3D1224942AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632969, "uuid": "f5326930-cba6-49c6-b578-406ed14f460b", "value": "768:AQM8vCB+25j6es8RX9FYpMSUpi+20qUpi+20YQX:3M8l25Jxd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785632969, "uuid": "c43b4784-1e71-499d-af15-7bbf08abd09e", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785632969, "uuid": "ca980978-e416-4b8f-8143-a0e560fd29a2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632969, "uuid": "ed8d46dd-75ae-4d09-ad8d-f9ccec31ebdd", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3deb14-8e4c-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785659677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659677, "uuid": "e57e4cbd-422b-4400-91f6-c34f2a161f63", "comment": "Malware payload (SalatStealer)", "value": "39888bfe023e44fdd4fa5b3ab616ebf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659677, "uuid": "6bea2d67-c655-4efe-8f02-77dd575258e6", "comment": "Malware payload (SalatStealer)", "value": "a11463bf176a39f72b5ab9c0e0401dbe0eb4be8d379b2d5fd5da21da0d2286e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659677, "uuid": "e4822a8e-7f19-4f7a-8364-64153744a7ac", "comment": "Malware payload (SalatStealer)", "value": "5d073f25656f0f942bff1178c1a52404d63b2b17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659677, "uuid": "f7e42f6b-9ee4-45de-9b2a-4671a82e5c4c", "comment": "Malware payload (SalatStealer)", "value": "11b2e9864899b7490b3c8910739f7961d14fd72e65281f723106d07ce5822a45842842c6d238fc597592d8dba9d6b801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659677, "uuid": "f5fbe9b9-daf4-4393-8226-a10dc0fa7df5", "value": "T1ECF533AEC360508FD9BD1CBC649A28D13428C8E8D3B35613CC2C25569E61FE96BFE5C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659677, "uuid": "7fc7341e-998e-4f7b-898a-06e6d2da77bd", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659677, "uuid": "c837d413-c34a-4c18-9ff1-d9687a679164", "value": "98304:4sccE/PujuuenaDR/OInFsmCRAXWLtDAR:pWujuuzDFsmCWWLtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785659677, "uuid": "e933c19f-da28-4129-a224-9f7762ce3610", "value": 3594240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785659677, "uuid": "e564b0fe-bd17-4f6a-a2f0-fdc58e28589f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659677, "uuid": "d9ac17fd-09b7-43b7-8846-c4862955ea3f", "value": "Rexil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98c8298-8e9e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785694886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694886, "uuid": "aebba44b-a0f7-4e1d-8555-32d12ad26c51", "comment": "Malware payload (Mirai)", "value": "6ee6967ec03d02d3f25be3dd9a9f672e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694886, "uuid": "0e285786-e3d4-4774-91c1-dc965a48b7ec", "comment": "Malware payload (Mirai)", "value": "a2bf687d8dee6a3a4d1531a46a3291e2f17a7a165ae40647621a72322b432e0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694886, "uuid": "93178a45-e50d-4e7c-a04f-a791941dcecc", "comment": "Malware payload (Mirai)", "value": "f2314f43f7fc53d4dde9523c70921785e1d03dd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694886, "uuid": "e25ec1a7-4aa4-4d48-ba88-ff500db74579", "comment": "Malware payload (Mirai)", "value": "f48f377c95bc3def5166c61109c2833757646f781b6f71838a08b3c5844601e67f85c6c84e12a14e1e05d8cd20e1e557", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694886, "uuid": "0d845584-6fc1-47e4-b38a-c92173100a69", "value": "T1D6858D5AF6E364BCC097C430835FD753A935F4A911227E7B26849E302E66E705B2DF22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694886, "uuid": "661c4ad5-ff99-4aca-b57c-5885f7bf3bcb", "value": "24576:tC7+cWufxGPdVHf+6YVN3JLl3UiifSJXSFi9xYv4yC28uEUyo:tJc9fxGFVFY3ZLl3UjfsXSFi9xYeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785694886, "uuid": "1169a631-0ede-4973-a10e-98b9187d7c8c", "value": 1727016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785694886, "uuid": "82603868-6b3a-496a-b6da-ea4f21d7639c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694886, "uuid": "c9f33cda-aa95-4d2b-b84f-7183ed1b8c95", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762ada81-8e76-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785677486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677486, "uuid": "50d6cf39-0385-4b71-983d-3c1284406393", "comment": "Malware payload", "value": "d1057f25411252f22c3d0ee83ecebb9c", "object_relation": "md5", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677486, "uuid": "a348a788-4eba-4e64-a631-d6ba7e6d49ac", "comment": "Malware payload", "value": "a495cb6ea1fce0b4a006562dc2e8d5db918acbf711192e10941fea612f792c20", "object_relation": "sha256", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677486, "uuid": "c5d7e681-6b2b-47c6-b39c-e49c14684c7b", "comment": "Malware payload", "value": "605beb500de5a38e520fa9686b80e91083e12337", "object_relation": "sha1", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677486, "uuid": "59550307-1a03-45fe-bb79-1705135c60af", "comment": "Malware payload", "value": "ad4876e59d351a514702943a6e0f7d24419a453bdc7d292726c7d7cc5e2dbe25e36682c49dab01d7f85eefffb1f7ea86", "object_relation": "sha3-384", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677486, "uuid": "7eeeb8b6-27f1-444b-9b22-2ca781f46c9b", "value": "T105D5239AA9F41970D467C379EFA3F46EB02A7B554B60CE5BF6CC6E108A134981037372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677486, "uuid": "ebfb10eb-5b21-4dcb-afa6-f7b6948f0636", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677486, "uuid": "6cd0fa89-d0ac-4177-9c2a-89a9aaa22ca5", "value": "49152:W4yETHLzsua/GpLAMl7Idjraw3l/ewelvlThdN8RrAxHcOn6isuyb:WjWkZ/G+Mp4jpewAv9hkrAxHcOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785677486, "uuid": "acbbabb3-d127-4891-a01f-8f8125b7e0a6", "value": 2903040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785677486, "uuid": "162b8cb9-6c4b-45c3-a345-9d0940d1bdbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677486, "uuid": "792acad8-c6d6-4829-9174-b13e1319460d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff703b8c-8e17-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785636914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636914, "uuid": "dd0e4718-6b4e-4144-a2e8-19ae577f775c", "comment": "Malware payload", "value": "8bf1b48138aecfd39dd241f7f515578a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636914, "uuid": "140c5269-dada-41fc-9885-b3b8b9262cdc", "comment": "Malware payload", "value": "a51580aade05f548b87eaf1dd98e4004330dbdcd8822a6405588944c57a8d33a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636914, "uuid": "e11f2f97-4325-46b8-b1a9-e63259dd8316", "comment": "Malware payload", "value": "418469b90afbade1081e050b10a0a23ad90f3302", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636914, "uuid": "f668585b-e665-40a0-8f3a-31399500916b", "comment": "Malware payload", "value": "c95a49c1de8692d14d95cdebb23738d357062f5d32ee652923356a2d1120dfbd1be509ea51cf01c8ee947d34b78e8efe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636914, "uuid": "25ed089e-4575-4910-8693-d7d93d62e69b", "value": "T19B016BC693649910801A995E22E651E1FC31C3C7254E4F787F9C682DABDCE14F16BF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636914, "uuid": "448a028d-d4ed-4d60-b58c-094c38fc31e8", "value": "24:kXCKysE2hi0ziQvZohaxMmF2AFuN1i0Xsj7d/tTlGN7:e9Qp+MsxvF2AIwPjhtTlM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785636914, "uuid": "809d231f-2c05-4c05-9b09-fe2477346e97", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785636914, "uuid": "5938116d-2cc8-4204-a10b-2deb448543f6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636914, "uuid": "9db4304a-14fd-46d8-a5af-1909e000fbf1", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c4b33f-8e9d-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1785694206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694206, "uuid": "761b5d92-f751-4b6d-833f-ae692d0789f6", "comment": "Malware payload (NanoCore)", "value": "2f347a1f58cc75b86e74c9ef63a1ce2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694206, "uuid": "2b267ed7-6bb5-4201-b239-fcd060efb91b", "comment": "Malware payload (NanoCore)", "value": "a5228e0087e7459608c1548b8e82328008fb37a5638b4317965520bdd37b918a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694206, "uuid": "c3b3b9e2-10a7-42bc-a0f6-4ddcbdb1e52f", "comment": "Malware payload (NanoCore)", "value": "22705afe6f5dec1945b138622e2d04318b373cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785694206, "uuid": "dabb4746-29b9-482c-8cb3-bde036d2a853", "comment": "Malware payload (NanoCore)", "value": "401f0067b525265d7aca2c2da890f60fafcdcac7b13fefcb09cc7daaa97acf2f9b795976da2dbac4dd289c2b30343d3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694206, "uuid": "b8f4c1f4-fbd0-4a5b-a5a4-89ed6f3427b4", "value": "T15E14CF167BA9492FE29E867D611202138379C2E3D8C3F3EF28D464B78B667E506071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694206, "uuid": "e7ccb346-40c0-418e-93c2-807d720106aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694206, "uuid": "8ea0a87c-7962-4508-a521-3932688fd886", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIVzC/Ma/FfqL4m1FYeRBtm23K:MLV6Bta6dtJmakIM5N/BFCh1FjM23K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785694206, "uuid": "30e0b534-909b-4654-926e-a152134372ff", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785694206, "uuid": "f08b8929-c91f-477d-b3c0-1bbf6d52ed36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785694206, "uuid": "c76d301e-e597-4164-8df1-cc59bafc8527", "value": "2F347A1F58CC75B86E74C9EF63A1CE2A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71535760-8e4a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785658580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658580, "uuid": "5b814808-16b2-4f92-bafa-c3c593c1cbad", "comment": "Malware payload", "value": "a12efcd06cce67239f2acf6620d0b394", "object_relation": "md5", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658580, "uuid": "defdd395-e758-4bba-8622-136171c0afce", "comment": "Malware payload", "value": "a824bc75d5e76a8e91a6c15501d9c68f723d4d92ea8217f906024ed217a36a42", "object_relation": "sha256", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658580, "uuid": "89238f67-84e2-425f-a1da-056cd9f87f88", "comment": "Malware payload", "value": "ab2b3da62a8cbd6fed2abb78b05ce01bd4a96728", "object_relation": "sha1", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658580, "uuid": "48570649-df88-4f9e-ae6b-f28a45913df8", "comment": "Malware payload", "value": "688346060c5c95789dd7f6c30c2a15d5157a94e935428faed98535cac58fdeb86ba7a694c0f500f580b99acdaedd8e49", "object_relation": "sha3-384", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658580, "uuid": "bb3b7807-eb10-4363-8827-761d4555643f", "value": "T1E9267D03B398A17EE06B1A36586FD310583F7670691B8E4B57F41B5C8E3E3806D2A677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658580, "uuid": "f167fd97-6e70-4763-bec6-006810691efd", "value": "278c5b3315d1bc544295d3240b704222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658580, "uuid": "57ab6469-878d-4208-8c58-f6940680b3b9", "value": "49152:hZ7+pBkeXEUOdMpd6q58STh78uWJxLKYpqi25FbigSR2/BfHAh8MnivLVA0:hZip50UcMpd6ub5FbigSR2/BO8MA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658580, "uuid": "efd80dd7-9fc0-4ae6-83d1-c930c0f09ce0", "value": 4793856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658580, "uuid": "ebc3f8fb-4485-45a6-a3d9-d451851a2ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658580, "uuid": "1c28d7f5-1050-4754-85b3-9dd3b11dca4e", "value": "a824bc75d5e76a8e91a6c15501d9c68f723d4d92ea8217f906024ed217a36a42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af7a6f5-8e18-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785637068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785637068, "uuid": "06452084-d11d-44e1-bfe5-c0dfcf954721", "comment": "Malware payload (Mirai)", "value": "69967cb243a863a0c8071189186dc969", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785637068, "uuid": "5fac022e-def1-415b-99ab-aed0cc9cdbb6", "comment": "Malware payload (Mirai)", "value": "ab901b2408ef39103a2b44eccb0dd49a6fe3ba895a2f00e0fb0cc9e71890739c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785637068, "uuid": "a50b5d56-9b9a-48eb-9a24-dcff06905d22", "comment": "Malware payload (Mirai)", "value": "c8cfb8796fc0dbf34c3a151ad1961aeeab458fc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785637068, "uuid": "ec369e78-a336-4e04-a274-c1fa4ace8df2", "comment": "Malware payload (Mirai)", "value": "ad476d511c624b562b41639574f617d64eaf645623987080700d6d24e0d01b96e5096bc530553bbed3634945d339c3a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785637068, "uuid": "6d300654-f31c-4179-975b-2bcc9a8a36d5", "value": "T12723F1B1C97FEFB0D439B8F18C486B8478ED655F5713875D249422A81EBBE205C12EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785637068, "uuid": "ae5a6799-ff20-46b1-9ad5-501c395c3a84", "value": "768:3DbdXXjWo86KJKMIw1tV+qWts83xxLFUGlkQNzEi/dyq49ld8N0sLFx05u:3DbdUbR5VAtt3349ldm5Au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785637068, "uuid": "69d76c1c-3820-4a21-a49d-6846d228b3ae", "value": 47612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785637068, "uuid": "717e1891-c28a-4741-bd94-3da80c4cad4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785637068, "uuid": "dccd77dd-94ff-48c9-9a1f-6930b1d4b1f0", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce206a5-8e13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785634843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634843, "uuid": "3b1d0307-687d-4c80-8b39-2505ba1babb1", "comment": "Malware payload (Mirai)", "value": "d2108a89ab1e70982dbbfa89cff3de81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634843, "uuid": "f5b235d1-0877-429d-a2f3-79d07264aa07", "comment": "Malware payload (Mirai)", "value": "ac795868b63b04ccd18e4070a5e021870ab81c2eb307f8bb04543220f6b0c371", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634843, "uuid": "566af841-045d-423b-9403-9d9d32376522", "comment": "Malware payload (Mirai)", "value": "99100e243802d2265bd54074fb2d8699d122d25f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634843, "uuid": "c5fe2cbb-feb6-4459-a9ac-254d3f8a8516", "comment": "Malware payload (Mirai)", "value": "50d72fb28a9747cf7f700308293252b44883b5fd6089c3adf6695aeb7618b5f55d90e8433e6be0fbb58e28ace29ec00e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634843, "uuid": "f189fe7e-1ced-44a3-8a72-00636ba8393d", "value": "T1A4F31B86BC814B01D1C215B6FE1D124E37135B78E3E972139E186B3D7B8ACBB0A3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634843, "uuid": "78ba7efe-cb97-44b8-bb24-114dd7ff6420", "value": "3072:RpjfE0nZ+B0+d2UVonPxBX9yFTaSMBWag1uKRpwAnmv3i:AU7+opBX0FTabBW9wAnmv3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785634843, "uuid": "e8ba942c-df52-4053-8037-db010a692494", "value": 172828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785634843, "uuid": "e19d0dd8-59a9-42ad-8547-f2c94fc59715", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634843, "uuid": "1a8b7969-1326-4cba-ba35-9ed8bc06a472", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32513fc-8e73-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785676407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676407, "uuid": "8f96f94c-d9da-49b8-8afc-b85667a907a5", "comment": "Malware payload", "value": "ccca5d59d9384b94b91632283e9fdad0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676407, "uuid": "508883cd-b22c-497d-8227-92a0fbfed6a1", "comment": "Malware payload", "value": "aeccec1db608341f32794d878b5fdb05d9f1194aec5a92142c60076dbf8c214a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676407, "uuid": "b1451a16-6da5-47c8-ad98-1603af2ba002", "comment": "Malware payload", "value": "69ef0a73bb58edd697053d257f732dd71caf91eb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785676407, "uuid": "263eb1bf-47e0-4d5b-831b-58ca69965623", "comment": "Malware payload", "value": "a4eaceb085504cfef1ee1456ac3850c940e6b80cd4e2c30d20f41cd243e3b633bc1e22b983f4fa70f0c71724d0540566", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785676407, "uuid": "45bfa0c6-1132-4cb6-93b1-577209929a30", "value": "T1B1C27D956A867C44BEC94A3E4CBD2B1D6DF5C3D1224D42AC3D8B3C719C12FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785676407, "uuid": "d0641f49-71be-45c3-8d06-dfc241d9e3a5", "value": "768:i8vCB+25j6es8RV9FYpMSUpi+20qUpi+20YQX:i8l25Jzd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785676407, "uuid": "efe09fd3-3992-4026-b6a9-15782d10766d", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785676407, "uuid": "b96c776b-45e2-4723-be63-66bf99523d16", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785676407, "uuid": "fe13e9c6-8c67-4f69-bdcb-22793ded8da5", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7962dd67-8e2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785646138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646138, "uuid": "5db341c2-8d30-45a5-af2b-67a521b27df0", "comment": "Malware payload (CoinMiner)", "value": "a1af1a6133606bf3f13177df0680ba46", "object_relation": "md5", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646138, "uuid": "53bccb72-ac93-448b-97fb-68d48c30c5ab", "comment": "Malware payload (CoinMiner)", "value": "aef01ab9e284b663cdd5caf288eff4120406ae452f5fb73e4b135c542aa59919", "object_relation": "sha256", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646138, "uuid": "54b22b58-41b6-453f-8c75-c0eb5044fdfe", "comment": "Malware payload (CoinMiner)", "value": "d5153d09a297bbacb98b50368b353f012adcbb7d", "object_relation": "sha1", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646138, "uuid": "a6d5da31-4e9f-4db4-a30e-467b72e40398", "comment": "Malware payload (CoinMiner)", "value": "356ad5348428a8ce1f41f3aff0c1c1683245760e08c6a2c219a3af3e0b2b19450979b1b07d98605f5e09babf8caba5be", "object_relation": "sha3-384", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646138, "uuid": "9ba141dc-527f-4a19-85a9-b670f358f66d", "value": "T1DB3633CBA4D665F9C412CBA0CB1330ADB1BA3BA54B607C023FDC56185D66D6914BEFE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646138, "uuid": "e06b2012-654e-476c-8096-b39037692260", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646138, "uuid": "c801acba-06c6-4881-92bc-8915d7b4b00f", "value": "98304:kB69H2ugWrS+l2PU+ijjVqikd2VOMyII9CY5sVYdLGpIqpf51uIqDzqDaMe2hVBA:7cugj+oPU5vVDkgVwz9CY5sI4Iqpf51U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785646138, "uuid": "bd7a758d-db6c-4ed3-8871-a7d35312646b", "value": 5218304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785646138, "uuid": "48e412d6-1d23-4e34-be17-a4265f125ae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646138, "uuid": "a2e97d12-7f8f-4611-9756-c4aab4ac53cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f638718-8e54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Neshta)", "timestamp": 1785662738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662738, "uuid": "6aa050de-e6f3-468e-93ed-d78a2970c3ef", "comment": "Malware payload (Neshta)", "value": "f75568d900a96c55b60e19d0e7670dcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662738, "uuid": "84fba1ce-4a7e-42ad-b866-20548e7bbc9e", "comment": "Malware payload (Neshta)", "value": "b0171c900fcc422ebb4bae4807728717a9f7fd9dce2f6c3735a83196905a2105", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662738, "uuid": "de302e9f-99fe-49dd-83e6-8a66b3584445", "comment": "Malware payload (Neshta)", "value": "ccc88d2b303448a4d0cac621ab30eb84835de808", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662738, "uuid": "f1bd738c-9127-466b-9916-729c750218a0", "comment": "Malware payload (Neshta)", "value": "7faad192681a102bcb237629295a2450ff5ac56639939e8e3c96487616af0dabe14d2e615ecc6073aefd7cbe6f9d894f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662738, "uuid": "670ae931-bd5a-4d5c-a274-a0015a86bc20", "value": "T11B647C56B3E00CF9E877927DCD56860AEA7278160721DBDF03A0466A6F273D08E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662738, "uuid": "28408065-bb30-4609-8ba6-ba10de27b5e9", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662738, "uuid": "f07d095f-0637-4228-8fd2-a890888f604d", "value": "3072:sr85CLEk98MzR6XbbA+7op6Dxzo/iAFGQhKTeMiKZvOrXPjM0y0rt4pOurYPapu/:k9LV8MgbbA+7jdPwGQgm4NlF+G29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785662738, "uuid": "6aa046a2-187d-432b-9691-1eba7426fa89", "value": 332176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785662738, "uuid": "f94aa44c-e4fd-4790-a79a-4ac1b01ea7a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662738, "uuid": "eddccf0e-360b-4321-a3d2-7e896d92cf62", "value": "b0171c900fcc422ebb4bae4807728717a9f7fd9dce2f6c3735a83196905a2105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97cf5c6-8ec7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785712388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712388, "uuid": "be46b2ba-ece3-43e8-aea5-35bb600cd92b", "comment": "Malware payload (Mirai)", "value": "6b59805a7a15900d4ef15916841a3417", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712388, "uuid": "23259abf-4f23-40ae-8e66-133e60895243", "comment": "Malware payload (Mirai)", "value": "b17643a10894128e150cec8f619be1c1960bc99eb789eeb4b5f6fa370265e2c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712388, "uuid": "c5d5b953-b891-4807-85db-4bc12cc5bfbc", "comment": "Malware payload (Mirai)", "value": "d25eb3e68b9f205116656c408a70418dcb2ec9e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712388, "uuid": "793e928f-8fcb-4c67-acf3-39e784401476", "comment": "Malware payload (Mirai)", "value": "3155129cdf0e109100692b590679e237239e3828631a037d1946c3c1a34221987f3be3b28dcfcb5610af1c533a101a2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712388, "uuid": "dcc8a89a-9e67-4c99-b67c-8cef17961e26", "value": "T159E46C6277228FA4F360D17105F38B659AA921630EF250C2937CC610BB51A7D6C6FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712388, "uuid": "3270dfe3-fc13-4758-a38f-89bc90e8a547", "value": "12288:U70Sy2742fuAM9Co3Y3yOseJQO+QhUG1tw8NGV8pG5kBSXi:Y742fuA213Y31seJQO+IUGI8Nqkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785712388, "uuid": "a67b8b79-4fd8-408b-86d7-b86dc1391172", "value": 660784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785712388, "uuid": "7b67b3c7-2ad0-4ac9-8030-aad11eaf83cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712388, "uuid": "aad63db4-abfe-47a5-9dde-c611c9292a59", "value": "xd.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30eaeb6a-8e0b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785631414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631414, "uuid": "4f5a88ba-8c6a-4a59-a9c8-d1c8f9b0a93c", "comment": "Malware payload (Mirai)", "value": "375254c03f390301e5b641111c1f0c40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631414, "uuid": "29f44aa1-9b05-4eb5-aa5c-c15e96df936d", "comment": "Malware payload (Mirai)", "value": "b4eb673cc44d251ecc21afc9e19240ad69ef9f99ea5a319ef57ea261ee15b452", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631414, "uuid": "bccdb27a-3c0d-4f45-970c-3ba863ab6440", "comment": "Malware payload (Mirai)", "value": "7143b9573c4f36f16f1f301c9afbfdc59956d0cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631414, "uuid": "27c17999-a967-4055-b430-950e204548f5", "comment": "Malware payload (Mirai)", "value": "058e91d6fac50ffb3378abe916c5da5f193da19b2a8307307540e9a1227b2cf18e2b3a4b62a7f9ae41876d2a34eb9d83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631414, "uuid": "177ff283-fb09-4494-9a68-10238d7735cd", "value": "T1D3E3F709BF610FF7E89FCC3709E91B0528CD556732A93B36B534D918B64B24B26E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631414, "uuid": "ad5b728a-35f7-4011-ad99-bd310237d99b", "value": "3072:zwV6WWosd4Bi3u7KGzJtcMaeeGeVlJSnKW2oyJi6ts1uYKu:zwIWWosd4Bi3u7KGzJtcMae10lJiKDbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785631414, "uuid": "3a572626-f1f6-4ad0-8512-63b8d4c7bc92", "value": 148792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785631414, "uuid": "ea943352-470a-4919-a7f3-864ad44a9f1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631414, "uuid": "31b2063d-8b7d-4f08-bbae-fb544e02273c", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4474e4f-8e79-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785678986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678986, "uuid": "1da5ab42-d1b3-47e7-8c10-a3a4374eebdc", "comment": "Malware payload (Mirai)", "value": "b67caef1324bf7b71264aa81ffb04c59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678986, "uuid": "41b33159-ae00-42aa-8172-5647a1529543", "comment": "Malware payload (Mirai)", "value": "b5e47503a197416bc1db54daf095acd81c70d5b73f7d0123aac6e212c7738c38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678986, "uuid": "9754beef-0730-4145-bd7e-ed2e314f92b0", "comment": "Malware payload (Mirai)", "value": "72a5d091475ee8bce7a39599b8f14073e86ede98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678986, "uuid": "f2571d70-a26e-4724-a68b-439bd16a1038", "comment": "Malware payload (Mirai)", "value": "bf76181b8c99e42bff35613cc9bc427c942ad05c22d1945d8a0d9b363306283d30c7540adaf3a0cf92590c077bedad8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678986, "uuid": "277286ff-edae-495e-8e96-12ccdda4ae2e", "value": "T1A8F2F0FCE1016993EFFAA8747CC9EA22B7B6021A35CC1CD290915F045766592EF0DDC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678986, "uuid": "069ffea7-c995-43e2-9c28-cb522ff6a157", "value": "768:yiO0JN+/422revGMYc3uJAF9uqICBET+44uVcqgw09s:yiO0cD2SvTTdCD4u+qgw09s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785678986, "uuid": "fb3f6d21-a376-4fde-9c90-b8fa1fb83b11", "value": 34556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785678986, "uuid": "ce55a1f4-fc5b-412d-a770-e8461d0260e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678986, "uuid": "d987dc5b-f54a-4534-ac2c-1b1268ffbbd9", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9997cc-8e55-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785663486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663486, "uuid": "21a02479-3f04-4292-84a1-f1ebf95aac1b", "comment": "Malware payload", "value": "1db08732a7f63ba3487b10f7c13ebaaf", "object_relation": "md5", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663486, "uuid": "4352a739-4a91-4739-8c27-5f8bf7b2acfa", "comment": "Malware payload", "value": "b804b9dd2726e69fb4f496a6872f90edf9146ad8044c6d3a592040ce1074a5d0", "object_relation": "sha256", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663486, "uuid": "b57df3df-9e34-4dc9-8ce5-1fab3f988e87", "comment": "Malware payload", "value": "3e9720f33a958795f9744517cde035c27f8d3764", "object_relation": "sha1", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663486, "uuid": "8f46f613-1847-4116-b437-8fe3df056ccc", "comment": "Malware payload", "value": "16731dec7526e23802dcf1ad98797b1767e0e231ec4f0df690049d92a93531f54a414ff7e42cca647edb1e593c34e28d", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663486, "uuid": "c7c21528-f22f-4f57-966c-f94b511bfb21", "value": "T1D4C24C1AA7660099F17752B4C9E30F16E3B5B863173362CF43D0621E1F6ABE0497DE61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663486, "uuid": "8b5b3c3b-eb70-40f4-bcbd-aa9eeb2031d4", "value": "880aaaee0047cc91a4aa99fd021d80ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663486, "uuid": "1e59aa93-020a-41b4-b055-7013acabe86a", "value": "384:lhTBAU4c0XhgvSVF+vM/rsjxcFDjxQBm1IPR+PL2KAE0sGwKP6g98SV9uC:yU4cBvSVngjuFnS41IPRqLd0sGL8SVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785663486, "uuid": "913cc95e-5367-44d5-8de1-202063b8295a", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785663486, "uuid": "3c7cef15-544a-40ad-add1-59ed6dd07e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663486, "uuid": "b06ce9d2-5c20-41c6-8676-8a89ac7c405e", "value": "Xceed.Wpf.DataGrid.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb0ce9b-8e80-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785681737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681737, "uuid": "d83a6f2e-dd60-4292-ae6d-510673858768", "comment": "Malware payload (ConnectWise)", "value": "9562334dd9a47ec1239a8667ddc1f01c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681737, "uuid": "73d02230-4052-4179-aa7f-0e0aa8e5c8dd", "comment": "Malware payload (ConnectWise)", "value": "b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681737, "uuid": "352d2ea5-f2e6-4635-9bdd-9bec04d8cd91", "comment": "Malware payload (ConnectWise)", "value": "b46c4e4694783311e2c612ed7f0ca67a88e1e352", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681737, "uuid": "f5b6545e-bf14-4d99-95ad-946821de7559", "comment": "Malware payload (ConnectWise)", "value": "2696589b876589db3789fa13e22a543474dae906dfc72d0a0ae0f37d9d12331d7572be5a9ecfc51681daf5610ae115a1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681737, "uuid": "d601eba2-c837-4e5c-8b36-66d7b1a831d2", "value": "T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681737, "uuid": "07b8c6f5-52b3-4dfc-b800-5f191a462521", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681737, "uuid": "2fa6cc36-49f8-426b-9be2-4ef126daf4bd", "value": "6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785681737, "uuid": "9089b8bf-c541-4d93-a59d-8cc86afb98b5", "value": 608024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785681737, "uuid": "245db3ac-a6d3-4597-89b9-23fcb498f59d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681737, "uuid": "eddbdee4-906a-49d9-bd07-d7dff18518e7", "value": "SecuriteInfo.com.PUA.ScreenConnect.8652.20654", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad91f6d9-8e3a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785651809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785651809, "uuid": "3b6226fc-905e-43cf-b34e-741c234b4584", "comment": "Malware payload (Mirai)", "value": "46c596d7f780f87054d3a4d5e3db57d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785651809, "uuid": "90cdf891-8786-44f8-8069-b55a3749b20c", "comment": "Malware payload (Mirai)", "value": "b9a96066856f30c4d0e54547d8420957d79e493e32ea5792504dc065da8801d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785651809, "uuid": "e0089fa7-2980-45fd-86ae-8bc017d1373b", "comment": "Malware payload (Mirai)", "value": "eb35b3606116a8d5f726f5bf8fd718c0fef5901d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785651809, "uuid": "8a4ad22d-2699-4930-ac0f-7e2607da2bb8", "comment": "Malware payload (Mirai)", "value": "a656a09c379b047f4a9765f4e39e081bd07a71cfdd611513e9691e1783a6bd6d65490f05656a578fc314eac668f6f619", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785651809, "uuid": "87ab756f-797b-4f21-b9fe-8858b3a4a8f3", "value": "T15A41F0CA5F718EF9F45AD53847270B3927AA554843C04289E19CDA005EC130D849E7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785651809, "uuid": "ba9c2eb4-9d81-42cf-a3b6-edbe553d6b37", "value": "24:3+jMdb5jl8AmslI3t8AmypR/z2H6llPJ2qtWB4u3GMI8paeudz3N9l5zBkEp7iP+:Oji5E4GYg2HyK1eHeu/9LuEpEon3weBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785651809, "uuid": "6d7c8c7d-d287-4c59-bf17-e0b7850e15af", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785651809, "uuid": "a9e7f69c-7932-4555-b105-4de380d29c55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785651809, "uuid": "6b8410e0-0ac1-4b6d-b639-be1f1aa77f9e", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb75bbf0-8e50-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785661281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785661281, "uuid": "4d6130af-e844-48c2-b8b8-1de807e62d80", "comment": "Malware payload", "value": "de03ab134d1cb176f26dfb57e21a4fe9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785661281, "uuid": "4180e822-936b-4186-b972-5bd6d1b10c54", "comment": "Malware payload", "value": "bb2f88cabeff761d3bb4e720de6b494b14bddcdaeeb11258e628652ccbff4037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785661281, "uuid": "14d40978-f338-419e-bda5-4ac2b5ef0544", "comment": "Malware payload", "value": "d0f3d95c63dbfcba888253f76f3a393030c151aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785661281, "uuid": "4bb8ca01-daee-4955-a7f7-2eef81446e19", "comment": "Malware payload", "value": "707d25412e95c18fbab24efa4fe6a914b45751411dc503de956a12d7009fba544ce7f7c05965ee7411cdaa7efe5ec09e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785661281, "uuid": "d55e4b7d-69cd-4e6f-b54b-41a69874a1c5", "value": "T17BE34B07A2A851BEE1B7C679CD924D41FB7378198B71A7CF07504AB60E63BD09E39302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785661281, "uuid": "ebfc5e96-bb84-4fa4-852a-8445b3faa4fb", "value": "bb3ac2c21e02c68abcad237dc3fa6d00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785661281, "uuid": "47f5b477-92e9-497f-8eed-98a06e1ad614", "value": "3072:5qeXA/4yIbHkNPN+6H6xCYOigUE265FJ2x:5vdHkNFdaxmMElJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785661281, "uuid": "2f3a84f2-692a-4b81-be80-22579795928c", "value": 152064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785661281, "uuid": "c38c0206-0ac0-487b-be5c-828010dd25e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785661281, "uuid": "f773631e-3ba0-449b-89f1-a7d3a7676b51", "value": "csrss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7119fde-8e79-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785678937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678937, "uuid": "978e7528-687a-43dd-b501-a1773df4959c", "comment": "Malware payload (Vidar)", "value": "56f6078765d8c5a08c68a83d0dcf5828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678937, "uuid": "2f9e300e-b4ff-47c8-bd3a-953c497cd1d8", "comment": "Malware payload (Vidar)", "value": "bb556307656b96aaaa46a3a52ec042b3f2d0711975fc808ec1b39309e87dd587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678937, "uuid": "e3d90c15-03af-4b41-a893-1a17122c5fb4", "comment": "Malware payload (Vidar)", "value": "be2e09f95df00061172df6925b350a11a9d47a69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785678937, "uuid": "df3e7290-a2a7-439a-ae6a-7c36e4de4fa7", "comment": "Malware payload (Vidar)", "value": "345cc56ea76dc8e2059edee71406a3a1fa444d27c0150c7c132e9274ece8d83555e59cdf2a0160410dc9d57aa54b5561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678937, "uuid": "f3b5a8c1-c6f1-45ba-86e1-857e19d56473", "value": "T142268C13B9A408F9D0E9D73A85766122B670B84D4B3173EB2D60BEB92F363D05E71790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678937, "uuid": "290989e8-ace5-42eb-bd25-5d9f6290fbc3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678937, "uuid": "d3c63717-20ca-4322-95fa-77a9cd937a69", "value": "49152:m05/uhori9f+xPrvRfrh0ydDMUcVHR2/+v8MiCjuJgrV0HAyk1dWm6Y:mGr4yQHRq+v8tCSJ0V0HAyk1YRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785678937, "uuid": "4331771b-d7a1-417c-836e-5f2d4447df4d", "value": 4508512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785678937, "uuid": "81af612a-5b37-4e83-b798-683a7343147f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785678937, "uuid": "f02fd273-9606-4607-911c-aadcd47c42da", "value": "Download_Movie_Maker_2.6_For_Windows_7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d629ed40-8ead-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785701269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785701269, "uuid": "e04404af-1a1a-4cff-ad3b-518832a2651a", "comment": "Malware payload (RemusStealer)", "value": "3a4457475ca594ab4a17b8158d7d63c7", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785701269, "uuid": "6f1fe592-b783-4f7d-8858-c5dc62e2e3a8", "comment": "Malware payload (RemusStealer)", "value": "bb71186aa5e8ce286c5e8698adf22aac802615856dbab846a88e740cb5ce4316", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785701269, "uuid": "0c3e9306-24a3-4024-ba6b-6ff3fbc3c834", "comment": "Malware payload (RemusStealer)", "value": "85df2e4cafb6310b7430f9b69ba1d40f8b255562", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785701269, "uuid": "ef92b833-f0bc-4e7e-b1cb-142b658331f7", "comment": "Malware payload (RemusStealer)", "value": "2d4432e38bad42f4ea4b7450ce0cd0a09ccaad60f468ac27a664cdf24fa56596bcf830f7cecbe1f0b6ae5b602f0b7704", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785701269, "uuid": "c692c634-622d-4b3a-b5b3-5deefb2bd365", "value": "T1F106334703457C8AD8746BB1AC28CD2DE7C495634BBC46E5384FDD8A8BA2329C3DC764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785701269, "uuid": "cfeb5665-f372-44ac-b4a0-3660cdbfd7d3", "value": "d9c0bfb4053066384ee7484b4c2917f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785701269, "uuid": "ead6fb8a-1318-46f4-9348-687fafbc7625", "value": "49152:pitrizwS/XN5k2W6LPjElRxSJUO8/gvAiMCtq45NQHkwndRKwtQyKgY4NP0W:pWrc7fc29LjSTg7uiNQldRzI4NP0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785701269, "uuid": "80fb70f6-a3da-40d1-89cc-8fbb406329b7", "value": 3806176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785701269, "uuid": "f08ed1e5-79a4-4b05-b0e1-f74654ac20fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785701269, "uuid": "67359e2b-9185-43f7-ab5c-5379073d1a9f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd73f7a7-8e4b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785659245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659245, "uuid": "e18f3379-9339-42e3-bb00-ed2a9994e5cb", "comment": "Malware payload", "value": "02ed9a3f0edd21788e2d8b6a339a2208", "object_relation": "md5", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "catalogbrief", "colour": "#9C7DF1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659245, "uuid": "ab77bf9f-1e05-4e22-bb06-5ed008b0e360", "comment": "Malware payload", "value": "bbec09c0e50f7d10359680587837c83f658a73e6fe22a79a12a44ac8f7f83a2b", "object_relation": "sha256", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "catalogbrief", "colour": "#9C7DF1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659245, "uuid": "315e0c60-7df2-4868-91bb-b0ca88b137f0", "comment": "Malware payload", "value": "386b8f5b615eca0ca0fdde51f5af130f3603c63c", "object_relation": "sha1", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "catalogbrief", "colour": "#9C7DF1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659245, "uuid": "2a499aad-b4ae-4a7b-b30d-d9bc0a981ff1", "comment": "Malware payload", "value": "330ee1c7e42b3b9813062c2d222f147c1b0a2068e41eb5ae199c89f8117e19b6da0feda722b52d45c9a102fc49e92a49", "object_relation": "sha3-384", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "catalogbrief", "colour": "#9C7DF1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659245, "uuid": "9190a203-c4df-49af-99e6-690c68fe709e", "value": "T1A5D533A70C64EE2B7CE2CB056C53D025AECE933542F5671A794D8E1D295CFA8C8DBC42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659245, "uuid": "c38a9900-743d-4da1-8543-c58d6ab1b778", "value": "49152:Zf3rJ5V+iGOPsqYlpMfp1LUqccPyfB99KLrGMB65h2xE9crZvc23LYQFJipzfaJ1:Z3r3q08p8nLUqccqfB996lFEuFvT3cQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785659245, "uuid": "0b03b8bd-839d-4c08-8778-c2046d84a5f7", "value": 2955014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785659245, "uuid": "abc14645-711d-4fe6-b9f7-4b3f94963792", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659245, "uuid": "a4208b7e-4bad-4b9a-98a8-bae0f034ec12", "value": "77844c3dabd0a9a1d9202da44a716df8d47d55fe86215f39c1eb00cfcc78f0a0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc54805e-8e6c-11f1-bd95-42010a9c0009", "comment": "Malware payload (AnimateClipper)", "timestamp": 1785673336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785673336, "uuid": "1eb9e464-b4cc-4928-afa9-5e34ec69d26d", "comment": "Malware payload (AnimateClipper)", "value": "bf50325f1dbd215e1c734c00b251789d", "object_relation": "md5", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "e3aaa940c8c30f0571cc42a6e9260f60", "colour": "#66AD55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785673336, "uuid": "9661dc59-71e5-4836-9356-d7699c207edb", "comment": "Malware payload (AnimateClipper)", "value": "bc9165c426258d33799107d41a1e692504d7e69e02762475ab3b8cbcd19d5d40", "object_relation": "sha256", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "e3aaa940c8c30f0571cc42a6e9260f60", "colour": "#66AD55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785673336, "uuid": "a8ebb143-5017-4749-a576-acd2132e3e9b", "comment": "Malware payload (AnimateClipper)", "value": "4b988defc8a7a8d8b86ef2d79ff1cdd6b31b7d34", "object_relation": "sha1", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "e3aaa940c8c30f0571cc42a6e9260f60", "colour": "#66AD55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785673336, "uuid": "cf3551ce-1c93-47fd-9fdc-dc7cea40e865", "comment": "Malware payload (AnimateClipper)", "value": "017cf83516c36216eb043554fa1079c152b845b9b05bb90e156d11440db6b2f5561d54438a72d66c349875df08660acc", "object_relation": "sha3-384", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "e3aaa940c8c30f0571cc42a6e9260f60", "colour": "#66AD55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785673336, "uuid": "54cb337a-2182-46ef-bbdb-a2bf7e39b24d", "value": "T18135BF15A3E401B8E92BC278CB9A4233E7B274551774AACF0759EA553F33AD06F3A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785673336, "uuid": "1820baa9-ea0a-4436-8637-5d6369853621", "value": "8c0ed5311e0eeba51b4c1a13e4263081", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785673336, "uuid": "93c05c3f-6074-45da-a30e-0f6cc4fd058a", "value": "24576:lC0Pf7dNvVC2cuWnd/ewT96mCTucMVvu8QmCgFqk:lvPfanHT95wpm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785673336, "uuid": "c8cac52d-2e3a-4a2a-aca8-ac0e7ab3c26f", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785673336, "uuid": "608329db-4fb0-4e4c-943c-7d3815b32858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785673336, "uuid": "e2ccca22-2e1f-474a-ae15-7d9091cdca54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dadb8c8-8e4c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785659352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659352, "uuid": "383fcae4-edd0-49c2-89ca-5bca4c502777", "comment": "Malware payload (Mirai)", "value": "7de3a227eb3ad974429898960349133d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659352, "uuid": "c9e02d73-4bb9-48e5-8fe8-8f360bd66e6a", "comment": "Malware payload (Mirai)", "value": "bd570ac073065d3b7348817717b5603b3b62118fb419a3c1f279745ce7d6b15d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659352, "uuid": "84480dad-b386-4cd1-a838-ff59258cbbcb", "comment": "Malware payload (Mirai)", "value": "f0a97417e576d33ea316484fd2dbdf7ab6c4e2ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659352, "uuid": "936bd5aa-9476-46c1-b8e2-12ff7de0dd4e", "comment": "Malware payload (Mirai)", "value": "e28afc4ed761c24014c3ff6a6fe56f540fbdb490231c6a34afcbd444655980885e108036de6a983bbb1f41debf35d199", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659352, "uuid": "27f07870-62d5-47c2-b34b-3b58bb2d1757", "value": "T1AB03E16FF9C47897CA2B4DB5860907754D00726212CFCF4BA6531C8CBBA948AACCD8A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659352, "uuid": "e68df5e0-e740-45f2-b257-79763625d154", "value": "768:5Joq+Ugdom7Wdfl2hj/gVsgoFqrrDhd9mvINebKD1Wl7:0dHom7cqo+TForDhdEI+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785659352, "uuid": "40b9fa4e-1e8a-4a19-b2cb-77860555db0e", "value": 38316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785659352, "uuid": "ae2b4b5e-6a83-4ad5-acfc-e380eed951e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659352, "uuid": "a7db9551-baa8-479b-8898-509a18d15489", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57b4a38-8e55-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785663499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663499, "uuid": "a2126acc-c353-4bc0-b79c-6be1be285822", "comment": "Malware payload", "value": "eba2bbd380b6949a249aba5c3ed13245", "object_relation": "md5", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663499, "uuid": "b513a13f-1314-45d7-8661-b52832a5a5d3", "comment": "Malware payload", "value": "bd75e2ae7e47a67d4832c409c7dd0840fb5b6b1ad2d074b7c0174fb11adc0bd6", "object_relation": "sha256", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663499, "uuid": "2d573730-96a0-4422-b11b-c626e741c871", "comment": "Malware payload", "value": "539e2c365cdd2b4abae50729794918c1ee4c1990", "object_relation": "sha1", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663499, "uuid": "10070375-f190-444b-a13a-e7f49092f565", "comment": "Malware payload", "value": "5df8d9dc6af014e5d1ffa8d9d53856e344df2fb15635f050bc2bf783648f6f3d1836f490a39a3c67e9a3a202bfdb09d5", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663499, "uuid": "0c9b0ed6-bbdf-48fc-8660-4c0b57766a17", "value": "T1BC563350A739E252E80AC1F916DC30BC19CCCD884535666E5BA83B66EC8F4F4AFDC857", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663499, "uuid": "38d98d5a-ae80-4d2d-8d11-0643fc2e047d", "value": "98304:MVlkLaiaDs4iL3PjuyWO5zt0UO5cHTKaVmplnQ5msq4KRI/jSpM/eF3WKC8XqRkt:MVlzia44iLayWOQUHuodO8+WKtqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785663499, "uuid": "56289340-3f8e-4739-883d-ce6ffbd29255", "value": 6383775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785663499, "uuid": "2cfa0a9d-e9d2-41b7-b687-38fc55dd77a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663499, "uuid": "dcc2b840-64cc-440d-870e-2495a87abd96", "value": "bd75e2ae7e47a67d4832c409c7dd0840fb5b6b1ad2d074b7c0174fb11adc0bd6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3602631c-8e7b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785679526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679526, "uuid": "e6b8f88d-1fea-43e2-a811-4adf728d61d4", "comment": "Malware payload", "value": "3cf109c6fb103a89ed85ce2a6b98e36f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false }, { "name": "shoeshowshoes-com", "colour": "#D80312", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679526, "uuid": "f821f81c-cdf9-4c74-a5e9-4331d9479f7d", "comment": "Malware payload", "value": "bd814af9aa0bd5e0fb63b7c4a34dc382589bd89da2bb8a462d8a22ba2ca6178c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false }, { "name": "shoeshowshoes-com", "colour": "#D80312", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679526, "uuid": "094b3945-8d33-43f8-975e-1e2d6ba80fb9", "comment": "Malware payload", "value": "2a5432cd60373e9a4ef04073d1c0e7f7cfe205c6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false }, { "name": "shoeshowshoes-com", "colour": "#D80312", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679526, "uuid": "f4504d11-924e-4c0f-9949-7b71c51fa7b0", "comment": "Malware payload", "value": "d517da7c8aeef087a16db464744a900a80ca2cfd11734695d6254d42809dfefb4a4ba70379450f53ed4c3a0379007ea8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false }, { "name": "shoeshowshoes-com", "colour": "#D80312", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679526, "uuid": "c14bea0d-f1a5-4604-bafc-8784c0b3086c", "value": "T18AE54D5AD6E196B747D25F267EA6FC2A0680AEC3A5D8E511B3301097827F38EF4133D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679526, "uuid": "c254f502-b4cf-40dc-ad85-6bd3a30aa4d5", "value": "e0c5df6940f38fca3c0c0c22d7bffedb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679526, "uuid": "81d90c6a-5823-492a-9640-5e4680cb01f2", "value": "98304:UMAKktWz9rKTFTDly6jjNuMPsdB1FBjJk7t3Mnf5b:ag5rKTFU6j43B1FVJk7t3uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785679526, "uuid": "85f6546b-0676-42eb-a875-7f0a85c2574b", "value": 3313152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785679526, "uuid": "0671e1cd-eb94-463e-8a52-f4a6c172b970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679526, "uuid": "978d1188-d921-4f39-951a-a6649f9a5a98", "value": "a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc6dae5-8ec4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785711161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711161, "uuid": "620d9831-c6b6-48f2-af34-b16101916f7b", "comment": "Malware payload", "value": "e8394961d8e735d603d9ebdc61a27700", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711161, "uuid": "7eb775e1-a776-4b02-9d38-429873cbc6fa", "comment": "Malware payload", "value": "bdcffdf543d7de8063d07d54f90f30d837fc872ed2f09b000788c6559a9af568", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711161, "uuid": "4300c514-5eb3-41c4-8737-040ff3ecc989", "comment": "Malware payload", "value": "0ff2653c33ee0aaa511f5b457368f0938d782143", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785711161, "uuid": "3ede764e-f244-4123-a623-e7d2708704a6", "comment": "Malware payload", "value": "2ac8c5bf346187a057bb8d82417aed23e666a4cbe87164c609d3b4206fcbbe6fcee573e679e742bb641ed5d453ca4c2b", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711161, "uuid": "939cd53b-5b0b-46da-b929-f1d2ff077860", "value": "T1DED522D5B5BA2DB0C877CBBA4FC2F47DB168778087658E9B738C76008E526041C7A276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711161, "uuid": "f889e3fe-c5e7-49a8-8cfe-c815471aabdd", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711161, "uuid": "027d1350-7c0b-42b3-8bbe-3b12239f609e", "value": "49152:k3t6WH39O9wnibP2nuU89IK2Al77eVEQ+hAnrdrW8X0XjDllrh9lEGRaWc2Bo:kNX9BDh8qzQ7bh8dqDlxdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785711161, "uuid": "6fb9e71f-d833-424a-b1ac-2bb21e370d83", "value": 2958336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785711161, "uuid": "f8e78e2e-1933-433c-8ad3-0c281f93e6f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785711161, "uuid": "10951579-da82-42cf-85a8-55da27b683e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2143a6bb-8e13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785634823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634823, "uuid": "d4c6727d-12dd-4f49-94a8-3673ce41f767", "comment": "Malware payload (Mirai)", "value": "528e36d1010cf423310230fb686725b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634823, "uuid": "8b4d1c29-f77f-45c6-8b1e-d6c08c506cfa", "comment": "Malware payload (Mirai)", "value": "bde905ff9a0748dc6f31b52b99b712c5b410b49843729e4932b647c15707fea1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634823, "uuid": "849f29d9-e444-4e30-a673-540a6e0d6f3d", "comment": "Malware payload (Mirai)", "value": "a137876efda162b1a42342db0a71e4f81f3c0ef3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634823, "uuid": "69321052-9dcc-4d9a-adfb-41e0b65cc590", "comment": "Malware payload (Mirai)", "value": "0e7ba1f7b01f2a45445559d0e29075d8d3db916cb0159557f0c9e18a89e55360afc348aa014a49b0adcb1928b90f702a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634823, "uuid": "cd4614a4-6b55-4944-9e76-6ab797d2cd63", "value": "T1C411DAAF045429AED6138903F274E33EF31B7FAD7EBA3B08C7856653A448440317298D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634823, "uuid": "0b3381db-2e0d-4966-b86d-84704bbaf5bb", "value": "24:5XQ9EteE+pTUVUTBTfVFTYpEXcEwpES/E9pKojEEJDEiurRwFRXCdRXnRwqqRwGz:emL+5aUxdNYyDwyh9kticw7XCTXRwq0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785634823, "uuid": "42f768ad-60c7-4e1c-add3-ae5117aa9940", "value": 952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785634823, "uuid": "c1b7bb8f-9a8f-4148-8cff-eac64709b934", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634823, "uuid": "56f459cf-f55f-41ea-a9f9-1b0e00506935", "value": "a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b445e527-8e5b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785665994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785665994, "uuid": "21abeedc-cb35-4659-9d92-d962001909ce", "comment": "Malware payload", "value": "3dac31a6de1c4e6dd1d5180f7fe1c3c3", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785665994, "uuid": "a64f53d2-0f1d-4d94-8b95-b397ec33525d", "comment": "Malware payload", "value": "be8245a30f7860f9783cae138ddb6c8411a2cb997f9bf861a7e10e1ee07ec3f1", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785665994, "uuid": "a864860d-6f34-41fb-8d3d-b9adb33736dc", "comment": "Malware payload", "value": "52f36b563ff030eac25717da6004fa71317b29f5", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785665994, "uuid": "729d1980-5a8b-4d90-bcca-cbe070c8aa1b", "comment": "Malware payload", "value": "af586da68a1068fe98c9752c27f92d47088491d142daef511c1938882150c8cd2b51d620aa9e02aa1775e4a1f4bb56af", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785665994, "uuid": "04372aa6-3634-4049-93f4-90d1ea7d79fb", "value": "T17AF56C03BDA948FAC0E9E73588666226BBB0B8084B3173D32D51BE752F767D09E35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785665994, "uuid": "95dd5fac-a9bc-4fdc-8211-95bc04086a8e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785665994, "uuid": "bc64bc2c-0247-4671-9d24-9faff396c362", "value": "49152:SRvyjFqnDRROmSmo3WHtuNlIep6igntvAUmmUXm4FKs7:S2ERfRwIe+n0mUXCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785665994, "uuid": "221aeb18-1231-429d-8fa4-10f888982c5d", "value": 3622280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785665994, "uuid": "62d7155a-60ff-40ad-b027-b7b6df6b83f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785665994, "uuid": "fb7d88de-c02c-4a51-867d-e33837a824ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd0474c-8e13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785635140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635140, "uuid": "0f151eb4-4019-4102-8f38-a934c94d36bf", "comment": "Malware payload (Mirai)", "value": "1cd5995ce10b309abf5f56e135dedb30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635140, "uuid": "06618672-ada2-49bf-9163-bdf9b18dcbde", "comment": "Malware payload (Mirai)", "value": "c0362bd243e87ca8fa0a5ec6eb3674ed57f30baf797b21043c2662f6f6d1db1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635140, "uuid": "ffa3b47d-f197-439d-8830-e044a2ace25a", "comment": "Malware payload (Mirai)", "value": "455b468e3ddcbf3f6342a4b1f0d924cc5dafc60d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635140, "uuid": "3196f2a1-d842-4e62-8017-91b3e89b849f", "comment": "Malware payload (Mirai)", "value": "0e871a7ec4f4e5cd0dc3e57a43622e32bd41538d1ce286ce889c7af87032f41d4823096097c98f761ded15ef18893f83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635140, "uuid": "c5866951-9b47-48d7-9adc-b27e9f94bb4f", "value": "T1E523F25262FDDA15DA2E067422DED4CA395CEC656B0C82F9CA88712F4434F353F298DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635140, "uuid": "b0ba42f5-4356-45d0-8c63-471547a4f1e3", "value": "768:zwbDYZ0ofy7ghK2QQdhSCXglDrm7zc59vnrDVDWMgan2JiRSsUmkjUJQzxov/+nL:z2YZ0Cy7ghMQPSSiDrm7459/11gaAXsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785635140, "uuid": "4ca1941f-099a-483c-9a82-5a07a844555f", "value": 46904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785635140, "uuid": "ed71375c-1789-4f48-8d79-5eab5aa2e3b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635140, "uuid": "800beeb9-ed42-4e5d-896f-5e3b6efe9624", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7ea838-8ebd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785708021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785708021, "uuid": "e032e180-4422-42f5-9319-352042bd9cd5", "comment": "Malware payload", "value": "0cb7115ecc997d8730305579eae518eb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785708021, "uuid": "25697f2f-4a38-4288-ae8f-3b86b92cf103", "comment": "Malware payload", "value": "c285743be1d2f01eb3d134750b71571797eb5d18affd0715ba2286da23580763", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785708021, "uuid": "033cef13-a521-49e1-a7d1-afe08a1b4beb", "comment": "Malware payload", "value": "8d4d1cebc2ef6cf6c8b2b3a335ce189864eb270d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785708021, "uuid": "a6af1656-0c15-44bc-9b66-10d674ad1532", "comment": "Malware payload", "value": "350d36fec8a803ac990f29c055099405a29e63e50978a78e2e35baa614c3b64295eec86d33a68142fd12410af784da69", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785708021, "uuid": "ec14df6d-e5f3-42fb-b27f-5256cb456e2e", "value": "T1CD824B0FB9424326D0E11070A276567BDA79A8B637C414DBF7E48AED0A6C6D1FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785708021, "uuid": "a5e80c8a-8cd6-44c9-bbf6-797f2b5dbe0f", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785708021, "uuid": "ca3c7f2e-10bf-4321-bd84-4f4fd6a3ab64", "value": "384:Zl6I8vVaF6OeYUQQlmLu94gXfc4lmxav8U9cXl:ZlPvUQQt9v8a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785708021, "uuid": "b4fbb2e9-f222-4cf0-8ed9-d64201d0323f", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785708021, "uuid": "0f70cecb-1061-43dc-ab00-8a8d3b74f99f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785708021, "uuid": "674f2c65-537c-4e23-ada5-c805b5b6b6da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28426507-8e0b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785631399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631399, "uuid": "045a06da-40ac-49e8-b81d-5c96d81085ff", "comment": "Malware payload (Mirai)", "value": "b76289767913796c0547e2381f1f564f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631399, "uuid": "a190e730-8813-439e-9dc1-bc947ea99b09", "comment": "Malware payload (Mirai)", "value": "c29f04f3bf672aa6e91a47b810bab140b7b21b0925fa10b3fc676c5c43057b90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631399, "uuid": "9ba71a12-88ed-432b-8c05-9d09a951ff5b", "comment": "Malware payload (Mirai)", "value": "9017a160276a9760c3075f0a0135ed76088b5192", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631399, "uuid": "fa008939-0c07-4622-9da9-f9e3ca88013b", "comment": "Malware payload (Mirai)", "value": "a404dc1b154f44841c0db445d5195d37d73f2048c5d3f1d06fd411c41474a1dc0b92545738ded36e3e00e591326a58d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631399, "uuid": "3e25fb64-9994-4967-a286-bca705b57495", "value": "T14F33F1DD926F2449EBEC4D3EB76F07E69A02F488321E6FCA13165C5192AC44F32C506C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631399, "uuid": "d4b7221b-e14c-45d2-a273-d37890838fe9", "value": "768:FF6WiBf9i4tROBwZ3OPhgD6GhB9K0Ul1yh43h8f1R/YNrtrohdBEE9aP+ZIWU5:T6DG4tB+ZgDh5Jh43h8/YFmS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785631399, "uuid": "f4ce683b-0032-4608-88aa-b6f910f68998", "value": 50436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785631399, "uuid": "0199c00e-b164-451d-a578-6c5473214b00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631399, "uuid": "20f6965a-262f-482d-83a3-c45184ffa5b1", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131e73ce-8e7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (BlakcSeeStealer)", "timestamp": 1785679038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679038, "uuid": "2cd266ca-9a80-46f9-a789-0b28d318a3f3", "comment": "Malware payload (BlakcSeeStealer)", "value": "559d2b4afa2fedc5beed36806c198cfb", "object_relation": "md5", "Tag": [ { "name": "94-183-168-16", "colour": "#5B2E5A", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679038, "uuid": "898747f4-893d-4c83-9440-52871dd79450", "comment": "Malware payload (BlakcSeeStealer)", "value": "c3bd9003c2a8b57c18442587a4d35f1bf0780b3d069bf5f7042e1351957403f5", "object_relation": "sha256", "Tag": [ { "name": "94-183-168-16", "colour": "#5B2E5A", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679038, "uuid": "73b7aa64-8bbe-4e87-9e0a-3ac0c2b4e256", "comment": "Malware payload (BlakcSeeStealer)", "value": "c48bb88bdcc7559e99aaf0db05bcdbfbbffd3f37", "object_relation": "sha1", "Tag": [ { "name": "94-183-168-16", "colour": "#5B2E5A", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679038, "uuid": "55862c77-f993-43d7-a9be-da8a68e4811b", "comment": "Malware payload (BlakcSeeStealer)", "value": "68f0f0b9f058242d66151a301365e0ef8c7c8d8de8abbff755da1a7091d0980a7265eb2a5b252f12f33f0927943e39c4", "object_relation": "sha3-384", "Tag": [ { "name": "94-183-168-16", "colour": "#5B2E5A", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679038, "uuid": "d0c4c93f-40f3-4ad6-a8c7-b6ee1d773a68", "value": "T192B5DF18E3D912A8E527DA34CB61A232E7B478160B61F98F0A9DC3551F73ED09B7B311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679038, "uuid": "d0eebd31-8e67-4da3-9ab8-86b402283111", "value": "7c15ad67c5cfe43a17beff396750ae2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679038, "uuid": "e914baae-d2fb-4e36-ab84-92e26a8b99f5", "value": "49152:w8LJ77iUQRk2y2XOSEauwCP1YAvjNhKaXhv7VwUWR1cYznG:wa3Sqf1LvjNhP7VwUBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785679038, "uuid": "1848b938-8529-4fed-996a-5a163196f355", "value": 2408960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785679038, "uuid": "7a063d86-d15d-46fb-bc39-bc9e03730e75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679038, "uuid": "efc79167-a203-483a-85c4-429e0727398c", "value": "vsdbg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce2b075-8e83-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785683295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785683295, "uuid": "25136b76-1a8b-4992-b2c1-35d881bf5129", "comment": "Malware payload", "value": "6bf187a9368ece887c0852a00a49d4fb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785683295, "uuid": "c1414d7c-d671-4e84-8799-5fa9188b6e43", "comment": "Malware payload", "value": "c522a752519580c37574684d86abfe3c4666ac72d837825ac21d6cfe937d7817", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785683295, "uuid": "bc028e7f-dbb0-4738-af93-5b9462fa2d8d", "comment": "Malware payload", "value": "bfb48ec8ac624caae0fb2c5141e0e3b49b1bbae8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785683295, "uuid": "f9ec5584-5406-405f-817f-3373113f971f", "comment": "Malware payload", "value": "22c4c7c3d8bb13147f47fff4951287cea397bccd0c2af13fa6b44ba9f27f9dc55155281154ca5c4c7608c952e866fedd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785683295, "uuid": "b8c22e8a-b48b-4885-8910-23fc0dd15077", "value": "T11F263352C725D8D8DAE3FB370A714117283AD0219B53A21BDE1682749CAF7C0EE2BDD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785683295, "uuid": "a4c77c58-755b-472d-bee7-5d9ecaa7bddf", "value": "98304:0clkO4KGmQmlqrBr+vo/IH2h9cC/V/l8y/z/MAIyb:0cCt5FBr+voQHYccVXzQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785683295, "uuid": "58442b79-5348-4607-8b27-b91b8384dd1c", "value": 4649454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785683295, "uuid": "5438a72a-7d25-446b-8189-24ddbbee649e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785683295, "uuid": "dc737a84-0161-4cda-9724-1d1ac35e8272", "value": "c522a752519580c37574684d86abfe3c4666ac72d837825ac21d6cfe937d7817.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f132d65-8e7b-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785679461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679461, "uuid": "69847c3b-1ffa-4e60-be1d-b7747a790f8c", "comment": "Malware payload (RemusStealer)", "value": "6ff7859c937bfb53afecb91ab4ec2a76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679461, "uuid": "95bc38a7-fd5c-40d1-9419-9b15ad9762be", "comment": "Malware payload (RemusStealer)", "value": "c75bee3494a32d7f23675c150f1c4365262cd5444967b92733bacaec7380bb88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679461, "uuid": "ecddca2c-6703-4dbb-bb93-c98387ea62c4", "comment": "Malware payload (RemusStealer)", "value": "6828f0493aec69f6ef4286c42059c64c1499a8cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679461, "uuid": "e9d51546-0898-4f50-aa30-b18e77e968a8", "comment": "Malware payload (RemusStealer)", "value": "c0f8d88efbc1d3e212522fecbaf4a4d4b9a274513c74c4e86dc5b60b3395b7be7fabf1261f67e3dc3ea718b8cb516161", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679461, "uuid": "1ce11b96-a5d5-49c2-ab68-656aacaf784d", "value": "T158D57B07BCE188E5C09AE23589B756927B74BC480B3127EB2EA0B7782F727D05D35794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679461, "uuid": "08ccbe37-5d82-4148-8053-feddb4a05017", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679461, "uuid": "58508f0a-b95c-40c1-8f79-0d8654d2b7e9", "value": "24576:JUwPivmAeIyO4TpDLNF9+zCfLbka0CK750Dg0TEP3V5bR7Pr6crSY06vA2Bele5t:JUEMmtOmftxfEdH5p0TE/V5FbzHYus2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785679461, "uuid": "14c6bded-7803-4d52-b83c-a1b305431324", "value": 2990424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785679461, "uuid": "cad477f9-64d9-43d1-a577-1b1563eafbcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679461, "uuid": "3d957f75-6586-4e38-a8f6-5e6e77950dc8", "value": "Stellar Data Recovery [by j0nb4].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f86aa3f-8e16-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785636270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636270, "uuid": "c451857a-2710-4f7d-9269-acfd75df0d05", "comment": "Malware payload (Mirai)", "value": "8d32dffccefccfe6742a66f732a53257", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636270, "uuid": "c9cd9342-3af8-46af-bff9-693a48307b31", "comment": "Malware payload (Mirai)", "value": "c7bfdeeffd0c9c3bbcb017caa8c57ef83ddfb9743209c33099c08a1389f66698", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636270, "uuid": "1e68d1f4-8cfb-44f2-ba8a-0787d30f97f3", "comment": "Malware payload (Mirai)", "value": "969d1d266ff273742106f90583c6b689a999f7f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636270, "uuid": "d135f2db-335d-4e74-9388-732a2ddbc886", "comment": "Malware payload (Mirai)", "value": "34976cac0eb2177d489d61e24ac2cf9e3061f8dc0fbc0b7ba88a53d68abec504b1ec87e937f61a21860832681db2b316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636270, "uuid": "bc5ec009-677a-4a92-a565-1104f361589d", "value": "T1ECF33B05734C004BE2A71EF03A3F6BE597EFDA9131F4A541295F9B4A8171A322986FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636270, "uuid": "90317e29-94b5-4e32-9666-b26927d763f2", "value": "1536:DRXrhoUlsUXqdbDGLXw9+K5TZLqxRRPvWn4lvpH/Vf1eqAvAAO0VA/6z0dTpfMzc:DRX3ad3EXw9+OLqx6wH9f7A0dAvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785636270, "uuid": "547f96a9-8e10-4eb8-85ac-e79e5af677ca", "value": 163992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785636270, "uuid": "85ee0c17-fc89-4352-b93e-7f77eefb7170", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636270, "uuid": "b23e3b31-129e-41a1-98a9-a173fdf09b64", "value": "zero.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97f31b0-8e3b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785652285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652285, "uuid": "03080824-f75d-4573-8c84-cb0650e5bf40", "comment": "Malware payload (Mirai)", "value": "a526e2a763a69ba1dda69e7b58c4d6ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652285, "uuid": "365aa082-6e5f-426d-b2e3-2e30aacd94b2", "comment": "Malware payload (Mirai)", "value": "c89341ffa77579edea71e6902494c09a569cc4f6356d616933f273e8ea38bf89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652285, "uuid": "554de0c6-a655-4635-ad81-be978dd35c4b", "comment": "Malware payload (Mirai)", "value": "08ab6f65d703b819c02677749380b0dea3f6fe48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785652285, "uuid": "16c6bc3a-57b0-4a9f-a36b-10c2cab2a51f", "comment": "Malware payload (Mirai)", "value": "2edc8436de86f29e9832c7ebf7738afa6aeec50c81fab211fa08ed3f0de8c0c80310f086d9a82b79c873ae1ddf6940bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652285, "uuid": "a42c304e-62e4-41d5-9a66-a590da12b199", "value": "T121E30789BC814B00D5D636F6FA1E124933534BBCE3F9B1039E145B2E278AD6B0B37A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652285, "uuid": "5c58a1ce-16aa-454b-b92f-c5ad07a15499", "value": "3072:/XVCt2PZvjYxbuvlvbIjmB16aDGb3d7slx5iBEHh:/F6gbIqv6aDGb3dYkBEHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785652285, "uuid": "ff409275-ac92-47d9-8dee-595da94c2236", "value": 145036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785652285, "uuid": "4a18a6e3-20d1-413b-8063-6ff2a3f7ce1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785652285, "uuid": "28909dd9-89ff-48a7-8847-3ac8d41e8013", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7c08a8-8e7d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785680421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680421, "uuid": "db5fea86-d820-43a0-828b-e9b0bdd4d073", "comment": "Malware payload (Mirai)", "value": "2f41ab95b44b6858b1ca23f9e6cb6c9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680421, "uuid": "9dd717dd-aea2-4c6c-a7a0-cd88aba6ba50", "comment": "Malware payload (Mirai)", "value": "c91a6e3b85b511485e6d37c5e5b5329f8d111e14178ec9c1e0125f58454c08d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680421, "uuid": "373471c8-40cc-4d29-8943-0941200a7adb", "comment": "Malware payload (Mirai)", "value": "a0dbd58e37c012f1c2818dd7025883a1854d9e0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785680421, "uuid": "4540dade-eef8-4feb-9d87-8be8cc503104", "comment": "Malware payload (Mirai)", "value": "d1aebc8780036853c2bd0f9cc94368e7165eddc2b4b47962dd7199369b9b5d4cb0cadc0e211a3b6502a166afe4754a47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680421, "uuid": "d9160a9b-c19c-4f52-8c53-b64978b82dd0", "value": "T135430226BCE35A319275C23E7B758ACBB95717E460F88432E50A85B02446C02E8FB797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680421, "uuid": "754d92b5-3c86-434c-aadc-6493210d117a", "value": "1536:zAISVp6FX21s7QGGIWaL7eqowcQL9zBoSHBCz:zAIjFGWTWaG6jL9tHHBCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785680421, "uuid": "83607419-c7bc-42d6-bffe-9111260bd1d9", "value": 60308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785680421, "uuid": "d9b883a4-ec7a-4b6f-8125-f4ec9f1c3409", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785680421, "uuid": "0c3c313c-b082-4f23-8b83-7aeb6a7f84fe", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1443f6-8e47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785657390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657390, "uuid": "e55dcf2a-cd0e-4902-a6cd-7881018594b1", "comment": "Malware payload", "value": "429f30a76eca5cbd3f6380de6b8737e0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657390, "uuid": "0a83f3ef-80fc-4ea6-90ee-8a0edb3dcb27", "comment": "Malware payload", "value": "c9e22125ecc99b4bdbd2bfbdd590d634a8c68c17929baa467e81380bab85a1bd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657390, "uuid": "6814a512-d8f0-4f83-94d3-b8f8fc53ec96", "comment": "Malware payload", "value": "afd294149f1caef47288872b5214575ba2f44fb5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657390, "uuid": "49c159ba-50bd-449d-8b76-4f89fc438e86", "comment": "Malware payload", "value": "ebd07301b8c6ddc1ae1b3dbac67ecf289189033c626b9abb8223f47ee865719fa55c216d2f9014e1e692ccf05e9dcf1d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657390, "uuid": "2905a087-3173-420a-bc45-2c9d11421368", "value": "T1E4236D651A857C14AA98C4371D7E2F0CBDAD43E6324492DE7FCB3CF28C5AA9D910871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657390, "uuid": "4621c950-e861-46ad-bc49-6f9db4225918", "value": "768:MZXRWNGxVZ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:MzlxQcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785657390, "uuid": "1842928e-704b-4a47-84d4-78a9cda0a698", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785657390, "uuid": "85610a29-d69d-42b6-9830-2ab9a0347d40", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657390, "uuid": "b61f07e7-ecd5-421d-a0e5-16edcbe839bd", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889319df-8e76-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785677517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677517, "uuid": "4baf633a-07c0-49d2-9b7b-b4f326a7e48e", "comment": "Malware payload", "value": "be417722cd7ae8d2b049cef6bb7dd32d", "object_relation": "md5", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677517, "uuid": "ccba7988-84f1-4124-85b0-f6621408cd83", "comment": "Malware payload", "value": "c9ffc5922f06b518cef5f5dae98914b112de01fdc4ddfd6c7d69a5bd5dbe6ab0", "object_relation": "sha256", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677517, "uuid": "bcb01287-b90b-439f-bb4d-6f0491080a68", "comment": "Malware payload", "value": "1aab2e355e9ea305db8270930c7c2e764d7e3b56", "object_relation": "sha1", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785677517, "uuid": "7b6bf3f1-afc8-4cb0-849e-d2989f0abbdb", "comment": "Malware payload", "value": "6ff821935df4f40a7d8d4c5c225b1aab3bf91bb11c99fe8d7a193f60abe4b7bad8e4fc5459b2116991629f143a3769ea", "object_relation": "sha3-384", "Tag": [ { "name": "6e7868436f4d3b49f375773379ba9022", "colour": "#CF283C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677517, "uuid": "ba03644f-ec1b-4662-a421-208f4db16773", "value": "T1F4D523DAB8FA1DB1C472CBB29F82F47DB11D37854BA18EDA398D6A008D536182D35371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677517, "uuid": "5c5c0647-a6a5-490d-bcc8-154b8cd5716f", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677517, "uuid": "a903b5d6-4cf0-47b4-9642-1162b6f1817f", "value": "49152:yAPGhqQqCEF1b80OMai5wqVp4ZG8JRBm0OuZUDW5MygHC43xm0L/50GDhAFpIz:yAnQq1FJ8phIw3ZcAx5/gHl3BLnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785677517, "uuid": "7b35fc2a-6b1c-42b8-94b5-9cc127d74a3f", "value": 2976768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785677517, "uuid": "92f07151-4f8a-4f74-9088-365be3aa9e4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785677517, "uuid": "9500801b-2550-420f-9782-5a15de73979e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a468140-8ec4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785710833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785710833, "uuid": "e8307d66-ed0b-4897-b24e-f15a98ad52d1", "comment": "Malware payload", "value": "111da74df7de47e068b7d6acc5ccb3b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785710833, "uuid": "8584fc2c-1e21-44c7-996c-311d7270eac3", "comment": "Malware payload", "value": "ca98331f359b0aa194ec6afc7783923fa9395146a369bce5e14ebc9270d6e64d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785710833, "uuid": "70a9b868-0037-4b16-b0b0-d25a520e0a8a", "comment": "Malware payload", "value": "816eb49586ed7830e487b26485eb9ad16f3f2877", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785710833, "uuid": "53c617c7-5662-48be-b616-c6352c4110c2", "comment": "Malware payload", "value": "191ffea0a831f3fb078c92d59bc5623209e5d940ba362728930fcb17172859420f41d6d6fbfb90e6ca0dbb4ccb9b15f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785710833, "uuid": "1836eda0-0cc6-4d12-9208-d29509423b60", "value": "T135166B03BD9448F9C0E9A7368863621ABB71B8088B3173D72E51BE792F767D09E35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785710833, "uuid": "2d82ed42-0740-46e2-b09e-35e4d24db30a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785710833, "uuid": "c26c323d-2188-4da6-b2ef-133e7486460f", "value": "49152:ETboedodgS5eWe8d2mkEIu2HYfWwFni+m4lxpGZ:E7dX74sKFFps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785710833, "uuid": "1a961906-0ed2-4b57-af8a-eabe5d927fd5", "value": 4375424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785710833, "uuid": "00cb577b-4d39-41cd-9f73-96ff45efaea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785710833, "uuid": "c4fda654-93ba-440d-aef8-cee707849148", "value": "7b17z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b474ed2a-8ec7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785712380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712380, "uuid": "5090e7e3-6fe4-447c-8098-f6091070803a", "comment": "Malware payload", "value": "3ee4cc3f90269c5b46d4121be30451d2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712380, "uuid": "a27e96df-f465-483a-b388-31f70320428d", "comment": "Malware payload", "value": "cae41900fd831579de5bc9650a22a1123f28a1874106f56870b81f7682d9287e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712380, "uuid": "4fc50575-8cc6-4f32-9d18-88cfb6924610", "comment": "Malware payload", "value": "1826208cf0ea6b30ec56b6102ab10f4e61728cac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712380, "uuid": "aaab30ab-f507-4421-b5bf-4ffb4eb0884b", "comment": "Malware payload", "value": "251a4e5f94f2e0278a69b22a788907ce1250e8b2fd3810c8687abd3a5ef5510fbbc54294d36f85770ca95f4e6a348518", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712380, "uuid": "aa6c8235-2fea-4e5f-9de2-262dce6d938c", "value": "T119F08BED949640323F0D5437711A4C652602082F24B95BDD224E99635E0CFA8235EF33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712380, "uuid": "819aca3e-102e-472d-a430-1dbe24007e92", "value": "12:ZsU9jWijWr5jW2FFl7jN/OQrNaQCTERE5YXmY6uYCYEeyH:Zp9jWijWr5jW2Fr7jN/VszBYXmYRYCYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785712380, "uuid": "cfb2f971-69db-46c7-8340-bcd99f36a11f", "value": 530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785712380, "uuid": "fe16c804-387a-4c38-90cf-da16b0934ff9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712380, "uuid": "9542ae46-d8fc-4cf2-bc00-5232b7cc13bc", "value": "huawei", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e6e203-8e9a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785692976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692976, "uuid": "76ccc5e5-4a7c-4d81-9158-59b9e28728c4", "comment": "Malware payload", "value": "c680a2a162aea8539f6869778ba31a6f", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692976, "uuid": "7e987f11-c5d0-41bf-b008-4e7d009c4568", "comment": "Malware payload", "value": "cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692976, "uuid": "d16ef798-686f-4941-97b5-3f5ed694368f", "comment": "Malware payload", "value": "2fc8f13bfcf9a46be3666b8d5bb05be28881b7ce", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692976, "uuid": "30693c93-47b3-4a27-852d-901de89e86d0", "comment": "Malware payload", "value": "182c89da3548900d3e86fa6b2dd6526771a231c46ff8d3d8c33076060ca6814dd276013b41286364be22551004e7ec56", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692976, "uuid": "7df98bdd-76fa-41dd-aca6-303ed48f70ec", "value": "T1C9D5235CFCF302B1E437C3F75693A1AEB12D37818AE44D5B768867101D532292DBA27A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692976, "uuid": "124ccb8b-198b-49df-9fb1-ca6fc19b7342", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692976, "uuid": "0b1deeac-ea11-40c8-9c7b-b5b51c8aa775", "value": "49152:fZnzZ/CI8qLg/3/0FS6lGyRJqQ8VBagUsHMsU2gQQVOvdDXnKb0jJ4uZxRP5jOKD:fJjrs/3cFnlUrhs6gQQV0dDXnKuNRJO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785692976, "uuid": "409ac18a-6ecf-4dff-831a-6a5be798b05f", "value": 2965504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785692976, "uuid": "4cdad38d-f275-440a-a795-f301b0da90fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692976, "uuid": "7713653e-7b47-4688-b8ef-98c3a85ac005", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b8ec56-8ea8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785698777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785698777, "uuid": "c512888c-6f2b-4b54-83d2-1854685b4223", "comment": "Malware payload (Mirai)", "value": "b1c1836c3a1b79919267dab2278e17f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785698777, "uuid": "f2d1571d-96ce-40d7-8789-5ef09468f2c9", "comment": "Malware payload (Mirai)", "value": "cc55866a9fef44732dfd16da90241e024dc5ec416aff55f377b082c265e2bcc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785698777, "uuid": "e295c655-c124-440e-924f-bc04bf2cf496", "comment": "Malware payload (Mirai)", "value": "a96ca1593464654bebf70e5c84ed6e147f83e898", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785698777, "uuid": "1a3928e6-1b20-4936-b6bb-f9039d5df5dd", "comment": "Malware payload (Mirai)", "value": "2e95fbed6dddd180d75f6f9f0faf9795d0fb36cb14796415f1d7aa27ced1db6c5267a141af3118c97f7f2f6df7b69a30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785698777, "uuid": "b25bc288-92bc-4a41-a697-ab3e05a57600", "value": "T1AD94E09AF7572E42C8C7857518C64146574DE59B33F393463B43AABB38293368F283C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785698777, "uuid": "9b8e6b33-128c-4ca6-8381-3d7dd92778ae", "value": "12288:MeziCjLXECA/WfkxbwWe648XfH8pLB/3:9hW4kVwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785698777, "uuid": "b1ba2944-815c-49b1-aace-ba898251e215", "value": 412028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785698777, "uuid": "375575ca-5cd0-4c65-b491-2d7ab4238af7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785698777, "uuid": "684afb52-4753-4a76-aabd-f77e4b3067b1", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7a5367-8ec7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785712390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712390, "uuid": "3659ee6c-3ab1-4543-b030-2afc04d7b65e", "comment": "Malware payload", "value": "b9b8cc0c63d547582b45e2ab2cedb83d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712390, "uuid": "bf6573a7-92dd-4671-aa37-f6d252ac3e1a", "comment": "Malware payload", "value": "ce7757d30cf3e83fd573935d57860d45682e9dff2a1a4947857a58e49125960f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712390, "uuid": "5708c6ed-d393-41eb-b336-c3f5d042182a", "comment": "Malware payload", "value": "1442cf7b9df0a5e174abf5ce2f6e2911bfd20b1d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712390, "uuid": "6d0dbb14-3d8f-4e5d-8efc-994675e17d5f", "comment": "Malware payload", "value": "cc1f4cba74c059c01969fc32c79ef87ae7a81bcfc43828f8e5f8d63e6c7c5c882c978f7565ac4b90a7c9cf4c3d9fe0d1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712390, "uuid": "b5627665-e331-4653-a2b4-8792b3f23fb1", "value": "T105F08BED949640323F0D5437711A4C652642082F24B95BDD224E9A635E0CFA8234EF33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712390, "uuid": "7c6c86f2-e81b-4c7f-ba33-5ebd2c89215d", "value": "12:ZsU9jWijWr5jW2FFl7jN/OQrNaQQTERE5YXmY6uYCYEeyH:Zp9jWijWr5jW2Fr7jN/Vs9BYXmYRYCYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785712390, "uuid": "7f6b2568-bfdb-4ce5-8bae-48d03087c1cd", "value": 528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785712390, "uuid": "0f33f39a-d732-4bde-8013-6141fbcdc09b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712390, "uuid": "49946034-bf2a-4849-b522-65f83199b39d", "value": "hnap", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b3bbea-8e7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785681408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681408, "uuid": "740a8807-0028-4f36-a507-84328df16ef8", "comment": "Malware payload (Mirai)", "value": "adc5bea7621d30622a764e0f66366c6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681408, "uuid": "b6ab6fca-408b-407e-838a-aadca2efe2eb", "comment": "Malware payload (Mirai)", "value": "ced43dcacd9725ccd26fe1e8be625d8de1a423d73583d56848f2680e4ea9bd07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681408, "uuid": "38e82cd6-8a2f-4308-9b44-562175a685b3", "comment": "Malware payload (Mirai)", "value": "ebb2eb49fe5175fe6c0dcc1fa206c2c2104dc676", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681408, "uuid": "e7c349f6-9fda-443f-b82e-39c5fc04ff75", "comment": "Malware payload (Mirai)", "value": "c072ff212034198041816752767e0eb000618bc2a84d98504e92d6fce654b41bd23ce9603404f5355b3a3fc86ab24a03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681408, "uuid": "0bacfc62-dddd-4362-971e-45fe3357b09d", "value": "T156342B46EA414F13C0D727BAF6AF4245333397A5D3E773069924AFB43B8679E0E22605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681408, "uuid": "a22f0d0a-f90c-4457-a1b0-16226fd9f9bc", "value": "6144:iSIs6bRUQLy7CPC9axohzWXW8gzw2zn2Qoi3g2MTHwM/R1vMFmK2BBg3Wn:DIs6bRU8PC9axEWXW8gBznRoggTl/EFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785681408, "uuid": "feb91a02-3d28-434e-8b6f-ec2768b25a92", "value": 236344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785681408, "uuid": "5f503f19-eab5-41c9-a55c-b60ddf4570da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681408, "uuid": "0c2c5185-bc16-46d6-8e41-52371b234a26", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d535cdef-8ea3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785696973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785696973, "uuid": "9235639e-a301-48dd-9479-8e1c59802b74", "comment": "Malware payload (Mirai)", "value": "ac539a9c34155edf95faf0d4c73d128b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785696973, "uuid": "db01fb26-afcc-4789-96f1-e4dd1e90989c", "comment": "Malware payload (Mirai)", "value": "d054f4822da5ea5e99edb57d809b9bacf86cfa3def04fa3711ddf88be7a68790", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785696973, "uuid": "a7a56082-5fe5-4dbf-b973-ef1e9df72e84", "comment": "Malware payload (Mirai)", "value": "c0f546d400cee6435e7414737bc8be58edbf2376", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785696973, "uuid": "a545c909-a403-4044-a877-ea5ec9fd66f8", "comment": "Malware payload (Mirai)", "value": "2a75603b82195a1c5e756b3e968eb3a19d2a528880b571a7d65633afc00d232434334840577979f8d40b84d76c5fcb03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785696973, "uuid": "c1f471d2-e910-4756-88ac-ff3c1a9a15b6", "value": "T12F259D12B7F102A6D28087354662D7A0BA47A7A665E0430FDF608EDFEF562650EC4CF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785696973, "uuid": "b45003f5-9ee2-4ffb-943a-fc5f3b27a892", "value": "12288:EnM7NKSw8SUyr2m6Av/H0A6YHQsRVs51g3d+:ygLwQm6kv0AJH1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785696973, "uuid": "291fb15e-f956-452c-9869-f79045cd3c47", "value": 1057472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785696973, "uuid": "be98c580-8ac1-437e-b065-e2302e58eb18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785696973, "uuid": "a59b56f0-2f52-4b55-af0d-874fb08ec440", "value": "xd.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f339b07b-8e55-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785663522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663522, "uuid": "ad7b2bf1-63a2-4671-9313-9bee6ed5a3e3", "comment": "Malware payload", "value": "bf27ca3cb19aea5a9717fd33cc57ea56", "object_relation": "md5", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663522, "uuid": "a05dda5f-b011-47dd-8db1-e35d60fae37b", "comment": "Malware payload", "value": "d26834d9d6bfef3de785c34d373f51f918c9ee8639d80f02d7938e22f956316b", "object_relation": "sha256", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663522, "uuid": "d57b75e8-8ad6-4ac4-8f0e-2fdb7bd4b9d4", "comment": "Malware payload", "value": "cf66d1313b5e940744f111a51caa74363776a575", "object_relation": "sha1", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663522, "uuid": "380006fc-5cfe-47a9-836e-b8eccbb32d39", "comment": "Malware payload", "value": "9c9ed1d4221ffcff199d9429e821208481d434297764f65732c22d26131aed3bdf77fcf9e9d42e5e50e280a341eb9271", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663522, "uuid": "f8da16f2-a0bc-4cc2-bf51-5cea331ae31f", "value": "T1D5448D83A29D18C7D1D3DB38C5938A51B73BB96845309B9F2362C269CE67FC0CE34965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663522, "uuid": "9014ed99-c4c1-49b5-87c5-190c0ba68ff2", "value": "ba35fc142ee9e219701015139a6b2327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663522, "uuid": "ac5487eb-d9d6-462c-b482-aacbcf5e2a24", "value": "3072:eFFiBC0fZ5KVknxO7rkuyQr+Q4iWis7A9zDyBTfmYlXWhap8yJ:225Kl7byDQhWmnXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785663522, "uuid": "a6705a8a-07d7-4c89-8a54-721b2171cd0f", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785663522, "uuid": "515ac802-a409-4020-8bd3-d36c08fd6d72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663522, "uuid": "e0465164-03d7-43d5-855f-9762588d1548", "value": "wintun.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9143a10c-8e9a-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785692993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692993, "uuid": "259122ff-aff0-4ca5-bcad-d05da3daaf5d", "comment": "Malware payload (CoinMiner)", "value": "8bc9c4049faa416af4f548178253db58", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692993, "uuid": "84ecc021-f406-4363-af7d-1b80db4057bb", "comment": "Malware payload (CoinMiner)", "value": "d36d08953cb47514a7d58a009161f0ad7fd5164bc1964a0b63c8ba1916ad218d", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692993, "uuid": "d008e2ed-3a6f-4dc2-a5db-f60b0f3ff80e", "comment": "Malware payload (CoinMiner)", "value": "0264d5abc1879e64466f97974ce543d9a3a40900", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692993, "uuid": "3d8acc0d-95b4-4174-acdf-6641c0ece507", "comment": "Malware payload (CoinMiner)", "value": "fce837752a189801750e195b4dd3f3073992d283c19ebaed8b4ff6df14e9e23859b7f3bddd293340360d812630d8722e", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692993, "uuid": "1040e9ec-a445-4df6-8d99-37b99b423a79", "value": "T18C3633496CC765B0C453CBB982A2657CF23ABF2067757C4777C82A25AD43E29083E3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692993, "uuid": "1daee2e3-bcb5-4528-8d22-eb8654f1f5bf", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692993, "uuid": "a67b74e5-ca25-403c-8568-9e8c3bfc5e55", "value": "98304:7eqgu8m6V0ShYdcMo1PBYGhCb5M4NRPEbaNv0dXd/Q7ueYP:yqguSVThYdTCBfkbnRm/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785692993, "uuid": "ebc9b089-b12f-4607-bc13-3a68ea3ac72d", "value": 5223936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785692993, "uuid": "9b6ae2f3-09b7-458e-9871-618174898219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692993, "uuid": "47269bd1-7e5a-4065-ab22-77c2450a0c10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbdc740-8eb1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785702864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785702864, "uuid": "0699c266-2407-4b7c-bd97-f287307be48b", "comment": "Malware payload", "value": "d821eb73ab51a02f5852c28af4b78c3a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785702864, "uuid": "3688b84a-8016-4fa0-9a74-3cbd5f70a42e", "comment": "Malware payload", "value": "d3998ff200687491baefd3038f06c9b891aabb3193be52fa14070c644c00b8e0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785702864, "uuid": "b95bf058-5848-4778-ad07-906cd0a5458b", "comment": "Malware payload", "value": "c1977685379884b09bbaf788da96bd19a962fef2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785702864, "uuid": "6bb94edd-9a32-45f0-8dd4-5073c47fc2ad", "comment": "Malware payload", "value": "b5c56a43ee3b524847bdc99d7f41a01b9fdc656060ce22b90cefd0133b06d04fb1f132bb967ae72c02656704893e2131", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785702864, "uuid": "18ee8330-581f-4934-93d2-455951d98330", "value": "T1212733A66C262F83CA6566BB23531302AF310DB33B1147512D39E92D1CBD1FA5B4D39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785702864, "uuid": "07accef3-bce4-4365-896d-b4971e01a606", "value": "393216:d26ctwbS3glvEv87upq4GCAKUduCu3et11G0YF0niA:dCwbps06JA7dBIeTiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785702864, "uuid": "54f91b0d-fe8f-45da-9adf-0c61cf94aad3", "value": 20328448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785702864, "uuid": "12294864-e8aa-4b3a-bfba-887503043ae8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785702864, "uuid": "a1271441-e1c3-4ad8-a3a9-73afa71bb439", "value": "Violence.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa803f3-8e4b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785659186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659186, "uuid": "d6352476-9cd8-40c8-b366-0d2dc31c2d69", "comment": "Malware payload", "value": "bd2ba9d488cb784aae3765952e6c5f6f", "object_relation": "md5", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659186, "uuid": "06e47105-b776-4902-b19e-3d94e11e5ff5", "comment": "Malware payload", "value": "d498ab02aab6595c465d272a05f73cd3b6406f592a9f309286f9427b82b9c1e8", "object_relation": "sha256", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659186, "uuid": "81041b3e-ed89-4f27-bda9-fae9b2c4d6c6", "comment": "Malware payload", "value": "5c2cc43040bb2446338f35324c3830010be2ed0f", "object_relation": "sha1", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659186, "uuid": "75e24c81-ecef-44dd-b0a5-5685696e6c55", "comment": "Malware payload", "value": "1f118a643ee9821ca8bb7f3aa1041e54626b6d2d3814e5be5b26b12807752449f0cb23d59f8b5c9774180331ef35aa42", "object_relation": "sha3-384", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659186, "uuid": "4bf70b89-28ca-487f-95cb-173de04aba5f", "value": "T13A31DC566B00A90A427B6129DF718848DF0561334CC86968FA7D01601FF142063BCF6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659186, "uuid": "1dd1ad7b-f617-4c37-926c-f5fc3e04a853", "value": "24:sEzAIM20GqfG4zhoFRRPXG+OPNZACQwgpX1j3O6SL63G2PAUFi/X/M4ZW:sEkI7HRPqZACQwAFcWG2IUFi/7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785659186, "uuid": "dbb84224-e8ed-4062-ab2e-327feaabc9a6", "value": 1704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785659186, "uuid": "83f5e76b-bbea-4a63-9347-cfd5ee47017e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659186, "uuid": "ed706526-faef-44e2-b341-e821c03e6d80", "value": "d498ab02aab6595c465d272a05f73cd3b6406f592a9f309286f9427b82b9c1e8.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98591e42-8e11-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785634164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634164, "uuid": "e20ccbe3-55a8-4d8f-a04e-7145be56b376", "comment": "Malware payload (Mirai)", "value": "0ffe3f1d758e5f29323b1e7e978c3ab2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634164, "uuid": "13ac7bef-ef2e-477f-b918-409bce99d8cd", "comment": "Malware payload (Mirai)", "value": "d67edc48b43fc48a0b399d5144bb5d3d0862e77065117fe10f7822a70daa1d96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634164, "uuid": "f8d810d3-a889-4a91-b4d1-4927263fcb53", "comment": "Malware payload (Mirai)", "value": "89a6132d864b4b1c3b2ea677f3b13dff83d59d27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785634164, "uuid": "85f33831-ce62-46ad-a39b-b8dd4e42b253", "comment": "Malware payload (Mirai)", "value": "41bd89bfb2277eafe54af7b65cfa48c4c78540b645fdde3c88c22b4f8b47ee1d611de6ff949d2344fdc0c8a017bce26d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634164, "uuid": "de8681b7-9a36-4b6a-a135-c0d8ec0ec83d", "value": "T1A1F33A0ABCC054FEC489C2748AADB532ED32B45E5134B6AB27C06E323D8DE61BE5D751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634164, "uuid": "81373a2b-6f3e-4062-a9e9-6e3d6b779d5c", "value": "3072:M6iSdcPSM+K2hwDAbHbDtYbBIeEW+9i9rYK6brE+BSF73:viSdcPSLASY+9BPCV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785634164, "uuid": "bb076a8d-8f77-4381-be21-c1c25f27f1f8", "value": 166776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785634164, "uuid": "d79c5f4a-9694-4cae-bb2b-778f8ea1c2c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785634164, "uuid": "151ece3f-a416-4348-955e-2d37f50b479f", "value": "zero.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961e21ed-8e7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785681405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681405, "uuid": "3d4a6036-338a-4fbc-a9ca-ea433de9cdf7", "comment": "Malware payload (Mirai)", "value": "0a79975007585ad8b4458316719cdd92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681405, "uuid": "80cdfddd-6afa-4d3f-8250-f09031eb39c1", "comment": "Malware payload (Mirai)", "value": "d75c881fdad84f78f7932f99d798dba690da597ec8791c545e382cd1c4c1b7ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681405, "uuid": "884ad0b4-2fc1-47bf-9487-4da37ec56ff3", "comment": "Malware payload (Mirai)", "value": "9bbc9451308211d918eed8c0ec6839b4c5b6c00f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681405, "uuid": "ae869180-256e-41fb-ae97-f8790c6bbf2e", "comment": "Malware payload (Mirai)", "value": "4c27a05b3a3697091368df6c02a55b65f52d68ce76d8ec925ab70216e9a82c94d4c2b3ababb1430749782e424c0ee4d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681405, "uuid": "53050527-771c-4095-af1f-026973ac7fb1", "value": "T19C632A91BD815B13C6D1227BFB5E028E372A63A8D2EE72179D216F2137C785B0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681405, "uuid": "0fa55db6-4f3e-425b-be4b-0b563b086fc7", "value": "1536:wikGww08b/IDPhDkSWirSQ5HD0+SLDGGqdhs/hs:wikUgPde6SQyhLJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785681405, "uuid": "b70b32ea-f267-4d4e-a076-9eda4c8ac9bd", "value": 72140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785681405, "uuid": "cd32679e-1c37-42b0-b97d-8f1f2d4e156b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681405, "uuid": "4001aa15-160e-462a-9f98-51b6504a5b50", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72471a71-8e88-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785685210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785685210, "uuid": "68d64da6-3e75-45f6-a056-badc6abd446b", "comment": "Malware payload", "value": "b745b1588a2fbaec03d5c00a82c47359", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785685210, "uuid": "022335df-3c98-4083-9a4c-5a6ab12b1716", "comment": "Malware payload", "value": "d7c61561dab4c69daf06ecd49eb74694d26319c0e1c8660f996a45fd71c5bc9e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785685210, "uuid": "1ec7dc00-2525-4502-9c15-6c87f8435be5", "comment": "Malware payload", "value": "91f81ae07ee1e9450072ad99837549e71fe304f8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785685210, "uuid": "4541bb6b-84e8-42f2-8b99-db2564a27ff5", "comment": "Malware payload", "value": "16923f8f98ea788e8157b30e0a043c0e229f46c9713a49e0adcc4191fbb85cb690dd9b128ec6612dd06da706fe2a1387", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785685210, "uuid": "9c6bb371-fa99-453d-b90a-51db591a2285", "value": "T1ED9633C67CC52374D097C7B09823A62D39253FD4BF664C8ABFA87601AC717262977386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785685210, "uuid": "f8b36a3e-fa33-432c-b995-9c7276b1fdf4", "value": "196608:W6WTYIpbo0g4lvOuUdZpEXmPNkCM4X+I4Hmq+r0ARtMhnYJE/JDL:fwp/g4lvOuUdZpEXmPmCMTGVbMhnYk5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785685210, "uuid": "d400de90-4c1e-4e0f-885a-acda3b011f28", "value": 8966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785685210, "uuid": "bafbd92b-6386-4299-8be9-53bf24f3f465", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785685210, "uuid": "77ae5d4b-6301-46b3-9237-7bf2f483f421", "value": "install_ehe007.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa897b2a-8e13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785635188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635188, "uuid": "39d1acba-169c-4fa0-a8cd-5a3af4451ab5", "comment": "Malware payload (Mirai)", "value": "d1d9c26eaf3d22b3c80ae8fd92e1b469", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635188, "uuid": "7792d56c-4d18-4340-ae8f-8c642fd0899d", "comment": "Malware payload (Mirai)", "value": "d86694d1cbdf7af6d65e8c362ab68b3bd18a6d6a5d882416704c2409e87e1b1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635188, "uuid": "097b9bc6-eb19-4314-a22d-0cb61cf2e2ba", "comment": "Malware payload (Mirai)", "value": "74da7f7adb87cac8fb5a93adee5536b29689f1b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785635188, "uuid": "2fda3141-f04e-40e3-9dc5-9e9fe0d97344", "comment": "Malware payload (Mirai)", "value": "1eedfd83a591bb049970159e8d72fde1ecd07edb910c0460d46bc728137acf3e4a295366091d4d79419fe245b92348a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635188, "uuid": "11604683-4bdb-498b-8e78-6901e65d9ecf", "value": "T174B34BC0F98B81F5C40B8C306166F63FCE31D5A95271DAADFF9A9F32DA776019502249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635188, "uuid": "fef4fdea-5699-45e1-9c1f-463a64fd9dc7", "value": "3072:08iN7p8KcnM5NcN4IV6OZzrjU7GDCCgptWsRCGq:Yt8VnMvcN1Rdnq6PGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785635188, "uuid": "28c38379-4ca8-48aa-be88-767d23854a1b", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785635188, "uuid": "7e9a5a29-4ed0-4d43-a165-2585e673e8b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785635188, "uuid": "91e2e4c0-d206-45e4-8854-df42432348f5", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79dbe7e-8e4b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785659181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659181, "uuid": "45289999-bc59-4c26-8839-4359a7e9c8ee", "comment": "Malware payload", "value": "2c4299431dd1a5a1629f3e3bb3510cf7", "object_relation": "md5", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659181, "uuid": "c9f68d3c-bb3e-4057-b5b3-fcdb50ca4909", "comment": "Malware payload", "value": "d8e18668b2df7bd01b48b0afc72818a7a42808714b09b0e3dc2b4713435dca5f", "object_relation": "sha256", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659181, "uuid": "5f41da8a-8af2-4ca7-afac-e219bb924863", "comment": "Malware payload", "value": "92c34d0609e1de4e5ab50da44b139f9f3a0d6c28", "object_relation": "sha1", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659181, "uuid": "95263fe8-8f2e-4f39-b55a-7836ad24f3ae", "comment": "Malware payload", "value": "63480d075e3303870b1d0c6bfb41577f22153ddb35806e90683de5fd1aacb853a1218da42a44a80ca8c60b999fad8456", "object_relation": "sha3-384", "Tag": [ { "name": "akxstudio-es", "colour": "#A85F20", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659181, "uuid": "de140557-215b-4b50-a898-524565cd970c", "value": "T1F931FB532B00A95581776419DF22C509DF88B2379CDCA509F9AE50986FB3060A3FDF6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659181, "uuid": "8d7bde10-0ea3-4db7-b072-cef7591582c4", "value": "24:sEsBtFmo6IM20GqfG4zhoFRRPXG+OPNZACQwgpXEAZOowkHK/aSzU2aQdH5aHM4Y:sEsvIo6I7HRPqZACQwA0m0J1hAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785659181, "uuid": "52724cbb-ea2c-49b8-b7ef-4c3dbc0a815a", "value": 1714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785659181, "uuid": "4adef4f6-3e12-44b4-96c1-348d4d925060", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659181, "uuid": "4c144702-5c98-45f0-821d-1202c579da2f", "value": "d8e18668b2df7bd01b48b0afc72818a7a42808714b09b0e3dc2b4713435dca5f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af4c1f2-8e80-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785681735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681735, "uuid": "93ca2d8b-7151-48af-96d9-b8dd5f1d30bd", "comment": "Malware payload (ConnectWise)", "value": "94216eb90ca53fbb175f0ee6adbfb663", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681735, "uuid": "926db300-20a7-44ea-8f60-ea9941824fe8", "comment": "Malware payload (ConnectWise)", "value": "da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681735, "uuid": "67881d35-ef22-4f47-89e3-86bd4dd1a552", "comment": "Malware payload (ConnectWise)", "value": "48038f060a5042ff44a2d9a9be46368ecc8436fd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785681735, "uuid": "f37c6bde-1236-44fc-8405-f155896b9d40", "comment": "Malware payload (ConnectWise)", "value": "e20e106a601278369250ccf88214971a23adbc53b6f5d51790ae045a98192e1616401d0b3c240db761c2f76ec49ffee6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681735, "uuid": "63da43ac-51fe-4344-85b8-a9c0ad63579b", "value": "T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681735, "uuid": "19c77e8c-b817-4201-af6b-1ff5bb086452", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681735, "uuid": "10710fc4-60b1-4b4e-bf87-4ec179d52e46", "value": "24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785681735, "uuid": "f43e6ee4-0780-46e9-bd1d-8098175e00c3", "value": 1729024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785681735, "uuid": "d9e5708d-6ff8-4ee0-875c-c86d571216c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785681735, "uuid": "2d578a4b-f973-40e6-bc8b-7a48c18c25d6", "value": "SecuriteInfo.com.Heur.2333.21192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8309c777-8e54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785662905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662905, "uuid": "48cc3c11-4381-44e0-a51b-e05009a6df24", "comment": "Malware payload (Mirai)", "value": "d6be3b8fc9608da584a5694e5db4c98a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662905, "uuid": "5d0a877f-54aa-41b2-ae74-037766387c31", "comment": "Malware payload (Mirai)", "value": "db021661e482c2a6c79be232b900ce9c66fcf1b78ad18ee9e3ba80a792c07d37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662905, "uuid": "c8b56225-fc53-4d24-877c-10ac38c45e30", "comment": "Malware payload (Mirai)", "value": "c148560d5ae7c41298b75015f46db7fdfaa42cfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785662905, "uuid": "b78f9157-cc35-4d06-851a-e9f57a872fe0", "comment": "Malware payload (Mirai)", "value": "2eea97ce53e6e52d98bad008a8dd9c8c5819242cb85e02046037083c0887c585f8089b4ea6941fea81d38c86535b0348", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662905, "uuid": "33af8c88-dc10-4380-a5d3-3e8c97b16bb7", "value": "T100A3E90AAF651EB7D81BCD3709EC074235CCA60772693BB57938D828F64A51B4AD3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662905, "uuid": "79985acf-c7e2-4869-81c0-3bc112f37fdb", "value": "1536:rOB52iEP9o9lsXHe72zNpnLKkMdJjXscFg8Xo5LWK107iy3wyX:qB+AlsX+72zJM9NK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785662905, "uuid": "e3769687-b7fd-443e-9dd9-1cacc65c3545", "value": 99104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785662905, "uuid": "51ae76cd-b823-4c15-916a-d0501b97e412", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785662905, "uuid": "f8bc44bf-84b8-422b-9c5b-6a5ec9e2f3ab", "value": "9YZ5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a60400d-8eae-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785701572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785701572, "uuid": "0ec2703b-9e9e-4748-ad8d-4b9decda4311", "comment": "Malware payload", "value": "2554316da2f58f58842e658619a40a61", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "MulDrop", "colour": "#42E25D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785701572, "uuid": "285c047d-d26c-40bb-9bcd-6b6c88438d28", "comment": "Malware payload", "value": "db4c3aa640d2be4ed97fbe502e2b27683a6ba3318524181bc4ab570bafe8c26d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "MulDrop", "colour": "#42E25D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785701572, "uuid": "4b24af86-d7e6-40ed-b1c2-432e7ce783bd", "comment": "Malware payload", "value": "f05369f1fce6a5a049036e66e27292c163ac15d0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "MulDrop", "colour": "#42E25D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785701572, "uuid": "158bd85a-a8a6-469c-815b-ac0d638c6ceb", "comment": "Malware payload", "value": "3562cfe9695ebe8649fed0539283e6bdd4d29df222dfa2e1bf0b5d42db57f8b7d1096d980e5d3e8f43dbd353439c6b11", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "MulDrop", "colour": "#42E25D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785701572, "uuid": "9d3ec565-345a-4d62-8cba-9037d4fc804d", "value": "T129E53379F4D81B4DE242DB332448C19096D2B81175E0ED4B97E8231E4F63CEB9B907BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785701572, "uuid": "825bd4b1-e573-4f4b-aed2-8a7bbe7aae31", "value": "49152:JnQ9qVFhBu5NAr5z0xvI9Q5tvz0qWcQeXdY7TZ4E1GW4aLksf/dsIvid4/T4Ur4D:Jn24hsHsqRZ7b0qm4dY/Z4C4E/id4LLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785701572, "uuid": "3cf24bba-28e4-43d5-87b1-cae1f127af18", "value": 3131448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785701572, "uuid": "994102fa-2735-477e-95a5-4c738e3c1b77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785701572, "uuid": "26d30548-b2e2-4f52-a82c-6355411db89d", "value": "zapret-discord-youtube-1.10.0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dde6fae-8e4b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785659004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659004, "uuid": "55184f31-7175-41b6-a396-666824ec0f5d", "comment": "Malware payload (Mirai)", "value": "39c2d430541bd5aef474b96b10978509", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659004, "uuid": "41d87396-11f9-4e0b-90a9-d2da805a34d9", "comment": "Malware payload (Mirai)", "value": "db65e6893ed2c3faa4576a7e61e06df23a3da843405f1e960ddc3eeabae9962b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659004, "uuid": "e6f99e22-2bd0-499d-b496-53d070db0d63", "comment": "Malware payload (Mirai)", "value": "76a97e9883840d0aa9c4a4044aa985fac6e52035", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785659004, "uuid": "b9cfbf4f-8c93-4e12-a4e6-8e580d27fb41", "comment": "Malware payload (Mirai)", "value": "0cc2a054a8ce4ffa49c110a1f8aa8eb6db55ba1507025a9c7ac5c067b3d23afeea71d5834ae5145c7a53296caf8ed3d7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659004, "uuid": "7c288831-ffc1-4164-aa9e-1a4f746641c4", "value": "T14F01E6CAD2509910406DC86D6AE612A4B431C3C7058B0F78BFDCD52CBB8CE08F16AE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659004, "uuid": "363758c7-5542-4b58-86ee-2fcdcfe19f64", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaKCXONFCAOFECczoNCWpkjCwtauD:kXCKysE2hi0ziQvZohaKlFRHbiNkjZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785659004, "uuid": "eb415b66-3a97-476f-958b-61df9b3d1798", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785659004, "uuid": "b2075396-9222-4722-894d-f1711104c864", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785659004, "uuid": "76f2e365-ac34-4532-82ab-8e96c85645d0", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bdb760-8e87-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785684867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785684867, "uuid": "98c89921-3b32-492e-b86c-a135fdf34c73", "comment": "Malware payload (AsyncRAT)", "value": "eb9656a9ac3dffcfc1677194a67a0279", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785684867, "uuid": "66c364b9-363f-4072-9f77-faa72040fa75", "comment": "Malware payload (AsyncRAT)", "value": "dc42da3571e4f907f456b2edb0b0ce4b22a66adc2f2c4d006b0c40ccdf69df77", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785684867, "uuid": "527d47ec-1a5b-4656-8e79-36930681f5d7", "comment": "Malware payload (AsyncRAT)", "value": "0987466ea2c57cd3b520ef025ed97ece71622ff3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785684867, "uuid": "a385cd2f-488e-4637-acfd-371f7cd77f6d", "comment": "Malware payload (AsyncRAT)", "value": "f1daf04afd8a2c424312c43105165c28992d7fd20adcc9b5b776a651b503160f9926a9c5b560a85323fabd673cce571e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785684867, "uuid": "3f15acb4-51fb-46e1-bdb7-eab1405bf6cb", "value": "T1D405027C974AD802ED8247B50A65D3B512709F9CF512C363CBF8FDD77A36B6A2848281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785684867, "uuid": "529b1241-ba06-4d38-a3bd-dbd9a30b0ffc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785684867, "uuid": "641ccbf4-114b-422d-ae16-cba1c8b2e37d", "value": "24576:BSpU6nePRa5SDP4iySRZgstup1ytrdj+Ati/:f45U4BotiaJ+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785684867, "uuid": "704ea643-ca0f-453f-afc6-7040ee96ed11", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785684867, "uuid": "fbd66711-f875-40ce-8f3c-a973e1521a54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785684867, "uuid": "3415599d-ac61-452f-8a32-e45c6d1e037e", "value": "RFQ & Specifications.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045a11f5-8e21-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785640788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785640788, "uuid": "29a80dc2-3bec-4673-989e-fc8c40ffeaac", "comment": "Malware payload (Vidar)", "value": "91912c07e3b6893dc8113e77b0923309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785640788, "uuid": "2fd64c58-4c6d-4efa-a4ee-61f6bf2b4183", "comment": "Malware payload (Vidar)", "value": "dc87cc13bad5c4cc715ace4737ac6f303994a68ec8a772067da9765d642e1b28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785640788, "uuid": "ff5b0d89-62ed-4ec1-a889-0193a2a402ce", "comment": "Malware payload (Vidar)", "value": "eed9618dd94b86fe10990521889cabbedc6ea329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785640788, "uuid": "994e764f-8113-4b40-ad1e-30dc57dc8423", "comment": "Malware payload (Vidar)", "value": "5ed381da74e122514795370bb20e1d7cbe721866c79852b330e743f65d99f4d9fd307a15b9cf8af4716971b75ff74d8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785640788, "uuid": "d6db3e28-91a2-45ef-ba2a-d79f61fe06a1", "value": "T17308339403D69A9AC28BAFFD127F0FD3AD5A6EA0725D90BF03168432F1D546BC58D04B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785640788, "uuid": "e059a25a-c40c-49e7-9065-225148ace089", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785640788, "uuid": "5418787a-a948-4bfc-a1d2-e786d82d186c", "value": "1572864:ALdkgowUngb6LtGKXpIMFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB777:A29ng6LQK5BaABZVPArg/bXeB777", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785640788, "uuid": "d0fd528f-3fc9-4800-84a0-0d54f6344c20", "value": 83766031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785640788, "uuid": "086b8090-7e44-4242-a935-20474e253a30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785640788, "uuid": "4cbfc3bc-61eb-4633-b44e-81c6a2779761", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1483ac-8e7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (CNBackdoor)", "timestamp": 1785679132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679132, "uuid": "d26d0185-666c-46ce-9aab-0f47df52992b", "comment": "Malware payload (CNBackdoor)", "value": "ab1d68a3000568efd4c0322a47b08b66", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679132, "uuid": "617d7471-d6c0-41fc-a782-d19fbe91779a", "comment": "Malware payload (CNBackdoor)", "value": "dea2d24eee1c12a4919e7b90e21711775b697b9b418347195d5dcb8dac19857a", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679132, "uuid": "70cb487f-308e-4f54-9972-6462ecabf349", "comment": "Malware payload (CNBackdoor)", "value": "ecdc2022718079778c2d36bf801a1a5e644c6125", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679132, "uuid": "91d4da58-422d-4d95-92cc-df3edce1e149", "comment": "Malware payload (CNBackdoor)", "value": "5341a0eecbef2ada120bffd4e03476ffe85de590e643e563519c532ae6f30574afe103120a0e7c8b86dbac25088f2d4d", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679132, "uuid": "58956947-1616-42c3-90e9-63220852d689", "value": "T1D517331CA8BE884AD55C37B04A02D059D70E5B3B981B086F7B9F663CD61F4038E78B76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679132, "uuid": "68618229-675d-49e0-b5ab-06c91c8c2d59", "value": "393216:rdD4BJwgJfJAQeqKZhSMOZUa+8CGpaahVnTIZRnyxnubo:GLBk1qshIjppVanYnub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785679132, "uuid": "53842d57-bcac-46ec-93a6-cef9764ee1a1", "value": 19017728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785679132, "uuid": "c8821cfc-c69c-430e-b38a-08013ad0011f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679132, "uuid": "355a9d21-445d-4b67-9909-ff340c2e0a15", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2fbddc-8e0b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785631409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631409, "uuid": "f983151c-5601-47ea-8146-83c5fd045b24", "comment": "Malware payload (Mirai)", "value": "0ad4565a180db6beaf5355d806dcb755", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631409, "uuid": "ee80c51b-fd63-4206-ae38-9b87ffc672e9", "comment": "Malware payload (Mirai)", "value": "dec424fc8ec0ec7f4e234f2ed759fd0ad672d8090e62dcf2a2fd3d4d8c90ac92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631409, "uuid": "5792d05f-0391-4da8-8f24-c5065ba95229", "comment": "Malware payload (Mirai)", "value": "be2c263d543eb69d6d74556d314876e43b8d2178", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631409, "uuid": "6d4253b4-8854-4215-864d-85b03a6344c4", "comment": "Malware payload (Mirai)", "value": "f6b16982a9d4d6af7dfe069e28f55067e8397635e0ff2b2e3b78236ab6e30f972363bb7de18d1f6e669fdcd1dfba6eb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631409, "uuid": "8c3b8b9a-adf9-4d83-8ead-5036d65a0917", "value": "T135B35C4273180F57C1930AB02E3F1BF687BBE5D021E4BA89650F9B1A8675E77154AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631409, "uuid": "e7061aa7-0810-426a-a1d9-a44395d19a1f", "value": "1536:3Vbxi0VY3+TmlGzmRRuNfvyJpkw8piKlglnw59KDp93+JuM1+463tLdME:Fbk0VkR8mkMp9Xtd9Cuk2+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785631409, "uuid": "7d227889-b153-46f7-b0f7-e7ca83576586", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785631409, "uuid": "b868d685-fa81-4d5f-b66a-f9c0d8b753c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631409, "uuid": "01e12c14-5096-4473-acbf-fe99655077b5", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd56db9-8e7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785679059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679059, "uuid": "ec72b50c-04e9-4526-8ae5-47d162a0689c", "comment": "Malware payload (Mirai)", "value": "d449dcec12245e1057c74aeebdee7db9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679059, "uuid": "0375f176-d0d4-4553-b761-6b885634486b", "comment": "Malware payload (Mirai)", "value": "df6aebba76962f8ef44da15f929d0f25e7af8428a009f26e2e081435bd912a9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679059, "uuid": "108b908d-c241-4d57-8fba-599ce088abad", "comment": "Malware payload (Mirai)", "value": "660f22cd2c472a387787f46369dabde1bbe87569", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785679059, "uuid": "db6daf6b-40ab-4b95-9d4a-bfdb56525eb5", "comment": "Malware payload (Mirai)", "value": "a42b22f4253df5a33045302fae5107d953809f48679a01eb846aa8268caef871ff9c4a0095f30e755bb4ebdcd51631b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679059, "uuid": "d608b000-09fa-44be-a72f-3ae6b9107bff", "value": "T14E634C02B31C0D47D1635DB42A3F17E183BFA9A120F4FB89651E9B869276E321186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679059, "uuid": "9a145e90-c960-4a8b-93d4-3f23da229563", "value": "1536:jIODpMBfPHVlTJAkw4TvFQLPXsWfeeIF+5yryD/Fhqs/n+5:kqeNhJAoENeeIY5Ly5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785679059, "uuid": "62f8fe46-09a5-494c-8849-04aa2d4c2aa0", "value": 73292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785679059, "uuid": "06000c0f-b995-4c3f-9ee1-885264737ad4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785679059, "uuid": "c7c7041a-e6cc-4e92-8ae7-ff33168bc7cd", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022a7861-8e4b-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1785658823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658823, "uuid": "289cd392-5bbe-4506-a395-3d4d98532cb5", "comment": "Malware payload (SilentNet)", "value": "bc51cdbe6cb657a633696621b9a20053", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658823, "uuid": "d386f678-20cd-4b47-b0b0-0ab65e38c56d", "comment": "Malware payload (SilentNet)", "value": "e2364865eb53943382341b5a7328c7a84f6753e5b4ed43b9562b9ec59e64ef23", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658823, "uuid": "c5f00670-dd83-407a-a924-ccde3813f602", "comment": "Malware payload (SilentNet)", "value": "11204ba69a9c96c0e27fa375c723225d51170a97", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658823, "uuid": "87fc2d1c-f26d-4329-923b-38f921daf9c9", "comment": "Malware payload (SilentNet)", "value": "7b7c39b8aa73d833156abedd06bf668f1164da99f11f1c078ae25a639af965a87aeefdaad63a14b25e1fd66b6c6fcd94", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658823, "uuid": "21dac7fa-3918-458b-aa77-e9dc048c6106", "value": "T149463320D5BD267DD5632730D4820E2B3B8E23C4AD027E2F1BB418B64D476C56FD6BA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658823, "uuid": "2ae6c098-85e9-4ed8-ac59-4266fa8358c8", "value": "98304:LTX66PQGWc8IQYrc16j5E0iG8oEiUygtka0iyLmH800Dx+KyksqYaQ:Lb6SQ/+QR16j5E0bhDKU680S8KMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658823, "uuid": "333aa2ed-376b-4a21-b70e-57835f94a5fe", "value": 5662557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658823, "uuid": "755512d4-5ee7-4afa-833f-34804f1b5640", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658823, "uuid": "013fb919-75af-4070-8827-6424d3cc74b6", "value": "Krypton Client 1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9657f06d-8eaa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785699874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785699874, "uuid": "c2af9d86-035e-4d0a-bbd4-81f4283adcce", "comment": "Malware payload (Mirai)", "value": "e5788a702a9e4b556ccae32e772c939a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785699874, "uuid": "41fdb86e-c184-45ec-8248-ebdeafdbf38c", "comment": "Malware payload (Mirai)", "value": "e731201a0924332f0b694e1e17958b4c70f274b22ad0b80a8face370cc921549", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785699874, "uuid": "54f4dac8-49c9-49ed-929e-9d9cc811cd33", "comment": "Malware payload (Mirai)", "value": "4d782e5387592222f8f730b9cf53a1ec43d8180e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785699874, "uuid": "c6f388e8-f503-4ae5-8f9a-a013f8f957fb", "comment": "Malware payload (Mirai)", "value": "6573760d5f9a285d218f129e2b47e08d0f0231a22bd85eeb4e395a6e3b9fd5a4d6d6c6316f0b18a51aeaa2618ba4eac8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785699874, "uuid": "bb2217e6-eb59-4384-b951-707b6582aa64", "value": "T10CB4C08663023D3FE0B3893A80EA4F17A735D784558327473169F9696923AF86F316C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785699874, "uuid": "ba61f09a-de58-4a8d-aa16-d38e3db73775", "value": "12288:OshrdnYE1p2CluL+m6XAjR1JuMNB5VLhV+p:OcdYE+Flmi73Vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785699874, "uuid": "beeeac1a-1192-4977-9acd-fafe16434e24", "value": 509924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785699874, "uuid": "7ded43da-db89-4194-a698-c953553150b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785699874, "uuid": "05a52f51-41fb-45c1-a79a-48fdfe03ba7f", "value": "xd.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d27f84-8e0e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785632788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632788, "uuid": "5eb4140d-4de8-418d-8e81-c692d6789467", "comment": "Malware payload (Mirai)", "value": "3531dbb844fa5ae9090ed92018e1eefe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632788, "uuid": "e906c67f-7f7f-469c-ae2e-6170366f2c43", "comment": "Malware payload (Mirai)", "value": "e7a21d0bb71be7547e411b75de1ea32a40966965543172d8e6693da5ac9a5f7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632788, "uuid": "0dccea9b-a3d0-4ee0-a39b-5bc4dc537065", "comment": "Malware payload (Mirai)", "value": "e5f822ca06e8026b8fb36babf8fa834202fd9562", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632788, "uuid": "6644b814-3bb3-42c3-85ef-2edd7a6d4734", "comment": "Malware payload (Mirai)", "value": "c341f8ddb2ab61efc14eb43a3e9bd4887d1fec0d9af2851b909ee2b307d6281529ca49313c48b2922c43d2aedf1c2341", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632788, "uuid": "c900cbfc-43d8-450e-a1e6-c64cf78f4a6a", "value": "T11BC33A85F8828A62D6D7237AFA6E128E372163E8D3DE7103CD216F2137C651F0D67991", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632788, "uuid": "4f5f5c1a-2061-46cb-862a-6d8df9fc6d31", "value": "1536:m57SbTR8mhSHxP0Pizl0+doQ/v3y6x8jdYkC2DyFwm3pB2P8xvoL:m57WT1hwau3yW0Yr2DxUBoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785632788, "uuid": "93824227-2f17-4bb1-ada5-9db1477eb438", "value": 120300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785632788, "uuid": "3713dc90-ad7e-4a51-98a6-7b3991f1235a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632788, "uuid": "ea0c2c96-560d-4396-8bf0-211ac75c6218", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6afc31b-8e47-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785657462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657462, "uuid": "e54a4483-a070-46ae-9738-6a001265f433", "comment": "Malware payload (Mirai)", "value": "55ee253f78a89c28060c1f910f39907e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657462, "uuid": "2cd7926c-e169-49f7-b82f-fe71346b665f", "comment": "Malware payload (Mirai)", "value": "e7bafa13cd6341c27abd8e34f0825503fb36a5ba40d402382b6a40f160cf01cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657462, "uuid": "206363a3-aa63-4c6c-8e9f-84b5f3bac90a", "comment": "Malware payload (Mirai)", "value": "f49b2d4361a4e6166ed4d35625cbe28bc1b54a33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785657462, "uuid": "14fc0a57-35d4-46ce-990f-1419a625fe06", "comment": "Malware payload (Mirai)", "value": "e023d5426602ce7cd597542d055836d422c6ae8c719c1dad0399f5768238fe9553f8adc475f89125014c5cf0fef2719b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657462, "uuid": "60b235e7-4c0b-4cba-a169-f1b7646552bc", "value": "T1AD734B22BA751D2BC4D4E87A61F30321F2F2478A25ACCA1A7D720D4DBF65A4032577F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657462, "uuid": "43e78a3c-8844-4771-a132-9a2aa4380ae1", "value": "1536:nJxSUCuRy82KFEFfkLaxQ+tBPznN95YYsP08tu8/1e:JIwaFcL2DDNPVSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785657462, "uuid": "8cf770ef-1824-47f9-9d22-6c6f7a398d74", "value": 78952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785657462, "uuid": "1b947d80-0f10-449c-9d3a-2824ef493aac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785657462, "uuid": "0ce426a9-0035-4c68-a6f1-a7270dbc715b", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34984205-8e55-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785663203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663203, "uuid": "582c066d-3e9b-4115-8659-b2f1178dc88d", "comment": "Malware payload", "value": "2221b3b7ec59e22c400d1727b7a2112b", "object_relation": "md5", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663203, "uuid": "1a94bba4-6b84-4fe8-a25b-9c4eeb99369f", "comment": "Malware payload", "value": "e911b6bc7704a70fc60262a084813ac5ef49739ac95660d42e26c8818c044832", "object_relation": "sha256", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663203, "uuid": "0ab4edfd-e20d-44af-bfec-e990d4f73e68", "comment": "Malware payload", "value": "fd330063fa1eccbcea1c2d41828595f5a510d3a1", "object_relation": "sha1", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785663203, "uuid": "9a048f1c-cc29-4b1b-9d1b-dffa92eb619b", "comment": "Malware payload", "value": "c55dda921c0e77dab3fd3910e59033fadf5d2da242b6128e42f7c057ada99199bc885249f35daca39f56e7e25f6b160a", "object_relation": "sha3-384", "Tag": [ { "name": "89-124-79-98", "colour": "#96D0F2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663203, "uuid": "db235c45-ca13-45be-b495-a42e7b84956a", "value": "T1A603BF2383880AA9F8889EC44158632B50F6D55E3C65084CFFDB6BC7FE3D9596134BB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663203, "uuid": "fafbb24a-99f5-4151-bd67-dd2830455d02", "value": "768:FwJlzWQiP+qRjgrbBFXMbWkisTa7W4fK1Ua2NbIXglrwsuc:8fp2ObTsEW4fK26gZVuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785663203, "uuid": "9c7005f3-7fc8-4796-9f33-e64f5e772a64", "value": 39487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785663203, "uuid": "ba038979-f7fa-4aa2-810f-b4fbe871d834", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785663203, "uuid": "5d36720d-d334-4245-b42b-937ec413e772", "value": "ACER.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e07ed4-8e0f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785633378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633378, "uuid": "f20898bb-d3df-4c2c-8093-7735052636e3", "comment": "Malware payload (Mirai)", "value": "1553b2eca1d147515a25763f0c3a17fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633378, "uuid": "0cd02889-8b76-423e-b214-ac3b2f042c25", "comment": "Malware payload (Mirai)", "value": "e9a42640b2832e6b4fab461e57d07f99cfb0f8428d64862e887206ba3a9e0b4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633378, "uuid": "8fc5800b-2ddf-4c73-abce-f0d53b9cfd8a", "comment": "Malware payload (Mirai)", "value": "ade95c873c4e8613895ccc5cde5ca0740858d870", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785633378, "uuid": "93621d4b-627f-4b10-a0e2-304c7e93540c", "comment": "Malware payload (Mirai)", "value": "c7200acfe51313c0c10549241babc07c7336496af953fff6977b7239f844a204469d3f47e7772b98542350573e1adfd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785633378, "uuid": "958ba476-fa39-4930-bf49-f71fc433c20d", "value": "T1BE13F122EAAA8444828E01FD84373D5D4109F84E65548FCFABE023E7D90EB7354BD9F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785633378, "uuid": "fadb7a04-77c8-47c4-9225-f1be4d787e99", "value": "768:2gDoFSJjBGqGPCcnFpAKGB4Dl0sMy/hqGX99tm7BndWnbcuyD7UoQRjg:WGVDGPXnEB4GsMy/h/XfuB0nouy8oyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785633378, "uuid": "01d7f8d2-183f-4f92-b3e5-f4ca74ac9563", "value": 45072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785633378, "uuid": "3890c494-ad0f-4b0b-824d-d7143555aef7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785633378, "uuid": "e68eef58-3efb-4c45-8d95-c92d85a74da5", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605e6442-8eab-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785700213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700213, "uuid": "ba370b7f-c3ea-4eb4-b183-69c2aa9e8ab0", "comment": "Malware payload", "value": "f43f81ef4c4cb8a5c210c25362f41eeb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700213, "uuid": "eb1c183e-dc71-4f10-833d-33a254c433a5", "comment": "Malware payload", "value": "e9fe35015e5ef9a7d7d0b07b5fee72f2bc55882175447bfe8a5bb7da2535101a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700213, "uuid": "c6e7b584-4f96-4af1-8597-1ae9c7f100dc", "comment": "Malware payload", "value": "fc8f0d5af29e8434e98531e8e7dc0272ae2eaac1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700213, "uuid": "565ae009-f6e5-4852-a8e7-62184c8c52ca", "comment": "Malware payload", "value": "685ccfb74137cd20cb6b24acf22b251a33b0935ca6c0597bae7efe882e5e09a1d2ba28b7d96c08418387ce2c95cff3a9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785700213, "uuid": "7eb06848-e31d-4609-90b5-60695b5e1d68", "value": "T1AAF08BED949640323F0D543775194C552602082F24B95BDD224E99635E0CFA8235EB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785700213, "uuid": "48e78a6a-c494-4576-a6a8-dffe3713027b", "value": "12:ZsU9jWijWr5jW2FFl7jN/OQrNaQJTERE5YXmY6uYCYEeyH:Zp9jWijWr5jW2Fr7jN/VsuBYXmYRYCYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785700213, "uuid": "e6e23137-3d6d-4f9b-8aab-ddb65a37f266", "value": 529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785700213, "uuid": "14136adc-d457-438f-8cd4-7e431955b675", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785700213, "uuid": "429647fa-3e1e-4671-acc2-6a9067375c33", "value": "sensi.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4561d85-8e35-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785649754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785649754, "uuid": "a5e533ec-1b04-47ee-8f46-0c674f5ff4a1", "comment": "Malware payload (ValleyRAT)", "value": "ac14f6dacdf01b8257412a33709a2891", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785649754, "uuid": "e2b6d4d9-8c2a-4c0d-8f5c-14920b9c96ee", "comment": "Malware payload (ValleyRAT)", "value": "ebe31ad40a9ce206268d9f355e42ca4979847bfd861b3d157c06ed1bd842219c", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785649754, "uuid": "e377539e-3d75-4dbe-a593-4f1d6173c479", "comment": "Malware payload (ValleyRAT)", "value": "acbead7f0fbc8b7b392f2edb91c1a7ed6f9d96e2", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785649754, "uuid": "4a9d76ca-3c99-4867-ad3c-fe34bc17934c", "comment": "Malware payload (ValleyRAT)", "value": "d44a3df3483c62f3e477d6b43b9eb5823ad60e7a911e9e54d7b032a08ef79a3c1ef42caa27e57e047734b1043372755e", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785649754, "uuid": "bacee987-4f9f-4182-87e3-a7b58830291d", "value": "T15E0733BC90D04791DACDADF3ABD997077C354523546EAFCA05826C28860F7B2B2F612D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785649754, "uuid": "94292a87-db26-4481-9e17-d23a84ce6031", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785649754, "uuid": "96acd02a-0826-42a2-9bc6-f7b29d972895", "value": "393216:2MkEDpSeSLpw9LI5VUHbHfsJwB8RAYhUl+LgeL7xrgz:2pEcvpa4VUHwuBonge3xrgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785649754, "uuid": "4506d477-3df1-4f05-8003-f933c207096a", "value": 17025035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785649754, "uuid": "b29b0a09-512f-4c6e-8785-4caaa45494bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785649754, "uuid": "f75ac500-04de-456f-b0f2-83d15bbeab56", "value": "Huorongt_12.8.1_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1e42ea-8e4a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785658573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658573, "uuid": "a67b20b3-83ca-4e7e-8496-a2f43011d3e4", "comment": "Malware payload", "value": "72b341521d22ceb4d5f2aeccf213ac3a", "object_relation": "md5", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658573, "uuid": "03eed1ee-f3fc-4218-b45c-28a1ceda43cb", "comment": "Malware payload", "value": "ec0891a2260e38475d2948692f4243430a88c1b849a4c4c8c69220b49ce9c5b3", "object_relation": "sha256", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658573, "uuid": "2f9a88d8-71a6-40a4-898e-7efea908cc7a", "comment": "Malware payload", "value": "35c8d1275df3dc0228d10e3f399b3a18a4fc8a9f", "object_relation": "sha1", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658573, "uuid": "8d0e22e2-9e4d-434f-b9d2-3daf95cf9b20", "comment": "Malware payload", "value": "caef9057aafd29cf5f01c9ae5325be1395d2fc73c19f29b3c3ada265b046b74d31c871ef411a629e593d5613f5a62cd1", "object_relation": "sha3-384", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658573, "uuid": "1c309bb1-b2e3-4c94-9e05-3531a14d096d", "value": "T1B9854A13B2856139F09B0E3E8927A584993F777342018C87A7F45ACCCF69A536A2D377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658573, "uuid": "78185fe2-b2a5-4bed-8b15-82eb7883f704", "value": "1f365d4e2c37b47fb208b089b5f61d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658573, "uuid": "55bb65bb-e753-49f1-addd-33c145b42f47", "value": "24576:D1v/FzzBX5jCMjQCsbuQISmaYJPshPK3By2Om9Mz1dAcFQU2:DNZOI1ewy2OzDAcaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658573, "uuid": "6480ed2c-f08b-4308-8850-f2b427ce0c56", "value": 1809920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658573, "uuid": "91f33f24-9d80-4d8b-b2a2-72060d31a1a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658573, "uuid": "05c7bf29-b9c8-4851-a488-cbe99fe41250", "value": "ec0891a2260e38475d2948692f4243430a88c1b849a4c4c8c69220b49ce9c5b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7390fa01-8e2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785646128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646128, "uuid": "1e8ad6a6-b192-4d4e-82d5-d316954d020d", "comment": "Malware payload", "value": "697debc15c15ab6bce6c0068ac6b37b5", "object_relation": "md5", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646128, "uuid": "c913a741-6ff0-40fe-a98d-ecae0e094eef", "comment": "Malware payload", "value": "f1dd856f66a38cae3488a9f077c4cc8c27445162e512cbb73770cac27436d869", "object_relation": "sha256", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646128, "uuid": "7a66a8c9-79af-4121-a000-5563ee5a8e9e", "comment": "Malware payload", "value": "0805f859e3f2c985f3ac785be05054fedfe55ca7", "object_relation": "sha1", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785646128, "uuid": "1877c8b9-5a8c-4e50-857a-440b50128541", "comment": "Malware payload", "value": "6faa477192389412c09b0868b7fa8b56a5461aec4f6b258d514db2dbf93823993e15e95e6855b48a3312c8ed1d91ea0d", "object_relation": "sha3-384", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646128, "uuid": "2037d32f-e7d8-4284-a03d-bf76f1d65866", "value": "T13CD523EA65F25C74C836CB72DF03E47DB069B7968B229E13B7C8A9409C562409C7B371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646128, "uuid": "d3284f83-d116-4fb8-924e-79ae6bbf8174", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646128, "uuid": "dd87bba2-83a0-4e90-b1f6-5c9e1eae36af", "value": "49152:Re7ZoLEmkoljX43U+n8wzMlEgIIheVzWSlvjAmSis0Ms0piDs0eeS3C:8ZorkoljH+8hlEE6SShjPxPVs0ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785646128, "uuid": "0e947133-8eae-4767-b317-d22c8419168e", "value": 2932224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785646128, "uuid": "a067c398-1e9a-45a1-b4aa-769f317fe255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785646128, "uuid": "1439d483-12d9-44ad-922a-f635b7377009", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b620cd43-8ec7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785712383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712383, "uuid": "ae67d4af-e2b4-49aa-a943-aa5d7b7bd38c", "comment": "Malware payload", "value": "7ccbf4dccac4bb7e5cd7b9c3b6513c75", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712383, "uuid": "f4b1e13c-3370-49b7-bbc7-5c19e9ebdd81", "comment": "Malware payload", "value": "f1e420fee19df82b35d05e445eaeab7cb1e8998665794898e3c0049b7cfde7aa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712383, "uuid": "82cea5d0-1b12-4ca0-ba71-45c460e754da", "comment": "Malware payload", "value": "1578cfef86c5ad6eedd87f65ae598026c16acd7e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785712383, "uuid": "5b6e2c88-7565-4139-9be4-3227e93ae3e6", "comment": "Malware payload", "value": "fd0b8ea612ece442a750c22ecd6763f99e0dfa7060d00145eb5fd7db9ff0c2f2b434d72ab91eb916cfc48be930c97bc8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712383, "uuid": "a9e07ecd-947f-495c-a030-d729918ec128", "value": "T16B019CCDDCD54170FA488A2A75BA6691E34D694F48C82E0DB01EDBA0DF4C961B21B737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712383, "uuid": "0ac2152f-23db-4bd7-a77d-9010e2f381e7", "value": "12:8e9LxyxA2XdG06P91KQ1KN51KUFFtTHXYX6QyTkyMxS:8e9FyK2Ul9TqDFDTHydyTIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785712383, "uuid": "c16520a3-1ebf-49d0-8db8-a5f532857d99", "value": 788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785712383, "uuid": "d9eb4fc7-e2ea-4ead-9d82-fdf38e7b9ff8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785712383, "uuid": "9f5c919a-fcb6-4e31-ba6b-afc2190eb444", "value": "gpon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f88aec9-8e0b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785631411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631411, "uuid": "fa52f48d-b705-4df5-b602-03962637d32f", "comment": "Malware payload (Mirai)", "value": "a4f0e91461b5bee890b1fa320346ffa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631411, "uuid": "7993c4bd-a681-4bed-8fd7-04b31f018c5e", "comment": "Malware payload (Mirai)", "value": "f38943d7da545cbb1771b7934a42e2ee9677986d671d12896b18235ebb894394", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631411, "uuid": "290380e3-3d02-4652-a4ef-93d3b745e052", "comment": "Malware payload (Mirai)", "value": "d6183438b6546a676742b4c0761dc6398d529105", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631411, "uuid": "20681975-68b5-4023-aa50-5fffeabf56e2", "comment": "Malware payload (Mirai)", "value": "59719253ebd60b94de3fd63950ded96e2b6754b60bbe5ed2a7ea3c87d6186c10ef4f721b22a69a77df658a9766f328ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631411, "uuid": "f401cf74-f9f7-4f19-9910-6d94decda026", "value": "T16724B84F6E239F7DF67887344BB35E25675923D623E0D684E1ACC2105E2029E581FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631411, "uuid": "0ce130a4-6b35-48a3-bcef-f316342af64b", "value": "3072:eq0AsDTvciQzHFBtcS/tfFu7y9cEwDIklS:J6TeH3tdqy9JwDIUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785631411, "uuid": "c43eadfb-364d-4060-a08b-f0d451b8937c", "value": 210264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785631411, "uuid": "7126e1f0-61f3-4b10-9a40-86ceb87e8ea3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631411, "uuid": "36417ee9-20e2-4ca0-8ec8-a981c00fe1af", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274ba7b7-8e0b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785631398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631398, "uuid": "7fcf6d7e-9634-46bc-8ff4-df2869e84df6", "comment": "Malware payload (Mirai)", "value": "0b5f3e31b64463bc4e5cf572363c3f2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631398, "uuid": "fb7f7ad2-faa6-4818-bde8-005c6ee75c2f", "comment": "Malware payload (Mirai)", "value": "f47c9c3d3efc98916fb74aa908075ffadf39b219dbdd7fa17d3da24ea77322cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631398, "uuid": "136497c8-0aeb-42a2-85d6-97b22cc73a11", "comment": "Malware payload (Mirai)", "value": "7de31467c01f7d659bf16898c7bd8653421d2113", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631398, "uuid": "7f389e3a-86f5-48e7-8ec9-0d75d9bddbc2", "comment": "Malware payload (Mirai)", "value": "8c5daa2adfe0d8c74bba977e5e09bdad992fa30ca755c07ef4fce4c616a74bd17f1443b3b5fb315e3f47441ac5f437a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631398, "uuid": "ebb74a80-31b8-4f0f-b00f-f899bf707bea", "value": "T16253025438065BECFE05C27C91E107A829A79A765272D42B28C8CEA3DF5498C3D5BFE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631398, "uuid": "a985e4b8-307f-4604-9f20-b6966cc3c17b", "value": "1536:KxwOGojcwOACygI8XgHe0L/JhWklXKxyXc2baVJu7:KfGouy76gxzHWCXMYfOVQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785631398, "uuid": "fd92c02e-935a-4407-a37f-a34ab056a49d", "value": 60948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785631398, "uuid": "1469deee-1593-4329-b974-b356d5145e9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631398, "uuid": "2e11f84d-64fd-4cb7-9ef5-f2fd5458cd3f", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb6d562-8ea9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785699564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785699564, "uuid": "c8e1b14d-da1a-44c7-bf7d-0c113dd2f6f5", "comment": "Malware payload", "value": "669e74c08eb9d7cbdbf135497f9f46f0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785699564, "uuid": "4aa8a154-dad3-4a27-bb09-2a6ad46b7f15", "comment": "Malware payload", "value": "f51484af77409f59acb111f5a88417d7a8890591050aa51ddf0102fd1540aaf3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785699564, "uuid": "fc10c9b7-9ed9-4e68-afd8-cfa03b332ce8", "comment": "Malware payload", "value": "5111da6cd9bc6346181a5238d75ba7b6ee884bf4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785699564, "uuid": "c1a64dda-ebe0-42b6-945e-9e6cbc8374da", "comment": "Malware payload", "value": "5b1e3d7a9eb8d4b94686e1de4c1689a465a8d644d19512d51f9f7c232443fe036248a1bebdb62b4c6b398c7d1a203f21", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785699564, "uuid": "78d3dbe9-5f3c-45c6-9aec-655d7361f4aa", "value": "T1A5235C5516867C24AA99C8361C7E2F0CB9AD43E6324452EE7FCB3CF28C4A6ADD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785699564, "uuid": "f8aba9f3-1731-4780-a230-7ee47cdb3771", "value": "768:BHl+H9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:BF+wcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785699564, "uuid": "49708e04-9797-4a66-a73e-e1044341d19c", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785699564, "uuid": "35f36bec-7fea-4832-a8f8-47798493058f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785699564, "uuid": "9a3871a3-11ab-416c-801d-0a2108906b32", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a9bb76-8e4b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785658993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658993, "uuid": "de7529b5-a90a-4624-8c45-e1d278031bc5", "comment": "Malware payload", "value": "e98ae77afdd2045a67c96947888d0b2e", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658993, "uuid": "6d0d2906-ddc6-4929-b2b9-a8677be743ee", "comment": "Malware payload", "value": "f57ec2d22472e3231c8917540cfbb54cb7eb387e664d1ddbb80e31ac318accf8", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658993, "uuid": "a8e9caac-47ce-474e-a767-79c801d099f9", "comment": "Malware payload", "value": "a4161c2219bb4cc979feade8b55cc36dbfef7b9e", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658993, "uuid": "444f8bd7-0777-439a-b1b4-e198328133ab", "comment": "Malware payload", "value": "4d1c3f361b7d20c98254b7f184d577c7a98932440ec6c6540c71000bd13b44e5c48c82263ffe6b69138d924d52feb45c", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658993, "uuid": "815a1abd-522c-4287-9763-ca92ec9e815a", "value": "T13008338A6E22B07FF813D473D11962E9635AE545D733CFA6213F91DEECA26007B440A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658993, "uuid": "419dd833-c834-417b-97c7-ced3c776850d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658993, "uuid": "9ab38101-592c-4d5b-a9cd-aa5fdeb89fe7", "value": "1572864:+S2um44Hif+FM2zg1nNHG3cv4JW4/KMYAMvJmiftzjPzcsZM2AWUQriXyL:+STm4vWFMP9NYJo+sUifljLcs22/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658993, "uuid": "46d3c850-2200-4ee8-84be-70f70609f758", "value": 81903570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658993, "uuid": "da8a6617-3436-48d7-9020-236d6acc997e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658993, "uuid": "52081d14-3475-42ce-84ee-05334df8b1d7", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c270e5dd-8e69-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785672031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785672031, "uuid": "6644e34f-0f08-44aa-855a-24fa22f08cfc", "comment": "Malware payload", "value": "cf6412d61e9aabf2d37ae39d68ad86f2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785672031, "uuid": "8a6ea2d3-a808-4303-9080-883a8d6d4a6c", "comment": "Malware payload", "value": "f657468ca72b9ab3b8e3dcede90fb41593d5b7eb58e02f507b33fd11167e9b32", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785672031, "uuid": "657a6236-f6b1-401e-b598-7f082fd030a9", "comment": "Malware payload", "value": "dfc976106cf0ad43c880137619dd62ed662926e8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785672031, "uuid": "35278fc6-da23-471e-9882-95b240e118de", "comment": "Malware payload", "value": "f391eb402a6ddcb3135ae61501d2e45e76d72c63ebb91ec2261c480a996bdc564bd3c266482dbc7607419398ba6baa3d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785672031, "uuid": "384fa224-bb3f-4764-9727-a68565ad8776", "value": "T10E235C551A857C24AA98C8361C7E2F0CB9AD43E6325452EE7FCF3CF28C4A6ADD10571D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785672031, "uuid": "c8f377e6-ce52-4249-b56e-2a8e29f58e8d", "value": "768:il+j9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:4+kcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785672031, "uuid": "8d4c5772-18b8-4af9-b579-ed955a11dc75", "value": 50035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785672031, "uuid": "32648864-76d6-402a-86e2-aaed75deca6f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785672031, "uuid": "94d46979-42b4-4d48-8c40-6fd89e041b79", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43caebcb-8eac-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785700594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700594, "uuid": "ea312fcb-fe8d-4b8b-8240-9add332726bd", "comment": "Malware payload (Mirai)", "value": "0d26b9c07506277b333c59717889565a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700594, "uuid": "9dfd0d30-21e6-4bba-9699-b5e554390e61", "comment": "Malware payload (Mirai)", "value": "f73e07daa7a1016efd4ee10266960549d4e2f85d0bc840d4c6a0a632e19e6c05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700594, "uuid": "1e530608-60a7-4cb1-9848-a7fd88021f0f", "comment": "Malware payload (Mirai)", "value": "599261168e55439762d3525bafe293333e84b5ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785700594, "uuid": "01159c45-b852-40cb-b3e0-66e815f28987", "comment": "Malware payload (Mirai)", "value": "764a84339a4f888ddfb0906863331b1e8e720d3122399335e37569abc5410c3af52b7ce4926f0c6e02dba32cef4a0b8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785700594, "uuid": "11dba3fc-7853-45f8-866e-c51495ded331", "value": "T1BDF45A82FF1C0563C9570DF0293E43E5F3217A9240F98239371E5B572622E76AAC779A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785700594, "uuid": "2d585d06-373e-4c98-8788-c1a0ea17352e", "value": "12288:ilnmKEVm7gNYIosWSjigaKpZcGuyIFhuI1EOvpepTTS/Q0f:mPEVm7gN2SRaKsFhhELS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785700594, "uuid": "25e8dfe0-f6ee-437b-af32-7d77c904282b", "value": 726984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785700594, "uuid": "6cf30f68-49c5-4251-bec4-4765fe0fd89a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785700594, "uuid": "d55f7d54-91a8-4994-812b-a4c63550a782", "value": "xd.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a5631e-8e4a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785658795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658795, "uuid": "2af1a61f-93b0-471a-8451-1d1becec732d", "comment": "Malware payload", "value": "5bd012ada726a51878173918115fefab", "object_relation": "md5", "Tag": [ { "name": "104-2-42-61", "colour": "#8D514F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658795, "uuid": "fcf52509-8ea9-4b8c-b9db-4ef70422c0b7", "comment": "Malware payload", "value": "f7cc27e73c25b2427f443d5c0dac964039177f1c0387e75405df2c0fbc88c9db", "object_relation": "sha256", "Tag": [ { "name": "104-2-42-61", "colour": "#8D514F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658795, "uuid": "a3545157-47c6-4092-b52e-fc0100eed0b8", "comment": "Malware payload", "value": "68a010ecfa1dfdf4acd8cd5e485bd7a9fd97f481", "object_relation": "sha1", "Tag": [ { "name": "104-2-42-61", "colour": "#8D514F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658795, "uuid": "a0091ff1-1541-4524-808c-393f818713c1", "comment": "Malware payload", "value": "c0ae9f9533d04b0213733ae45a33d273a6cddbb5a670ccfe7f97e21f57e69f4e25e6294b246119b8ed1c1df95cd80004", "object_relation": "sha3-384", "Tag": [ { "name": "104-2-42-61", "colour": "#8D514F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658795, "uuid": "5036e242-73eb-425a-a2d0-4f9657747e64", "value": "T16C3199003EFA0620F3B7DE728077A71489BBB85ACE10CB1E408006481077A00E17EFB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658795, "uuid": "0d881be0-6982-476f-8f3b-2f460cde4548", "value": "12:8rlfyOm/VnEXzQK9+a+UsIeaMyDjLfoilVubdpYrn1IlI7GXuHbLn1Il:8YPtneka+vy3LgAqddNXuHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658795, "uuid": "cae4134f-92f6-4ff9-aaf3-09c2cd2e1de3", "value": 1505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658795, "uuid": "874bcf3d-ed28-4a8d-87a9-84e2f563de29", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658795, "uuid": "f15f8b3a-45ef-4a57-9b4d-f65522fac314", "value": "f7cc27e73c25b2427f443d5c0dac964039177f1c0387e75405df2c0fbc88c9db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a91af71-8e4a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785658569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658569, "uuid": "ecbff8c6-76f1-4079-985d-5e9fb43bd7d9", "comment": "Malware payload", "value": "83bc8de74ba1fd989b9ccda6d04103b8", "object_relation": "md5", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658569, "uuid": "6d42ad4b-8d20-499c-b4b3-8969079fd949", "comment": "Malware payload", "value": "fa4d699db3112a87eea7385944464ccf116709bb5b18921252e869c3604cf227", "object_relation": "sha256", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658569, "uuid": "2f7df343-a769-444c-8175-f58c85d4b1ee", "comment": "Malware payload", "value": "f0bffa28f4c6e6da60d6fe0d13f805c185148ac2", "object_relation": "sha1", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658569, "uuid": "90ad9348-4e87-4dbc-874c-5a10856508a3", "comment": "Malware payload", "value": "f563e7cd41f1124743258b12243078e7a03901aea2fbe1657d78574e0185541d4c59859c509511dc735ddfa319ef350d", "object_relation": "sha3-384", "Tag": [ { "name": "217-60-195-192", "colour": "#7EEE38", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nfe-boletos-notas-com", "colour": "#28C958", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658569, "uuid": "94b8c83a-c9c0-4dcc-ad46-71fb28a34369", "value": "T162856C13B389B93AE06B0E3A4927E544983FFB716906CC07A7E4094C8E3D5546E3E6D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658569, "uuid": "1ec454f8-d369-4c07-9ceb-475d359c4f3e", "value": "1f365d4e2c37b47fb208b089b5f61d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658569, "uuid": "31975afe-2a21-4141-9ac7-e5061e29946b", "value": "24576:17zJjP252w/6rutl+fbfUpTQ2GlQn1dAcFQU2:Flxc+f+U2bDAcaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658569, "uuid": "65e7d2c0-bbcb-4e30-9e57-caf8d4f2fada", "value": 1809920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658569, "uuid": "2ad96201-fe49-49f8-b4f7-6abcca3f5248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658569, "uuid": "f1cd2de8-5b66-44c7-8693-3904799fa06a", "value": "fa4d699db3112a87eea7385944464ccf116709bb5b18921252e869c3604cf227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01475d53-8e2d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785645937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785645937, "uuid": "1ca04cca-c3b9-4e9d-992f-5d64394d253f", "comment": "Malware payload", "value": "7aa60530eef290f1fed0e8f89706202f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785645937, "uuid": "5779874e-6138-4dad-bf9c-6ef184f86d52", "comment": "Malware payload", "value": "fa762f03d64d6d568b3155c923d4c94a82652a804bed6a52a8fbb153c88bfcb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785645937, "uuid": "5727f437-f01a-4f80-8a15-4bf1cd96f58c", "comment": "Malware payload", "value": "9cac86bb34b7056e6e8d7906f8158abe49512538", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785645937, "uuid": "16f87568-16ac-48af-89a0-1951bf815b58", "comment": "Malware payload", "value": "7ea69f4f6a451814dfa236d3f8ec673e6d935e1e722bffbaceba316fd3c15843df7e26a3a0e96198fad1f670fa8d99d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785645937, "uuid": "ce6c266f-683e-43b5-8ed7-fcc043c6189d", "value": "T18EE623FA54D532F4D9C74780A24B57CE71E1A05D4AAEB82D3BC71C429931E8B828DE37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785645937, "uuid": "afce5059-a0fc-4f68-9b27-10bc15be9a36", "value": "ce4a3f0960b9d681f3164ddda2742e21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785645937, "uuid": "6b8766c8-0165-4311-ae87-6bc9a6bdc7ae", "value": "393216:auGM6T7739BUwX9UOWue5PLWrusk+pMCruLzAphAMl:apMS339Be51RszpMCrYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785645937, "uuid": "642cf7ef-57fe-473a-abaf-7705da399829", "value": 14959952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785645937, "uuid": "63632cda-b0c8-4e6d-8a46-4f3a170a01da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785645937, "uuid": "d05f4068-7193-4c03-9388-7bd1e545198d", "value": "resight-v1.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac7e345-8e9f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785695291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785695291, "uuid": "701e3ee7-5156-4783-aae4-356fbf8ff9ed", "comment": "Malware payload", "value": "7ef1b6156debab0301ffc1dbea6227ca", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785695291, "uuid": "e1660752-4a8b-4781-96f6-5cd19ce036c0", "comment": "Malware payload", "value": "fbbb632f5eb001ae9e45b6d47d388e78de432a08a8366b111c98fc952c482cb7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785695291, "uuid": "d78a65fb-7418-47c9-9b64-04c88460c96c", "comment": "Malware payload", "value": "4dfc28af216b6f9a7edc09b4b45901daf2ade90a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785695291, "uuid": "56a5a03e-f4cb-4dd5-81e9-898aa6f7c936", "comment": "Malware payload", "value": "21418063ffa1c5d630118cf78185ef05b5b1319803d336db8ac034fbb1ece3c82b5a446bad6d6d7d9ab37d0f7d5d33c7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785695291, "uuid": "d0f63ff9-e2e8-4253-a348-551905febf36", "value": "T169A63382BDCE23B0D18BD374A50A659E38683FD9BAB258417ADD72012EB37371379750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785695291, "uuid": "a7bb87f3-fc3b-4515-be75-7f6f2af30a1b", "value": "196608:l2cqthMixMRIa2mMtqn0IWK8HtDkY/HlYkW222C0RkyWdTOEnwEhPy6A7M:ltLIMHH4DZx97ahOQw3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785695291, "uuid": "2ed5a64d-d099-4632-885b-fc38644fbf52", "value": 10321920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785695291, "uuid": "c57e829d-a409-494d-91b4-ebb1b56e58c2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785695291, "uuid": "89c5e198-cd9c-4562-985f-4d8b88107861", "value": "install_ehe006.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c0e89e-8e9a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785692969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692969, "uuid": "a0ad8ab8-f1b6-4d7b-9b6e-14228e5e7e20", "comment": "Malware payload", "value": "d54564b71fbd16a14eef1a7db3d9b52c", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692969, "uuid": "57870ddc-419f-4a80-af06-b2ea581fab20", "comment": "Malware payload", "value": "fbe92013eaeb2808f5b9b7c585d2cc3af5b884cc424e8c3b49fc54ebaa1264f3", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692969, "uuid": "36c1e28c-d9c8-4cf7-89f2-701f28c43284", "comment": "Malware payload", "value": "a6161a4ce9f5c8b6f01cfa9acc83519bd69f8e16", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785692969, "uuid": "953fe209-b204-41c5-9a0a-601bc93d1388", "comment": "Malware payload", "value": "05c0340f35739fdf243dcaa92cff5f58148e0e66341a312821eb6bd6642b7ffb1506f68a0694b57232a99aed8d3f4583", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692969, "uuid": "58e2eb3f-a8b1-4774-b479-9815de3a5e07", "value": "T118D523DAA8F20EB5D47FC7728F52F8AD706937948A710D5BB2CD7A008DA24585C363B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692969, "uuid": "97372e90-6c1a-418a-b26b-8c49ed33ebc8", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692969, "uuid": "aeae50cc-660e-4725-8c05-216c6fa064c5", "value": "49152:Wwx+/t7QWOAguYssS19OkbaVGI54zydvkLgjVmh+YXwPmv+2Or9EWtC7gngf:Ww4tvCuQ+9Oka4wvk3+YAb2yarg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785692969, "uuid": "c0dcf9da-ef02-4018-b1db-0ca31271f77c", "value": 2930688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785692969, "uuid": "ad7fc1fa-ca4f-4e94-9685-39e10c8b293e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785692969, "uuid": "db491c2f-baba-4827-8078-38ee5f0d7eee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e59f15-8e0c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785631951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631951, "uuid": "83d4ca9d-a694-478d-bd29-333847e2a17d", "comment": "Malware payload (Mirai)", "value": "c679ca7fcd82f32680166b57fd6ad14d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631951, "uuid": "a72d5f4d-7382-4ff8-8d94-6706a8949f39", "comment": "Malware payload (Mirai)", "value": "fd4746bedadaf4dfc3c9b6e062f0488e9c866e79455079ad8790e9a37c95cc03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631951, "uuid": "71ea51e0-49a6-4829-89eb-04ccd6d46fdf", "comment": "Malware payload (Mirai)", "value": "e4f77f8274e70020cd02c37c34ea8ae61bc8b8a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785631951, "uuid": "e68c040d-cae8-439b-a53a-5477e548102e", "comment": "Malware payload (Mirai)", "value": "c716e86a89c2a8581e881721bd2e8a7ae99881aaa0d5a6a5a5f200d18f1d050b5634792f48414290930d163d144e74ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631951, "uuid": "2d92244b-e4c3-4729-b615-3d134b3c31a4", "value": "T1BEF31B8ABC818B03C5E261B3FB0E428D372647E8D3EA71179D196F29375B8970E37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631951, "uuid": "262ab61e-3457-47c2-a60b-0a422e2b6728", "value": "3072:SNy0UQiOiPTe+oiBmb4JZ1l3NdmOyahSB:SgQi7aMEb4JvldcpahSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785631951, "uuid": "ede73e8b-4d7c-437f-a9ce-03bb201eb6a1", "value": 165568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785631951, "uuid": "c8865ec7-4b2d-41e6-9187-358413d0496e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785631951, "uuid": "30ec7e71-ea89-47b6-9af5-6c85e249d88f", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cac7314-8e49-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785658116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658116, "uuid": "5701afbb-9299-4234-95e2-49ad23fb0696", "comment": "Malware payload (Mirai)", "value": "9c51b7aefcd7d92a31e7bd76b5f5b3be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658116, "uuid": "3fe4a25f-9349-48a8-a19f-10f9c267b088", "comment": "Malware payload (Mirai)", "value": "fd66a2fe2fe980c283d6efe8209d075a4f0bc1e4c684757c58f12b1ad7189550", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658116, "uuid": "640b336a-ad2a-4c64-9c8b-849e2ec858e8", "comment": "Malware payload (Mirai)", "value": "cf662b9199bc60a3b0c3e5d85cc5dd40a584beba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785658116, "uuid": "b174c709-05e9-437a-8435-c8568a01a621", "comment": "Malware payload (Mirai)", "value": "f91dd6548846d5d46a5a2fb6c85fc826c8178c33df64913954274ce01f8c0abf0d2c767a62c44d2f22b6110042e09096", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658116, "uuid": "d4183162-90d0-453c-9c13-24b484846198", "value": "T14131F1D1A7D05D7DC8E451BE9E6B431473699F80F0C63923820CB7586D1AF3D9D2648A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658116, "uuid": "11755328-9955-45be-ada4-d266eeb4b70a", "value": "24:uAlKGpa7Urz/jlfDOXK1hH9Vev3gRGH9iVBBuLlPO9gSO:uAlKGpa7UrLZRIzGBu49O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785658116, "uuid": "3dc54ddb-697d-46b8-8af9-f4caa7ccc167", "value": 1492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785658116, "uuid": "da579cf5-95de-4b56-9d2a-c56eb52d8958", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785658116, "uuid": "3de07e94-77c4-40a5-ab4b-cd1df58cc2ce", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4200795-8e0e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785632895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632895, "uuid": "a57bf4e0-ec4c-4167-9a27-f3a4e2d0370c", "comment": "Malware payload (Mirai)", "value": "d54cf40b605a0d28a458a080f7d0e613", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632895, "uuid": "e27081bc-0cb4-4d5a-bcdd-b99a78e4a78c", "comment": "Malware payload (Mirai)", "value": "fd8afd2e0d2d6b33739270e33d0343efaaf9856e0ad26f98cb2cfdb3f72360cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632895, "uuid": "06831dcb-8ce2-49f2-a1b3-eda3bbfe42ef", "comment": "Malware payload (Mirai)", "value": "e0dc844159a874d2ccc9d4a6b3647bfdd3e93959", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785632895, "uuid": "b7a76a31-3735-441a-be56-60a32f6d9eab", "comment": "Malware payload (Mirai)", "value": "0a464b8931161159fbb6830e5d0086e5884c98c7b9025a6c1aa0b1d39273a58862edd1ff407028d7791e19e624fe9536", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632895, "uuid": "e23d9810-70c0-4e41-b3cc-5c734b0d9684", "value": "T1AF33F27E51553C30EAB0333EA1D18C9722A58A7582DFF9F30A144E296B7268360F3E57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632895, "uuid": "11308472-85cd-427d-a0cc-64841bd54657", "value": "1536:NRcE/LRFZAIF6M9v9G2NTppUZQCjFYNi3vGRzz0:NeWLRQsLv9GMp2SEFQweRzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785632895, "uuid": "0bbe83ea-2063-4afd-8d83-94bd06079fe2", "value": 55052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785632895, "uuid": "8bcda4d7-3450-40e2-b0ce-f252e407f1e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785632895, "uuid": "bdd2791e-44fe-4512-9f0b-9df848d7b224", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640e5a16-8e39-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785651256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785651256, "uuid": "14e9793a-f7ba-4a8d-9c6b-cc9d93d56128", "comment": "Malware payload (Mirai)", "value": "273aadd3b9f0741de08dece06a908de6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785651256, "uuid": "11a23c09-d40c-4bca-bf3a-0286bf0eae1c", "comment": "Malware payload (Mirai)", "value": "fdf0a3a084b3ee58a9bafb561a9ef3ee33e343e47f15d00c76bd0834c951ec68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785651256, "uuid": "4db7b19d-6790-41d7-a481-1ceb8c4a8294", "comment": "Malware payload (Mirai)", "value": "160be2efa64326a4267cd1a1fda0d905d724e28d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785651256, "uuid": "5dc8e1f9-6e21-48ee-8aa1-d5de20c51408", "comment": "Malware payload (Mirai)", "value": "00e8ed622cf5ee7bc4ba3ebc59ff2deecb550d274515fa45aab1c4f57dccdf1439eae0f224f9f121ec8001aa586fbb4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785651256, "uuid": "908a597c-fcee-4c4d-906c-0b079ecd7cbf", "value": "T1BA31FE95A2D09DF9CCA491BEAD56431173649F80F0C732A3920C7715BE2AE7C9C26086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785651256, "uuid": "c2f019e9-1a00-47ac-8165-956e01b57816", "value": "24:lpKGpa7Urz/jlfDOXK1hH9Vev3gRGH9iM/BBuk0S2lxrR+zHGS90t:/KGpa7UrLZRIz5Buk0FlxrsHGS90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785651256, "uuid": "d4650208-559b-44f3-a4e7-2605380fa28f", "value": 1448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785651256, "uuid": "01f6a554-ad44-47e1-8404-d6a6ed0940f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785651256, "uuid": "a6385d05-4127-46fd-86ba-7fe943ad1daf", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9e2aa5-8eaf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785701790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785701790, "uuid": "f643c304-0053-468f-a087-d6aa3b42173d", "comment": "Malware payload (Mirai)", "value": "7950b0362b06908c1ee4c058bf1a95c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785701790, "uuid": "a6247f6c-f71a-4431-ba18-30e0f1e9839e", "comment": "Malware payload (Mirai)", "value": "fe4500826280340597344445a1734897495008210740ea41f80f3b5dbc908184", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785701790, "uuid": "3892fee7-6ed4-4908-8784-502790020482", "comment": "Malware payload (Mirai)", "value": "d53a17e201b2b80588439c3ad420cc1e5103a038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785701790, "uuid": "71a8329a-3319-44d7-9e43-934fa52aadbb", "comment": "Malware payload (Mirai)", "value": "d3c5c5aa03d87015a1369f6764fea226e998db22e3c2d2e376b16a573418e813b56bcd632a83d50c74254bcb1e0389fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785701790, "uuid": "d9534888-aea9-408b-80bd-d939f791d19c", "value": "T1BFC44A55F880AF61C6C539B6F64D42AC73074BB9D3EB72069A144B343BDB86B0B3A705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785701790, "uuid": "1d0bd3eb-2742-4f79-adcd-0e2458c74301", "value": "12288:+W9tt/OIgS0XDjqo58WeiF3ZfZy8pLb/B:Fft/OTjqdg5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785701790, "uuid": "36e9796e-124c-42fa-8a73-147ff7dfa112", "value": 559368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785701790, "uuid": "7f8cf5aa-2bb4-4c4d-a724-bdc6d989b189", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785701790, "uuid": "ddc31132-d3e3-4402-8e75-8acb3a21fad8", "value": "xd.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd3178e-8e16-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785636213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636213, "uuid": "26f071e5-911f-4ae5-819d-9015cf00e3cc", "comment": "Malware payload (Mirai)", "value": "876a2bcddcc21ac6a66ceffc437a77bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636213, "uuid": "b200c503-f0c3-4e47-9918-8c22a2c47012", "comment": "Malware payload (Mirai)", "value": "fe95a35a549a6e1783f30a0727ad1b7823f7607775a34865336752a266ed304a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636213, "uuid": "0aa65165-5a01-4730-af05-41c3a5ba1c6e", "comment": "Malware payload (Mirai)", "value": "2620989e757f48c39f8cb49facc0a8836b7c9cd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785636213, "uuid": "570299d0-d25e-4b1c-9433-a843db680a81", "comment": "Malware payload (Mirai)", "value": "ca1c87fdfe064e6466f46b16bed3b0f5239222d60fae896b4ca90eb9eba4c67f85cd51492ad990464c7a4498bcc68a9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636213, "uuid": "add20716-3be3-4e3d-933b-7097ae62f852", "value": "T13443F2DD78C90DD9FFA79BBECD43C9C13B65C5ED17C59AD83390B2409507A889A02CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636213, "uuid": "94b01b3c-b6ea-480b-9642-2be403c56283", "value": "1536:oB9+SWw8JddOQNtrXEMgiQIytRdbeyJZt4u+qgw09P:oTkw8L9EMyIKRdbeKZt4u+qgwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785636213, "uuid": "6a7fe4e7-a70f-4d21-b311-dc55d28c836b", "value": 55844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785636213, "uuid": "9d7520a9-0a01-4f7c-9f12-dd936dfa781d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785636213, "uuid": "69bab0e0-d4b3-48c2-96fc-a51ac2ad43fb", "value": "zero.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4f6f71-8e3a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785651888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785651888, "uuid": "07559719-1fd0-439f-98d3-0276fd4280aa", "comment": "Malware payload", "value": "7d1397db1a855aa71832fea5897d3c9e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785651888, "uuid": "64a0ba2d-f59f-4fd9-a584-851e3bec12ab", "comment": "Malware payload", "value": "ff5ebcbb76cd264685df27c9aa3b78f825a2cf139aa52c58b880ba5fbd9b4f85", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785651888, "uuid": "8a421a8b-1ccc-4237-b677-e8443b3f6221", "comment": "Malware payload", "value": "d427bee42c33741de07a94a1bf76e173a8657e09", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785651888, "uuid": "a31457da-f1ee-4280-9b0a-75797f21b8b7", "comment": "Malware payload", "value": "8ceefdf6d05384e69642fbaf655ccea276591ea8de4848d115b0fc572584e61778c06aab2826f79a06915ea41131be5e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785651888, "uuid": "0c4460a0-c6aa-4287-b916-b53715bea771", "value": "T133C27D966A867C44BEC94A3E4CBD2B4D6DF5C3D1324D42AC3D4A3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785651888, "uuid": "147eb735-938f-4aac-9581-191c4336ba04", "value": "768:68vCB+25j6es8RV9FYpMSUpi+20qUpi+20YQX:68l25Jzd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785651888, "uuid": "238b36bc-53d7-4626-bc89-8a44767016e3", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785651888, "uuid": "32ae0846-aca5-48d1-b2b0-c1093eb02c0a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785651888, "uuid": "f16d8e9e-2e62-4648-955e-203385c82753", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }