{ "Event": { "published": true, "date": "2026-05-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-09", "timestamp": 1778371381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b94f69ab-1d20-4ec7-80d5-dcf0a1e6ec3a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51832d5-4ba0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778328956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328956, "uuid": "66eb1bf1-a205-46f9-b282-713a9f75df4c", "comment": "Malware payload (Mirai)", "value": "ac7ef9f99edef485468b21e973b4d12a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328956, "uuid": "a55d96ef-e711-4cbe-93d4-30ae6049641e", "comment": "Malware payload (Mirai)", "value": "00cf5fc1adcb4e56c532645274065bfcb6f002d927a33222820464cb9799293d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328956, "uuid": "22cafc2b-8298-4c58-82d7-4df31356c351", "comment": "Malware payload (Mirai)", "value": "a63a384ad385af3950a85d041fcaf03e31ffa21c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328956, "uuid": "be88ccc9-9322-417d-ad98-8a59170388b6", "comment": "Malware payload (Mirai)", "value": "44312ce722baa1cb68517bdbf3890978de2b6f100dca58bbad5e2c352a9709c44760e4c13c57eddee04231540efc41ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328956, "uuid": "d632a5b6-ee9f-41d9-a0e5-032d490738e6", "value": "T152A319DEB8925A1DC6D656B7B62E538873B55374C3CB7203C8144FF8A28B10E4B36B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328956, "uuid": "e9b5e852-3d7c-4534-8740-9998c0dde5de", "value": "1536:kh4fVqSjAtaNSvU9YijtV8dtE+r+AsTo/3UuDAIkdJwCbB:02VqlUNSMKiLN+KAsToMuwbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778328956, "uuid": "576381bf-a42f-43f1-9c9f-ebd94d0311a5", "value": 104876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778328956, "uuid": "2dc21ec6-11f6-44bd-9bd1-ca6134ee7c5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328956, "uuid": "f5c3a04d-4fc5-43d1-a11c-dc7c152e7932", "value": "debug.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45516cdd-4ba3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778330003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330003, "uuid": "b0fc4eae-c184-446a-9641-7c7c63fadcc3", "comment": "Malware payload (Mirai)", "value": "22499fbd47d74027cb7e53b457ca9828", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330003, "uuid": "480a74b5-dc9a-4322-b07d-31bafbfa1af5", "comment": "Malware payload (Mirai)", "value": "00d89ade7abd5a42cada38cf54f4670c93817b7d059134aca5c30663413e84ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330003, "uuid": "1244f027-e6ef-4025-b45d-ec2d03139ba6", "comment": "Malware payload (Mirai)", "value": "12a45a96cf33f790487d457ca3f36978020a995b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330003, "uuid": "50ef56a1-8244-42b7-b616-20023b424e8c", "comment": "Malware payload (Mirai)", "value": "8f53afdff704c9da455f8bf8f23476c9fd4802c591aab7acc0156d20939e89a179fe4a30261d09b2e3dee6f99da910b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330003, "uuid": "2c4872d6-3904-41f3-80fb-fb0c1f4cf53a", "value": "T15C04D55F6E225FADF36D833553B38A31A7A8338623E0C586E17CD5111EA034E552BFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330003, "uuid": "77bd6548-b941-4154-bd01-0ee602c08d4e", "value": "3072:JIkKEhfYibLG+pdFkJZIQCmuFYQIs8zZrobRb1hMiYtuJJBVol:JFh/LGudFknPtZrUphgtuJJBVol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778330003, "uuid": "26931243-0602-4987-bb92-10abbce00f55", "value": 185064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778330003, "uuid": "7ea66ea4-06c8-45b4-999e-d49a9c7263e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330003, "uuid": "be63c968-cb8f-4445-ba71-423935cc2080", "value": "debug.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69a5c4c-4b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778324207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324207, "uuid": "344864a6-2a4a-4513-8b9c-be72465db3f2", "comment": "Malware payload", "value": "c3b38300b0d92f7403cea09ff55f2b59", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324207, "uuid": "2a89d230-7f24-4d23-be8b-baf3307c5929", "comment": "Malware payload", "value": "027decc4e4173fad5c92070f94df236135f3e3a472eb5d9351521295bacac4e7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324207, "uuid": "12b72769-24bd-4873-aac7-7931ecc68821", "comment": "Malware payload", "value": "6b3ed2969e1e73217350cf277f540b5329c7126f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324207, "uuid": "17496fcf-df8e-4742-93db-c9b323f2549e", "comment": "Malware payload", "value": "b387d64a8945c33b09730dc635d8525d00b1c14c0c451f175bbcc786e90cc6ba66f4a341d4d729fc4c88e7102906852d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324207, "uuid": "971fc1c3-e578-459a-a90b-75615ed87a95", "value": "T178926C0FB9518315D5C00474A5B2873FD6BA9476338454EFFBD88ACA1B682EAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324207, "uuid": "943fb13d-2331-4d22-ad15-c295732d717d", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324207, "uuid": "6f59ffd1-cd65-4052-aa3c-16a287d9504e", "value": "384:ApIkjLVlvadxqSDO5wtT0vu98t2rFJ/Bgav8U9cJG:AVqx3600G9oJa0U4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778324207, "uuid": "5d999118-3af4-4d2e-814a-e83f824f7496", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778324207, "uuid": "0e8f1dc3-50f6-4ccc-8ee2-ed8b457a8451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324207, "uuid": "35bb33a8-4fc7-49d8-ad88-4b8ed756f4ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ddbd8e-4b99-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778325713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778325713, "uuid": "c3f0d5c0-5d35-43d1-929c-43a8790bc3d9", "comment": "Malware payload (Mirai)", "value": "d8550fdd649dd2172dd45618d496184c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778325713, "uuid": "d4db66d8-21ea-45cf-b69c-6cc76d25df2c", "comment": "Malware payload (Mirai)", "value": "028e0cdcf32eed1c0f24b57a695b887c616af76c1f300aa4caa13b7e5026ea9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778325713, "uuid": "acba0dee-4b51-4a1c-b4fd-60e5efbd99e0", "comment": "Malware payload (Mirai)", "value": "06c8402062d906b8f45287ebb4bea81eadec66c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778325713, "uuid": "50ed8ab9-b87f-4f86-b0c7-0cba1faf3b18", "comment": "Malware payload (Mirai)", "value": "c2f40eaac871ff186420cb297e2f0da055cab909f4737e5b86f68a77fe62678eb3ef457dfabe91939f66920176556f71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778325713, "uuid": "9771c14c-518c-479f-8181-07643ac28bd5", "value": "T1AE04D51E6E219F7EF368833557B78E70A39933C626E0C585E16CD5111F6038E682FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778325713, "uuid": "5f1a8b5c-c7d1-464c-a10c-89be17ecce75", "value": "3072:EPHDvzs7urX+KRqvSNgcRmmDeBhhZhJ1X5ZupTT7//LVYWfQG3gTeE:EPHDvzbrhRbbmmw5ZOv//LLfQ2gTeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778325713, "uuid": "6dfce2b4-e8ef-4028-8d62-a18a45753c26", "value": 180696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778325713, "uuid": "f270aee1-d754-42d1-8aea-a953b4887599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778325713, "uuid": "f3b9d58f-67b8-41c8-9a57-cb8ee9aeb219", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f2b50c-4b79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778312199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778312199, "uuid": "8bf5df5c-781c-49d7-8c0f-c02a5b98e7e0", "comment": "Malware payload", "value": "bd8132a5c83cae4a2afb3d4172424bf0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778312199, "uuid": "3b8b4a73-1feb-4fb4-ad9f-41b9f34ebe4e", "comment": "Malware payload", "value": "02959a12149400b87d8c9db42a4fba5ebd8e8184dadc432fc5d565fef08f5bb5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778312199, "uuid": "e77cb683-848e-4efb-8dfd-941962fe5b44", "comment": "Malware payload", "value": "8d82c7e50ab42c68d9f5311512c15b3d71a356e1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778312199, "uuid": "40f44596-43d2-4fb2-808f-abbddac4d211", "comment": "Malware payload", "value": "a940c512f4852f5c7448f00dcb0ceae67101e4518ef69ebbc297027d9a800a03fe4b82c94c95fe5559302e3bcfa1441d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778312199, "uuid": "87832440-6df2-4261-bb33-654287f71e98", "value": "T17BE4E026FAD914FBD277813CCAA74A05EA717C9607605ACF239007AA2F27BD44D3E741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778312199, "uuid": "570c92c5-e684-4120-9814-80053a205ae2", "value": "4bfc91f3e74bbb889bcf3811fa31cc44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778312199, "uuid": "fa82ad21-f08f-434a-bd79-de4031749858", "value": "6144:g9DJ/h5euxdKMW14A7q7/HhT7nSH//Mbpjnw6Hs2acgCOjsoXq+vZzMQwFV+fhwB:AhYuOMWB7q7h3K8Vg/ILSzMQD3yuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778312199, "uuid": "519954af-2358-477b-a1ac-263420d0ecad", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778312199, "uuid": "7cc740bf-67b2-4464-bbd4-a6fbeaa133f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778312199, "uuid": "089dbb49-5189-4ea0-a99b-bcac809ca03f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34c23c7-4bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778349086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349086, "uuid": "9e3fb056-d32a-4c25-bd65-6dda17377d9c", "comment": "Malware payload (Mirai)", "value": "95341a163fbf7cd52eeef2e468ee6bd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349086, "uuid": "467b6cb7-91e0-4934-b9b1-cd0d81f716dc", "comment": "Malware payload (Mirai)", "value": "02e58ee8b7024162ca0c52daff54da0ce71f816ca68429e7e962ec69b52a3f6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349086, "uuid": "e13c67d9-cbfe-4d8e-a7ae-e1857efd619d", "comment": "Malware payload (Mirai)", "value": "f333733e321b84fa75b4ab0bca0622cb4739e1e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349086, "uuid": "d0b1dbb4-5d84-410d-8759-de07c3f3cb45", "comment": "Malware payload (Mirai)", "value": "f689bfdf6271cf6588ccae71d1b1abdbc1efef6fd5bb5cbd71750759d5cbe5422f3989634bd633338768618c5a0611bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349086, "uuid": "649b99af-120b-475f-838b-a095efeca79d", "value": "T19F04E75FAE225FADF36D833557B38A30A7A833C613E0C586E17CD5111EA034E552BBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349086, "uuid": "8e90c4b1-b68d-4e69-bbd7-a9ba7f6578e1", "value": "3072:nyJ2gAY4qgZ9L5A93K5omFWMqC6maSMMiXvIM3F8u4mNRBNyW:bgKqgrL5A9H0eSMjAA8ujRBNyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778349086, "uuid": "34d0dda4-947e-4dd7-99ca-70a9d3c4113d", "value": 184888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778349086, "uuid": "90470286-38df-458f-aaf9-260e4b419839", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349086, "uuid": "886e0307-639e-4a9f-ae79-03438e811892", "value": "debug.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdd7977-4bfd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778368891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368891, "uuid": "9b81b785-7373-4528-b992-9d2a0cafa4f8", "comment": "Malware payload (Mirai)", "value": "7315d6b3184da18833691c46c63e8ede", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368891, "uuid": "79a7d537-13dc-4f26-bb13-e6fa7bdd892c", "comment": "Malware payload (Mirai)", "value": "03bf5df18f7b546bb2e98f624f631f8888098e641c423b4821f0fdb4a925703b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368891, "uuid": "c841d3df-4e97-4de4-a98a-e25740611441", "comment": "Malware payload (Mirai)", "value": "32e0a75b2c14c8d9bf6c6636c645eaa91e3346a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368891, "uuid": "9d9b74b6-2444-484e-8583-9bab6920e6c9", "comment": "Malware payload (Mirai)", "value": "438143fbd378e9034dc1eed05f4fca85a191c12a2f3ded64f1a805b71b8db433bcbd77be9967c56710b6b9da17652cb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368891, "uuid": "670650bb-082d-4881-926b-bdcb3b936585", "value": "T15946E845ACC42BA6C02C9B7494FACE5263741D144AF14A3626A4FFE9BC762787F078DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368891, "uuid": "f5a14fb2-06e7-47d1-96f0-b1f981195688", "value": "24576:vA1LbNagTSnF6MUxpyRhKLnMRCNbfvThHwFEwB0WGvxe5qwm6pD41TQOW2HNn+iw:vQUtneLVwm6edtn7Ir2bW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368891, "uuid": "0f3bda52-5db7-4358-90c0-64d4a569cfc1", "value": 5439488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368891, "uuid": "5d904de6-f4c2-4e1f-8b4d-680acc0f8413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368891, "uuid": "7232d203-4e16-4079-a636-af1b19a3a89e", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c8aa02-4b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778324176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324176, "uuid": "f2597b27-7c69-48e9-bd59-c0f35133e204", "comment": "Malware payload", "value": "a537f5b17c4d2fd944c3764c2471d673", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324176, "uuid": "4cb05856-36e1-48bd-bd2c-8cd41c19dacc", "comment": "Malware payload", "value": "03dc051af7ced238d0ecf15bfbe741f531c5656981c0df80ed8519a994b087e1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324176, "uuid": "6380dc56-a279-4f5f-9121-0c4f12e0e5fa", "comment": "Malware payload", "value": "7fbf7359c5c4589feeb33dd748e367034d2c9a00", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324176, "uuid": "6bd64d42-5484-4764-a63d-1a8c12a8c276", "comment": "Malware payload", "value": "38b5d21ef75e5bc89a6555025696c36bba2622c9158037a6fa4b56d1bcde38695e7a28bab0120ae78d31f5540b056904", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324176, "uuid": "ab8b2cf4-a770-4c65-91f7-9f744b1bbb1d", "value": "T1FF926C0FB9544319D4C00434A1B2877BD6BA9876338454EFFBD8CACA1B682DAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324176, "uuid": "ebc08158-1f53-4845-8d24-623ca436f2b2", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324176, "uuid": "e01504c4-7fab-4caa-94e6-c437b882fed0", "value": "384:eIkj7VlvadxaizO5w5DSZvu98t2rFJ/Bwav8U9c3G:uax3qIUG9o5a0U+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778324176, "uuid": "2e974294-14dd-4c92-9c32-7158153064fa", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778324176, "uuid": "ddc50c30-4090-4769-8547-e346990e054e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324176, "uuid": "38170580-c0e2-4286-ba81-4ffd5b3dddc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd247adf-4bb5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778338043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778338043, "uuid": "8748ba58-dc39-45d9-b3d5-4bd3b574a218", "comment": "Malware payload", "value": "721b5b2625369a4f39e12db0fb1359af", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778338043, "uuid": "4d65c480-b024-4212-bc92-6e52e71f43bd", "comment": "Malware payload", "value": "07fd1121692d6e9c25e9ee20085cc7ec6acba03af7a3f3d2887b8aa2545b4c42", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778338043, "uuid": "adf41ffa-94ca-4af4-a6c0-0498e726a470", "comment": "Malware payload", "value": "a06e600641a9802dda32ee5fefd8e7489d3882bd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778338043, "uuid": "d370fcc6-2cd5-421a-90fc-838d3c17857e", "comment": "Malware payload", "value": "e1a1d5bf0c0f9f224685cf2b090829681673d9e1eb2109781874c477c2bff7cf6d8d17fc400c187060e10dc34dbeb929", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778338043, "uuid": "2ac15586-24f7-444b-b074-1a0447627759", "value": "T16B136D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBF8B3CF18C15A9CE31971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778338043, "uuid": "d68365a5-855a-4484-802f-85cd51fee197", "value": "768:brs9NyXsZztC9L9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bAHusZTco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778338043, "uuid": "4ddf4262-f0bd-488c-8670-2b2671ebc5dc", "value": 45436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778338043, "uuid": "c37a3689-8422-4f39-a210-64ba71a321bd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778338043, "uuid": "382465c5-8cc5-4a65-b002-b609ee15dd51", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29ff8d6-4bd5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778351662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351662, "uuid": "d8c2e0ed-11b9-4818-a4b7-2e40e01fc8fa", "comment": "Malware payload (Mirai)", "value": "0ae1c138c168df81d32bcd66d14c1774", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351662, "uuid": "ce7ea13c-fce3-48cd-b963-262e2f8ffbe8", "comment": "Malware payload (Mirai)", "value": "083d057f368a2c1422a857443e987783a7f1ea4cc5b6376bf12b5bc3d997d410", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351662, "uuid": "90593986-ffab-42fa-a7e0-a87ad2ab6187", "comment": "Malware payload (Mirai)", "value": "ef72b7981c3b73da0849210742be83719db76667", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351662, "uuid": "e2aab348-4a36-42e3-9a74-04eb2d0cd570", "comment": "Malware payload (Mirai)", "value": "7bd103a60d54a4a6eb1ae2b2301033d9f9c843c2d547e62d7c6a5c206d86613661fbd1cc304e35d0c8ca464077ef4673", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351662, "uuid": "e865c9b4-0e44-4809-b4b8-87ffd7d04643", "value": "T166A318A3FD07DE7BF00BA77780A308193130FB7149535AB672963D97AA791D52822F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351662, "uuid": "77a1428e-6562-4b51-89f9-df3cc7a2a8e6", "value": "3072:iwkK42Um1bExH4RAeBaZJjGNyFwp6TO8BuPsqQu1:imoH4yFA6T9BzqQu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778351662, "uuid": "f36e77d8-9c46-4fe0-8d2f-ac7d82d4a8db", "value": 107128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778351662, "uuid": "45f76435-cde4-475d-8020-5199bc749ec4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351662, "uuid": "5d1db8d8-df83-4af6-8e9f-2bfa93655d70", "value": "zyre.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cef52e9-4bdc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778354471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354471, "uuid": "b66c9ccb-9283-465b-bacd-d96e166bdbc5", "comment": "Malware payload (Mirai)", "value": "9604b0634140848940b543c05940c0b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354471, "uuid": "2a7bdcad-6f8e-44d0-a4c4-6fb2ee1f9d9f", "comment": "Malware payload (Mirai)", "value": "0c06e4f6068c8cb140922e68923927a70e038b6c45422f0cee871f5b80d37c3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354471, "uuid": "aac5e4f1-fdcf-4a34-b46c-ac640b45933e", "comment": "Malware payload (Mirai)", "value": "eb36dd288093ea92461fb65ec762a34765b86770", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354471, "uuid": "8023b290-2324-4292-886a-45fc4ba4adcf", "comment": "Malware payload (Mirai)", "value": "03a9c2a0455e98eea41b206e45f1db3d551eb0a937ae589b6209d3d9ba49b1c7e96ea6d953fd8293f9cd0c0294479513", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354471, "uuid": "410fc931-d7b5-4ef8-9bf7-19d951ac90a4", "value": "T1B7C34B46FD928A12C6C61AB7FA6F428D372513B8D3DE3203DD151F25338A95B0E3B685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354471, "uuid": "b867caa5-a766-4434-96ba-c920acdad569", "value": "1536:1OFXEuXWWpYXufPPODMT2O5QiS2L2N3g6Wd77rHSUt28EJQUTrOruvBGAvrXDwU8:1OFXrTpYXuoMThu3fWd3rHcvxH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778354471, "uuid": "bb0145de-5311-41e4-8669-9d61c386e287", "value": 124856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778354471, "uuid": "a49c8286-94a0-4e5c-91cb-077a47ad1277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354471, "uuid": "426ba072-4a04-488f-8257-a3fbf3111a7b", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ed17b6-4ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778329708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329708, "uuid": "1effbeeb-ef96-4794-8103-9046a80a4d1c", "comment": "Malware payload (Mirai)", "value": "acaed012677e0a7b09fd998b2f18710e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329708, "uuid": "d26d6006-3d3e-4afe-8c8a-c44f52f5b37e", "comment": "Malware payload (Mirai)", "value": "0cb5acb5d9e44d07d3898693263c2f70a3e99683aaaa71fe0e452b904bb7534f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329708, "uuid": "7a8e814f-d4c1-4f5a-ae99-98dc1a4e5f2d", "comment": "Malware payload (Mirai)", "value": "39cb9d15720e1b038274cd83078317bb5d32bbcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329708, "uuid": "58bf470e-da67-4599-805e-e3344fcf2d51", "comment": "Malware payload (Mirai)", "value": "e78ff5a6f75b097ca9722282f95038ef921292d017a2f088d51f579990eb294801cb1e1f78e20ab38b6973347ee2c4aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329708, "uuid": "13bdd9c7-a232-423f-ad43-545d686e66f1", "value": "T1C9C36C929353D5F1D8150930A077E336EA79C12B211AEAC2E3ACDE34F897A42C5277DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329708, "uuid": "6c740cee-5c6e-443e-80d7-17dd6e840d50", "value": "3072:lxh0Jgy1JxeB/ogDBwZjLkUt9PrNcfbJNSBVyB4:lxh0JgGJxeB/zD2ZjwUz0SBVyB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778329708, "uuid": "ab7e6cd2-4563-4cc4-a658-8f506ef919a3", "value": 128844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778329708, "uuid": "aea10c3d-4d69-4f27-8063-0c27b8d62172", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329708, "uuid": "2a4254a1-900c-4013-9698-b1c596f33865", "value": "debug.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87804d90-4bc8-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778346006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778346006, "uuid": "684e7d1c-1fc8-484f-8b7f-ec4affac2b4d", "comment": "Malware payload (NanoCore)", "value": "b886d90ffa270acb4f3174d8da95e024", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778346006, "uuid": "1454645e-1fec-4cd7-b1d5-3b01af330035", "comment": "Malware payload (NanoCore)", "value": "0ceeec9baf97ee6df1e16a68276f0af435f0dbf442d7f2169a1519d350b3edf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778346006, "uuid": "9f1eb414-26f3-460d-814b-2769aa233683", "comment": "Malware payload (NanoCore)", "value": "c1c9623c2840dbcf4b2de4290245f7eafe7ed135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778346006, "uuid": "bfe71152-2679-4577-89d7-6535b191dca5", "comment": "Malware payload (NanoCore)", "value": "88c039f5d896867dd8f80bdbcd32d5da8928a16aea7b9d023662257676f1dd72ba55b7c3cca0160ba52e0aecd08e6e2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778346006, "uuid": "44640c7f-5693-44b3-b327-20ddd758f487", "value": "T18114CF5677A88A2FE2DE867971220217837982E3D9C3F3EE28D454B74F663E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778346006, "uuid": "a041b0b0-f8cb-4edf-8843-3b9067256fc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778346006, "uuid": "421bf8b2-9364-4045-9f7f-5b421205702f", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIElc75sSYbqSJ0gzRpc1CbZq:sLV6Bta6dtJmakIM58lZYbggzzfZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778346006, "uuid": "0f68a5bd-a953-4b9d-bfe9-146ce853b2ff", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778346006, "uuid": "fa557b33-d37f-46d7-bd27-66de85d7777d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778346006, "uuid": "d5534e94-c41d-4083-b171-44d321294933", "value": "swingmasters.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253002bb-4b68-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778304609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778304609, "uuid": "dbcf8dfb-af04-42c5-92c7-2c1f5f6b0602", "comment": "Malware payload (NanoCore)", "value": "64ede03ffb757532383148d857086a78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778304609, "uuid": "a3c56c75-aef6-4257-a2b4-83bf82d8961d", "comment": "Malware payload (NanoCore)", "value": "0d4a07bdb41c27805c9ce7adaf623ca9689ab53aa133e84f1d99af8006f49932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778304609, "uuid": "e0586741-51cf-46ae-a83b-eacbd50836e3", "comment": "Malware payload (NanoCore)", "value": "098e3d67edd9a0a206630ce8c1daae6e99a463c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778304609, "uuid": "d2938098-05d7-49f8-a60a-2632bc068379", "comment": "Malware payload (NanoCore)", "value": "c2c43d92200a3483c8278e94458d20582e562f831409ccc93f96a7790b7f9d64d4373d5bc098fd6a136cb635e6edd063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778304609, "uuid": "61663d31-10a9-49cc-a849-835b0fcdeacb", "value": "T11B14CF263BA44A2FE2DF467970521216937DC2E399D3F3DA68D855B78F267E10A070C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778304609, "uuid": "e8cb4f50-5e70-4e60-952b-e49efbd39cf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778304609, "uuid": "ad521c59-38a2-4416-b724-21072cf8c7b4", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI3eimDpc0FBulAlXG5brgpwZC7:MLV6Bta6dtJmakIM5ZXpt3uS9yYpw90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778304609, "uuid": "41b58a76-3d96-4f51-bae3-35485f9768db", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778304609, "uuid": "2646a134-bd49-4165-b91a-24e690a4bbdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778304609, "uuid": "fc3ce662-e9fe-46ee-a7ba-9757b04c2a6e", "value": "shopgaldaka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25088824-4ba8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778332097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332097, "uuid": "bc010f4f-5d8c-42d4-8502-04e451ab1454", "comment": "Malware payload", "value": "3496fb256ec0b348a817767518d1c526", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332097, "uuid": "24440ebf-8783-4822-952d-78a34f8a7e21", "comment": "Malware payload", "value": "0e6032fe7c0b314ef1bd5fcccde58f723f7fc762adf4d12543bf4ed77a37399b", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332097, "uuid": "adec3e89-9e02-4320-ae9a-5138a33550bc", "comment": "Malware payload", "value": "8a9a019ec969d2e114842c112e304ca067d91ef6", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332097, "uuid": "9e46bb93-b9d8-4226-bbfd-bfb7099b3604", "comment": "Malware payload", "value": "3cddcd6db06cb24d3da1024a9254904202c3dd6ec3bddcf36b93e3361311409c87a143fa552cb1b7763b646df61b230e", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332097, "uuid": "a9954361-5b7b-4a01-8560-5e0a443eb40f", "value": "T18CA67B13A89645A4D0A5E336C46BD652AB19B88DC33877C36DE29EF05F313C12F3971A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332097, "uuid": "6aa0c867-30b3-47d3-a3ed-3235e2f9b656", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332097, "uuid": "533f09eb-79e9-411a-a345-6ba0fa26458a", "value": "49152:ACr7/HQMNeGp3AVtEr7b1qJpZvb7QrmztwNSVxsECGP:A8/LDx5IDnBXCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778332097, "uuid": "c3ca7e2a-a372-45bd-91b8-2f95525c92af", "value": 9663624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778332097, "uuid": "96c8903b-3b72-4167-be2c-a20b606a9183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332097, "uuid": "1a2e73b8-d999-4cfe-8f47-dce5c96af50b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f822d2-4ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778332009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332009, "uuid": "84affa29-8f79-433a-bf0d-7e5719aa290f", "comment": "Malware payload (Mirai)", "value": "580f879fb3620a3b7d844f67dbb4e4c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332009, "uuid": "741dd972-2d88-4907-85db-9a9bed2f4b90", "comment": "Malware payload (Mirai)", "value": "1147f93b718840f44e2f361c84f26173a83f26971852a57d0d128e64ecac1081", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332009, "uuid": "1e8d542e-3669-4527-b463-c31d21e649ea", "comment": "Malware payload (Mirai)", "value": "d04909cbcf2a05f35dae25ee508c72deab52b92f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332009, "uuid": "43a5d7c0-551a-4bde-a710-66c100776008", "comment": "Malware payload (Mirai)", "value": "e798b12101e77cceab4d728afbf6fce5ad4c43f3826c0093c01fdd57c9b3f97b9c3cd00ebe1be7fea6b6d484d10384f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332009, "uuid": "a143e9be-e2b1-4b8c-8c11-f4df40172cc6", "value": "T1F5C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332009, "uuid": "1513842b-268a-4540-8418-2bfc3e0ff79e", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiyuw:VoRNjmj1VGFVrRiyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778332009, "uuid": "ccd59da9-e1d8-445d-8c9c-dd922539d71a", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778332009, "uuid": "ecb21ebf-b330-462e-a490-215dfdd99859", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332009, "uuid": "09cdc877-a4ce-4a85-9467-10ac1f3b02bf", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432989a9-4b9b-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1778326564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326564, "uuid": "b79da432-8d9e-4d5d-b9d5-b77a7b263033", "comment": "Malware payload (Stealc)", "value": "595163ce106e2f90c4a80d6f514c088a", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326564, "uuid": "ee77e123-2c46-4973-a3a3-24c0313d62f2", "comment": "Malware payload (Stealc)", "value": "11f22d21a0f2f263d3f3f7db295ad11a070cbc71800e19d6c065d50caaa7f290", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326564, "uuid": "fea63fb8-1fea-48e9-bb38-b9018ed0e0d9", "comment": "Malware payload (Stealc)", "value": "bc6fbca8b37e6b6622b04a1724880f817d34cdb0", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326564, "uuid": "992d26bd-13d6-4cdc-a129-2ae56d7a1bb9", "comment": "Malware payload (Stealc)", "value": "c813432cc8535cd6f4b3fb0ae88fb38aa24ff8266a435f92d8ea9e8d7c7307696efbd5e9242c319d3e169966b0acee4c", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326564, "uuid": "b2e9beda-81a6-40ee-833d-23407ecd126b", "value": "T1B5166C98E27529B8CC54A0B51D2E0CDE1E1E1435A29F88F747CDA8460533FFB5DB862B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326564, "uuid": "2522fc12-cc57-4116-9831-099892de9a52", "value": "489b077c69526c0f84b5fb07fefbbb5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326564, "uuid": "588a5997-0c80-458a-8109-cd52911c7e29", "value": "49152:jVPEZb7XyGA1PEZRNXyGXUswYwUu/a9YLf3FNxQFxk4ouJqNVG0RgfjmifP:JPEZb7qPEZRN8Jxva8Mrmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778326564, "uuid": "d59e739b-09de-47b2-b522-6ca0c6d0e28a", "value": 4159488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778326564, "uuid": "18838df5-19d8-45c9-866b-65103c6f0508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326564, "uuid": "c50cb567-98fe-47b7-9734-2a186f7e6016", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df47e7eb-4b9e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778328114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328114, "uuid": "5aaaf7b1-46c2-4fa7-8384-18837fc8889f", "comment": "Malware payload (Mirai)", "value": "094fe2e78ea4c3f76c7e038c78773e47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328114, "uuid": "dff0ddbf-c97f-41a1-a1a7-04949ca196e3", "comment": "Malware payload (Mirai)", "value": "12064052c5a9df7368d51c7d328546d2445617e06cdf0b1a95d62909dd0ef06c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328114, "uuid": "2cff2540-d806-4227-b51f-f0d41e1ff3fb", "comment": "Malware payload (Mirai)", "value": "6cdb6ad7dc86be44b1b398df5f3bdda9888cecd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328114, "uuid": "470272ca-93bd-4308-a93b-00c2da7996ac", "comment": "Malware payload (Mirai)", "value": "9097b92c3a76c0f12424a59296be454b9f4b5ffff6658e8fff3dbc1ef0d46a259ff4f0a9b6db2de1009dfa990a701f93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328114, "uuid": "2a6229cd-b4b6-484a-b8d2-0cde4996c8ff", "value": "T1CB33F1B4A08ED071EA511938ABAC43D2172B376DEFF13226376841E5209E14D36F4AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328114, "uuid": "186ea3a3-0654-4fd8-aa40-6eff5860cc46", "value": "768:5X29U/9VGU0fa3jPIDykM7Pint5U/24BFTXinbs+EAHAZYG64/Mh5PBNygWs+EsS:5X2a/9VnrPINM7Pintg26h64/0ihz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778328114, "uuid": "471ef0da-b523-467e-bdb4-ab8cc5161773", "value": 52148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778328114, "uuid": "03bf1ac3-10eb-42a8-9605-e7dfb4beca64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328114, "uuid": "565ae062-64c7-4652-b562-9d1db2394383", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae2f2b6-4ba4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778330577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330577, "uuid": "09d7eaa0-9ec1-47e0-be7b-f2c9d4c84bd6", "comment": "Malware payload (Mirai)", "value": "9d43eecbed38e902c76ef930cc72a520", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330577, "uuid": "3295476a-f254-4e2d-b020-f3f4fd619956", "comment": "Malware payload (Mirai)", "value": "12ad2e32965731ed2adc9069070591cff2a42c2f57c130a929d92aff49eff736", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330577, "uuid": "d7f57407-534b-47d9-bd51-59921094fe75", "comment": "Malware payload (Mirai)", "value": "0eb70063ac2eddb892ffd9fa96c418100da6faeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330577, "uuid": "f919c5a3-cc9e-495b-ac94-ba02148335e9", "comment": "Malware payload (Mirai)", "value": "81218ebd124b4522e25664858d035f8cd6f7b8f1d19d3d12704528d12a7a661782e2d131f220e33a0df8fd1bae391afd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330577, "uuid": "ddf5704b-c623-4b08-9d31-4a6db2b5983e", "value": "T137146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330577, "uuid": "67dfe561-cd18-4e15-94cf-57a426a2d88c", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtd:BZAyFzQSdS7Ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778330577, "uuid": "1b3745f9-ef11-4d0b-9d4c-20d05faddc74", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778330577, "uuid": "e78483fc-f8c1-48ab-a0a6-be3cd88c5db6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330577, "uuid": "63232f03-8449-49c1-bcc0-dfb2f4f49922", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4507377e-4bbb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778340311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778340311, "uuid": "c8325237-3f62-4c3e-8983-c1b7633da4a5", "comment": "Malware payload (Mirai)", "value": "7024ee3be3a7a017513c7d981380000e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778340311, "uuid": "24d9282b-c599-4c79-9eee-25b12a11c432", "comment": "Malware payload (Mirai)", "value": "13a0729114500073c5c4de6a378a0e458d5dea103164a77b26550fa82864fff5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778340311, "uuid": "3cf86cad-c4b4-4d96-9f0b-13b923531eeb", "comment": "Malware payload (Mirai)", "value": "c8f7813adedf138cd55d06474f97c0be0bb546be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778340311, "uuid": "a7b5b852-5995-4f7d-af71-5fcebc02991a", "comment": "Malware payload (Mirai)", "value": "148b4640c94ff2ab20674c07f7980e1c318ce40f09cf9f878e1875ee0fe14a0557ed4685a7e21754c1be1812f0d24e79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778340311, "uuid": "7e9f8195-0f99-4869-b34e-efb3b102e648", "value": "T1B783199EF4E24A1DC5C00BF6763E934A33A553B5C3DB7653DD004EA8A68B50E4F36A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778340311, "uuid": "1bea0c54-8fb9-4756-9f76-5c78a9b5daf0", "value": "1536:RQi81QZTh20Ef5JcijRfMKGRDFjo8eAvrXDwM:D81QZc0jiEBFoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778340311, "uuid": "079f47ad-3ef0-4dc6-956b-fc375664a35d", "value": 88204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778340311, "uuid": "3f4750d3-ecd0-411e-93a0-ef7615545420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778340311, "uuid": "d2fd04da-c3c2-4529-b8a2-a7c09e23e015", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88d069c-4bfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778368046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368046, "uuid": "35c1f75f-055e-4277-a9a7-5843483fd3dc", "comment": "Malware payload", "value": "4d042c84c6a260d2ed6956a32e801255", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368046, "uuid": "8c244ab9-77c9-426a-99aa-eb879480374f", "comment": "Malware payload", "value": "14727d903608a46edcbcc5d5728984c85f4ed12cfcda5cdfa8804fff34fa190d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368046, "uuid": "e82e4559-40e1-47a3-b61a-9c24bd25591b", "comment": "Malware payload", "value": "9f5298d55dc0d77e6400dc485c47b6f2e351a586", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368046, "uuid": "78f5675e-b060-40e0-a1ff-f8186d68a88e", "comment": "Malware payload", "value": "f9f870b3edd0b1884c64ab6c635fa5c67f01869f5dce4e9d0e9a73cd10dc1a17f2f78ba3eafae125ae0ff22cb8e0130a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368046, "uuid": "f18b8d12-d94a-4935-a679-7e0154231b85", "value": "T1EA762897B8924942C5E43A37B8BE81C433630EB98BD756575D05FE383EBE5CA0A39740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368046, "uuid": "0923ffeb-f870-4fac-be43-b7d94319051a", "value": "49152:J2F+nyqbR7ezgrESAW+4SCEkkabjm5RI5EO:wEnyqbR7rrTMGLkMUkEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368046, "uuid": "8f1b8f6b-1453-485a-95e9-b7b6a0974736", "value": 7471266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368046, "uuid": "35621f08-518e-49d1-be64-f01b1e65f1b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368046, "uuid": "f499163b-fb76-4ed0-b314-c0a3f744b8fc", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd054878-4b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778324191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324191, "uuid": "fbb718cd-28d4-474f-a0b9-546c5bc178c9", "comment": "Malware payload", "value": "1b8083aa5f31f50bfe0ccbecdcfefd76", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324191, "uuid": "be907ccb-5b34-4fd5-965d-15e6c29a1698", "comment": "Malware payload", "value": "149ad59bd8813ba2b3d8678453c1bddb53d42267ce82fd30b9671a96e5448cdd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324191, "uuid": "7653eb31-949a-4a20-be32-3e12a0ea5c50", "comment": "Malware payload", "value": "94cca457c4fb37b3204eee1affa5e46ce818e895", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324191, "uuid": "6461d688-4b8a-40bd-bad1-b93a3fbeee52", "comment": "Malware payload", "value": "b0e750d1a770bc8edefd47fb7b0c3d67c2fd002bf2e314c6b3b6e89e1ca7ba10ec605c7d5fe08dacb060347d89b9689e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324191, "uuid": "bd568189-8f3d-4299-afae-b1dcb112f43d", "value": "T16E926C0FB9554319D4C00434A1B2877FD6BA9876338454EFFBD88ACA1B682DAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324191, "uuid": "ec96897d-0127-4eed-b818-74f7bace0902", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324191, "uuid": "4fc95d77-498c-4714-b482-cde9d49a93cf", "value": "384:OIkj7VlvadxaizO5wlDSZvu98t2rFJ/Bwav8U9cdG:eax3q8UG9o5a0UMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778324191, "uuid": "d4ef82b5-cd78-4ac3-9eb6-541dc0b015b6", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778324191, "uuid": "463dcaee-f6d2-44b1-a718-edddc4e18e1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324191, "uuid": "884d7a23-0ebc-4aa3-bb51-f75b43f3fcc3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfb4393-4bc2-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778343306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343306, "uuid": "b149fc07-ff43-4cd5-aa5b-3939d4d06641", "comment": "Malware payload (NanoCore)", "value": "3381551a9a905b25283410a5bdd741c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343306, "uuid": "d8460185-3436-47d1-b643-bc4e81544d6e", "comment": "Malware payload (NanoCore)", "value": "155085a8228664f1bcc9117896956a0bdb5b07f8986f0f09ec16bbdd8d827de3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343306, "uuid": "f0571e41-d6d6-4961-8c67-c73cb10bcbee", "comment": "Malware payload (NanoCore)", "value": "1b5620d6fc8a28880ffb5ea834707c338a238cc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343306, "uuid": "834c95cf-8354-4d89-9451-df3c82b8ab71", "comment": "Malware payload (NanoCore)", "value": "e125d925980978ea492e63ce43dcf2eb310c42d8962108ae612165637f54a68c07053151e661d06facd2ceb574f84d4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343306, "uuid": "1126c181-2ce0-4432-be68-4e3ac96fe32e", "value": "T14114CF6537E4493EE3DE8678701242028379C2E3A8D3F3EE28D461B79B667E44A471D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343306, "uuid": "dc2a96ef-0832-4b39-9d89-66b185475cdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343306, "uuid": "7f35f079-b1e8-4da5-bf39-746bba9b4694", "value": "6144:MLV6Bta6dtJmakIM5q6fA+eXcTTacsRy3Cj+S:MLV6BtpmkPuA+eXsaDCUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778343306, "uuid": "80cd4490-fa51-4406-a40b-c0e0ceb79cd0", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778343306, "uuid": "ffba5d36-d4d9-4e09-81ef-da7d28938570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343306, "uuid": "829407c5-39ea-4690-b8f7-b4c268340940", "value": "u888ny.comnano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de3d718-4bda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778353667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778353667, "uuid": "02deb241-6dc6-4081-968f-5ad3cfad8077", "comment": "Malware payload", "value": "cac4f95fb07fa8bc8f9cc3419b7945d2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778353667, "uuid": "165a8755-c100-4d65-b9c8-86a1bda02b89", "comment": "Malware payload", "value": "1921717197c1e6da607cf23a9f3da5f2d0e67ff7cbf6f5a82cd00b53524aa653", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778353667, "uuid": "248e7f4c-a12f-418f-b79e-32272985d1e3", "comment": "Malware payload", "value": "e2a0ffcad0dcd347a1491a459d7085466c153009", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778353667, "uuid": "b102fde7-b4db-404b-a77e-1b07ba10f7c9", "comment": "Malware payload", "value": "5673800730cb1382bb5fadc6fe3db655e949c7fafb66908d1dbfeea2f3fbf16082262462fff8831f5847e9ac82eb0245", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778353667, "uuid": "71a184c5-c636-4b00-9cbd-6a90ec4f913b", "value": "T152D4D042F5E5EC31D463093D08E0C66F663CBC31ABA2E98B17A5A7A71CF52E08576707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778353667, "uuid": "51c10587-2a59-4b80-b035-8f4352411305", "value": "12288:i3cVAOjj6UT5naDKk6+s7rR04bqDY001b7undDGd:ishFk6+s3R04bCI1fuid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778353667, "uuid": "da8f43dc-b2de-424a-b4e4-4734543f0a32", "value": 655404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778353667, "uuid": "463a9bc1-bbe6-4aba-ba4d-7a4d894f3407", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778353667, "uuid": "96985154-1cec-46d0-816a-593b6410a0e3", "value": "TINB.docx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9477facb-4ba9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778332713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332713, "uuid": "30e80e25-d839-4997-b8ad-7021f8f61f6c", "comment": "Malware payload (Mirai)", "value": "0ac3a684308d741f6a31e00459775722", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332713, "uuid": "75d2ef15-e653-4f16-90f6-ce4fe871e53d", "comment": "Malware payload (Mirai)", "value": "19d72bebfa50a11fda736c6f260cd0abc714b3b7e265eaf004e88f3346283d2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332713, "uuid": "db1eb6b9-1779-4ce6-9f9e-4776075efd4d", "comment": "Malware payload (Mirai)", "value": "dfffac4d272ec85e155417887ca243cf22a909ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332713, "uuid": "0fbf98f0-155f-44d5-89ae-343d70327f41", "comment": "Malware payload (Mirai)", "value": "b817e37746885356d8d99c02fa064bdf323633d9b2949da3295aacb50915e30f7b36168fae2850c0ab3ce158ae73e1ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332713, "uuid": "d09bc204-3d20-4e3f-973e-5b2fbdecc7d3", "value": "T17804981E6E228F7DF6A9C73447B78E25975C23D617E1D644E2ACC2105E2038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332713, "uuid": "031a6098-15ce-43fd-a705-43d1a8ee9ada", "value": "3072:V9zCtZN9fmqzZzCSaPX/TtPJc+nmhB9WmasuZ0M6YaM:TCtZN9OqzZu3zZJTuBdax0M6jM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778332713, "uuid": "f83a7e8d-7c76-4524-8da3-2b0a5f8ee7d8", "value": 186124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778332713, "uuid": "ddf29b70-324d-40a4-a12f-9abc8c9e25da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332713, "uuid": "4ffe4884-f428-43ab-b711-dc8852b6dba4", "value": "micro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060c2de8-4b92-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778322596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778322596, "uuid": "f1c71ab0-3205-4014-a472-d6efbc10e9b1", "comment": "Malware payload (Mirai)", "value": "be0cd6d9a77c699cedcd7a8132789b75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778322596, "uuid": "ca88303f-8767-4cc1-b057-9b35e42badf9", "comment": "Malware payload (Mirai)", "value": "1a63a2f3f865c058fab9d6a42dbaed7329b1b23282e5f3cd0e4c726c33a7801a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778322596, "uuid": "5ea98d2f-168d-4b5b-acfc-80b0f2ecf47f", "comment": "Malware payload (Mirai)", "value": "041fcbcca6201fb2c0a4c9bbb29f07d14976a718", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778322596, "uuid": "5684b995-3537-4014-9e12-04fd61d3c321", "comment": "Malware payload (Mirai)", "value": "e15defa59bf58b28b2bec51f5d7b6903aa8cdaad60b29de7dda9c204f24e076de1aeb6a8c00279c97dfc097d0feab129", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778322596, "uuid": "47043b73-2678-4368-8af9-2e07978ff451", "value": "T1E0D3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778322596, "uuid": "04707e0c-8444-43f7-b284-7a0ae262f544", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0ZM6:xOFgpOEoVv3MXL5NhGOM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778322596, "uuid": "864cf385-18aa-45a1-a05e-d7446e893890", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778322596, "uuid": "6ee447fb-02ac-4a3c-8b33-03a9c06787bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778322596, "uuid": "753f2e28-c466-48b1-9061-2c00fda0a49f", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073ae21a-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778331188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331188, "uuid": "7e90d527-38da-4e43-a4fc-0811f54ed161", "comment": "Malware payload", "value": "c49dd0e45d54ccc3aa1144148ea4e3fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331188, "uuid": "82eb33fe-0c6b-4bfe-aa9b-a03d957acd59", "comment": "Malware payload", "value": "1a800a56c365807963da602d7e2e38ea3712431da3f11d36574426d89ee9fb7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331188, "uuid": "3a5256a7-07a3-4725-9b6e-e533561f6b87", "comment": "Malware payload", "value": "b8b2293f5381998f420073bfac2cd003ea0c754b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331188, "uuid": "61dd1fb9-3833-4a6d-96db-0d4d8dea61de", "comment": "Malware payload", "value": "8246de45a2102d7d1ac3b30e6aeb6af9e35b8166cde853f6163838fc7ab5995867a93e7575f0db9fd39ad221a3ac2afd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331188, "uuid": "8d5a679c-a1fe-43ca-8254-814a32a0fbf3", "value": "T11E14BF4227405FE6D9E219334BE389E27A7D32B671E1620375684508DF29F0BF87BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331188, "uuid": "5d518083-d1b7-4e62-9370-ca2f0c421151", "value": "3072:NQRXBTipCe3jDTKndC0yuctKR2ZaidpdeYqLR2byVX4Pa2CFN5rSLwq+jR:NUxnyDgCzKIZ1e5l4yVVrCZ+jR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331188, "uuid": "e742bcc1-5657-49ae-bcd0-3724d09edacd", "value": 199782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331188, "uuid": "808b74f7-230c-4349-9ffd-41c8715fd4bc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331188, "uuid": "f0966275-0673-48fc-9e30-3f0b243adcd3", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14137552-4bb5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778337652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778337652, "uuid": "0b1d4fef-ff0b-430e-bca4-0f671eb63f57", "comment": "Malware payload", "value": "7c289893cf9f5e2528af37dcd013bdfd", "object_relation": "md5", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "Convagent", "colour": "#441F96", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778337652, "uuid": "bb9e8b7d-6916-429f-bd76-a574ae6e80f7", "comment": "Malware payload", "value": "1b01aefde5fb78109b606778240deec65d3414e7953a2db7b7b04eea04e2b7a2", "object_relation": "sha256", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "Convagent", "colour": "#441F96", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778337652, "uuid": "74c26b6d-e53b-4880-8471-f232c0cc62ff", "comment": "Malware payload", "value": "6fc92e3c039d49b1243b150437ccb2bcb292cc48", "object_relation": "sha1", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "Convagent", "colour": "#441F96", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778337652, "uuid": "127ecf6c-a6f6-4903-ac4b-2e025623457e", "comment": "Malware payload", "value": "115a4aa5a60df0a5eff195d55afb6101cb7c13dac14a3e9a85153fce5d1638cb42fe7e9eafadd2df9999213f304645a2", "object_relation": "sha3-384", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "Convagent", "colour": "#441F96", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778337652, "uuid": "baa32f4c-51c6-46a7-b9c8-0b7ac4c279ab", "value": "T19D753307F6A08E5BEB88C97DCB819B2915231B15479CDD33F794C46FB4CB4614AB290B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778337652, "uuid": "131c8925-c5dd-4793-af13-35754b551bb7", "value": "49152:YokQ2ldPqNvHiMbx15kCpZmlTv+2Vb6ziw:YnPOvhtiT+4umw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778337652, "uuid": "e7852cc1-e6ff-42bb-ae9c-deba9feb26e1", "value": 1624958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778337652, "uuid": "8133aa23-19c9-4e16-aa54-c4e66cd68db4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778337652, "uuid": "c30b42d3-a9e6-44ec-b2e4-641ec95867c7", "value": "yp-VeZ5H7M6wd3HCRN0X.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebc266a-4bfd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778368889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368889, "uuid": "81d52076-9ea8-4406-8640-ca954bf3af84", "comment": "Malware payload (Mirai)", "value": "630af656ef98e4d15a5e372929307a33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368889, "uuid": "145a836a-7357-43b7-b557-9762e28317af", "comment": "Malware payload (Mirai)", "value": "1b141165df34e7f56eeca2a18ad3d4f98a55a456e14624133cc2d79c3e531bc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368889, "uuid": "d9e8c1e2-34f6-4e38-ba7e-d1a00a1f5eee", "comment": "Malware payload (Mirai)", "value": "fb44cdb927c356e8e4308a79d3ecb6130a978516", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368889, "uuid": "aca18243-16e2-4ad7-9dde-8081a74f5642", "comment": "Malware payload (Mirai)", "value": "545c5af83ab41fd30171a982a1c5705b06dd6304d23a4183a34bff8d1c92d4e121d8ea20688368d3cd45a155a2443517", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368889, "uuid": "5a799e64-68ef-4980-aeaa-b7d3a7b8c423", "value": "T1D4262851FECB44F6E9031E3044BBA26F67315D058B29DBC7EA507F2AE9776D21932208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368889, "uuid": "3b048906-a490-4934-8a3a-bbc67d5a7fc1", "value": "49152:lpMwciYpuWQYs7FR5+Q+uvvunTcP8+pvrIW++xFzbiT/59JY2QNVEH:7Mw0BOR5+Q+uvjPM3jQkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368889, "uuid": "3fe1f694-8265-47e7-84d7-14fe35c24a78", "value": 4792320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368889, "uuid": "cc266470-f98a-4d97-91f5-6648e6e5231c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368889, "uuid": "9fb3d078-498b-4869-a154-2e0241006817", "value": "i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e03ecaa-4bb9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778339413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778339413, "uuid": "259cc6be-9241-4392-ae8c-27b06c1f7f58", "comment": "Malware payload (Mirai)", "value": "aab2cd32785276e4bc95d7435e1d19cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778339413, "uuid": "95ca151d-13b9-4adb-b408-d27c072b8ed6", "comment": "Malware payload (Mirai)", "value": "1b25ae49618c71b61683e64a261d7c0c2938c84a29ff42be1846c531d65b3c7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778339413, "uuid": "5badcf6b-e62f-43d0-a0e1-0c7a4475ba3e", "comment": "Malware payload (Mirai)", "value": "7c7cc51b50eb490e3a2ba71eb3a817bf1ee788ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778339413, "uuid": "df57df7b-e663-45c4-83dd-e42ff1e3e66a", "comment": "Malware payload (Mirai)", "value": "b7c31e3dfb4ada944b10c69d27b3a23dfcd8c81bdbbedb29845d361168c0cdb1f49f2f83ca1792eef54ebbf605e53af8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778339413, "uuid": "e5f92fb5-0779-471f-bb5e-e00ab7dccdd1", "value": "T16CB39DA2F5221DA8C21545B421F1CAB45373AA1292535CFA65AEC63D5083EDEF33D3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778339413, "uuid": "67eecf8f-09a9-45ab-887b-3a3b83bbcb61", "value": "3072:Vk1KxjCiDg16OIeHaVZFD7TecsILrgeWm+KsD7U+PRcD4zp:Vk8CiUwOIeHaVZFD7TecsILrgeJ+tDgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778339413, "uuid": "03539904-02fd-4fa0-8cb9-e2de4f9cc7cb", "value": 116720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778339413, "uuid": "58299f60-5936-4c5a-a1a9-277095abaa78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778339413, "uuid": "6cea506c-95dd-409b-aaa0-b1397646598b", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38614b4a-4bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778333418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333418, "uuid": "f2b3fd72-8547-4d7a-b811-2e37aa3b7e63", "comment": "Malware payload (Mirai)", "value": "1c8db8aedd76bad17f55242c4dc72c3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333418, "uuid": "44af25b3-9b10-4cbe-9a72-b36f9b0446a2", "comment": "Malware payload (Mirai)", "value": "1ec1abb746d820cafbbaf8c9c65117248956e0fb586ba200cf3b97937708ef79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333418, "uuid": "44af664b-d2eb-4cce-a8f8-48667bb258e6", "comment": "Malware payload (Mirai)", "value": "37eb9f5d885f1ef3b8de69a9120108c52d9c394b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333418, "uuid": "2fa6b262-2e0f-438d-a4f6-9b0449d3c360", "comment": "Malware payload (Mirai)", "value": "fb134271e66742a28e6ea5873222c085c6bf6186ba61105fcabe087ef21598b1c259267d23a3718ed36f89b613137ec1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333418, "uuid": "22f26c01-c37e-423c-9a82-12dde9e21460", "value": "T1A6A319DEB8A20A1DC6D556B7B62E978573B55374C3CB7203D8104EF4A28F10E4B36B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333418, "uuid": "a1db56e3-931c-4f41-8ebf-35d51e0b44ec", "value": "1536:8OUrgDkJN3WsHz8o7lQOeMAC6zsAxJgE/Y51xk7XiPrUuDAIkdJwCbB:8OKWkJNGs4so06zsAj/e1xk7XiYuwbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778333418, "uuid": "93addf81-aabf-4aae-887c-51e6cb5f1075", "value": 104684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778333418, "uuid": "13b41c5d-3058-40c3-8748-7126ccc4262d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333418, "uuid": "53aaec09-deae-415a-b180-20cbab596310", "value": "debug.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a0ad6d-4be5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778358561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778358561, "uuid": "57863743-0b2b-465e-b1bf-cf73ed7296c7", "comment": "Malware payload", "value": "ef9567198ec785ef0f72f12031ae5f41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778358561, "uuid": "6cfe23b3-4f58-4819-989a-00c3bf500946", "comment": "Malware payload", "value": "210831eb499d558a50581d3b4f7c052b886d2d0a86fd35168c37c8d9d3f39f0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778358561, "uuid": "4e8efbc8-cda5-4ea6-809d-874a2cf1ab09", "comment": "Malware payload", "value": "6e09d95a9bb4a2078de2504416e1c49ffdc3080e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778358561, "uuid": "58721465-504e-4602-8073-762ccde157b4", "comment": "Malware payload", "value": "75df688a8eb58892a1b534a16bc98ff761f8814f03c2f9f1e201947c8f9ba9b0c98e399c004fd82fda2a4bb5ee69496d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778358561, "uuid": "9676bd3b-0254-4176-a823-369fd01149b0", "value": "T182F42956F8809F62C5D1257AFA5F82B8731347B8C3DB720699188B343BD782B4B3B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778358561, "uuid": "c0ebe217-3ea2-4ed6-8465-939d6d7e81a7", "value": "12288:z0Bkb9VCrdy7DDMnKRckEpl9bqgpcdpLVllTQPv1j/cuN:z0BkJVCByIQI9CfJ4Nj/cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778358561, "uuid": "7a6141d3-09bf-45e6-9f11-2e9d5206aa5e", "value": 727952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778358561, "uuid": "f999be61-c041-472d-8ed8-71a32e70af01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778358561, "uuid": "49107749-4641-44bc-a78f-056efa618108", "value": "avx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ff46e4-4ba1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778329436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329436, "uuid": "7b834284-1b3e-44d0-8ed5-dc4c7116072c", "comment": "Malware payload", "value": "3f4511c34f01bd494c0581ce12e07c04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329436, "uuid": "0d4770bb-96dd-48c4-8fe3-28282894c265", "comment": "Malware payload", "value": "2133accc4a8a636b19dc32c6f600be4ba3afe51ab1b9d197d017550f22800e0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329436, "uuid": "8a9c8c1e-1161-4498-898c-e4198ccdf26e", "comment": "Malware payload", "value": "895e507752e357d0e94c9cfd7e48803e19741890", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329436, "uuid": "31f9b344-9b8f-472e-b731-04c6c24f7cb8", "comment": "Malware payload", "value": "d09a99d8cc5dd736098878fd4fff4703431f48d6f5f9e47ca0f9c5b41aaae21be77871c671a9ef32e902aa8821258c84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329436, "uuid": "b9e03a83-87e4-4552-8f4e-242d49e304f1", "value": "T1E308AF837707EDA2F192A7B944A74340B776F4B817608713325C5338AF5FB18AEE1A64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329436, "uuid": "242c35ec-093e-4d17-a6f5-8f588b275940", "value": "134463e32c3cbe702e5ab6a4147754d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329436, "uuid": "2d7aefab-9c6c-4ac4-b898-2853f5609e7b", "value": "786432:7RZ2A3e5iapP3KPPVfO6bLEyTd/gQMRZp:+JP0PPVfO6bD/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778329436, "uuid": "9529a787-6b81-4863-975e-7f499ac3825f", "value": 80018432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778329436, "uuid": "d3d05c12-8a08-4021-8ca1-2d09bd8917ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329436, "uuid": "786e0078-3e2f-41c0-b090-01bdec7b0f34", "value": "install.6.3.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516bd8fd-4bee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778362236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778362236, "uuid": "d8e9b7fb-9e66-4eb9-82c1-6e2ecd6d4627", "comment": "Malware payload", "value": "b5b55cd09ec0fd93ecda01d196eaf571", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778362236, "uuid": "bd3d7fba-638d-4ab5-92b6-638270af2a51", "comment": "Malware payload", "value": "21925e714f42324b7e1f637a2401df452916d3994215ebc86b6cac829b6ab1be", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778362236, "uuid": "92414068-511d-4555-aa70-b7cf808350a5", "comment": "Malware payload", "value": "5eb89f9c585650f4d484bf3d39db69a958d339e4", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778362236, "uuid": "da7366a6-3b06-40c3-bf0d-f1342a1a62e5", "comment": "Malware payload", "value": "cbd08b9ed37354567faf20286372620097c5b0e8d1ab6c109e1aa3817d41bf683b2e3f7764ba8ffda5e85b6ccee78acb", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778362236, "uuid": "c6487aaf-a25f-4ca6-b1f8-fbde8783ac29", "value": "T146E4E126EB9914F9E177C13CC9664A06EB727C5607606ACF33900ADA2F27BE41D3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778362236, "uuid": "aa9e585f-3fe9-472b-beff-17323d5a8558", "value": "4bfc91f3e74bbb889bcf3811fa31cc44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778362236, "uuid": "edc62ceb-14da-4188-84f0-6e021c5c9157", "value": "12288:zh83570Nyl4FGwNf6fhXCQIdjMySm8ohtSy5z1Df2ZAP:N259I/8CQIdlSMtXxx2ZAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778362236, "uuid": "4109a5d8-4660-4399-ad6c-db222db25c4f", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778362236, "uuid": "e55e5e97-c2e2-4650-840e-518af7ff966e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778362236, "uuid": "7a40f0f7-cc91-4d38-ac8b-d22a9241d741", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a3a826-4b92-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778322989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778322989, "uuid": "3a361cd6-c030-4db2-9ba3-fcd709e45679", "comment": "Malware payload (Mirai)", "value": "fd22d7c637c8bf14fc0994ff5cb70d24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778322989, "uuid": "40ce6cf0-5ab4-4f78-af9e-4c748753eb8d", "comment": "Malware payload (Mirai)", "value": "2436e8dd5d8e08537c5c0e79bc645ad4498937d66da6ebdfad385e22c8dfd85d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778322989, "uuid": "296bfe84-8483-4c78-9057-8487d10ca614", "comment": "Malware payload (Mirai)", "value": "570556f89bbc7dcf96d6542b7e25fb319e6fb6b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778322989, "uuid": "9b88d985-e759-41e7-9ac5-8c17ca596bb2", "comment": "Malware payload (Mirai)", "value": "78c39a991233dc069392ec6c1e9837335dadf20b387389b1fddf2546b0371402206d8ae4dc0b64d48f6d4b87c6077802", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778322989, "uuid": "2d29e71a-8de2-4820-9fdc-7be0935c7458", "value": "T1F7F33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778322989, "uuid": "e1964f8f-1301-4693-bdb3-18d702368f2f", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHPfam:9FJMgWPZr8IaCWReS1WpPeQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778322989, "uuid": "99142829-5d29-472e-98fe-5e28721c29e8", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778322989, "uuid": "7c8ce737-b382-4314-9a29-6845ceeb31e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778322989, "uuid": "1d666363-8b90-441d-8e3f-f8e02af2744c", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c546092-4bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778342014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342014, "uuid": "d39f057a-4e41-4ee5-a0ec-091ddd8f1528", "comment": "Malware payload (Mirai)", "value": "7c9a7a68d2a1e483bd577c085d104485", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342014, "uuid": "dc72338b-610b-4aad-833d-101e379b1863", "comment": "Malware payload (Mirai)", "value": "2449bf050b16f29ac8db26559e82ae8a0aebe497a9d406d446bffe7fd7c1c24d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342014, "uuid": "a1064dd8-f16a-4e86-9041-4f81e2fc49c9", "comment": "Malware payload (Mirai)", "value": "98d4dd6ff2fc7f4faffc9c433b350ca064e67c6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342014, "uuid": "72c770ab-c1a9-4bf3-85ec-a78e0a167aab", "comment": "Malware payload (Mirai)", "value": "768874bdcb902b2b0d64524f8030b3ead5d5dd7dc4fda68593973429fe677419f34d5382e0f9e419e82ecb4f17c17bc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342014, "uuid": "79dfded2-2d86-485b-b317-68681d7299cf", "value": "T16B266CA8BC1CB552DEC87AB43B6541D5B235FC48AF41C7277614BBADA9F23548F22320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342014, "uuid": "0058ca28-f386-4ae5-a7b0-f6b7a22da819", "value": "24576:+DNK6Fxw1aDV2IDWZrH2+6wM16tIoRbTCcAHbnSw2sOk5cvE7SCfTqXk59yjyuzT:+Ddwl27DoRbTCcS92sOds75EnEVPvVfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778342014, "uuid": "08981143-ef37-4743-809d-a4554eaf4a88", "value": 4849816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778342014, "uuid": "0287b55b-e83f-418b-ba8d-ea2e8e2baff8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342014, "uuid": "ac9be81a-9730-42aa-8794-480d0f96dffa", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d1ed97-4bae-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1778334759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334759, "uuid": "1e32b6b1-de00-4c2e-9159-c65699f8bf4e", "comment": "Malware payload (LummaStealer)", "value": "5f2b25f69dca7b6c31f9a72271801b38", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334759, "uuid": "cc2b59d2-2692-4daa-b4aa-3ea375108ebd", "comment": "Malware payload (LummaStealer)", "value": "24614d868fb7777708a033040e69ad14e7bcbd2298786c502a86203c6d1b560c", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334759, "uuid": "63dd6d43-e03d-4b0d-8282-2aaa041c86bb", "comment": "Malware payload (LummaStealer)", "value": "7dfa42d641dda48d3ea94b5ac7daab4d179ed4ee", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334759, "uuid": "8f94a26c-05c4-49fc-b4e6-7c001ee09ae5", "comment": "Malware payload (LummaStealer)", "value": "010d46c12854a62b4a72283f1d162c12c833c316a9d801d8f8da938424f5611d82f2fec5ad3ca5c32048ad8f8451dfbd", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334759, "uuid": "a5a6569b-e50d-4a02-8cca-1eb7c2639190", "value": "T13ED5782A226CB7F5D7BD847AB3C32830F737AA802B10A34FA835D45D1CE68B75159B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334759, "uuid": "8ae487a2-ca4a-40b2-aac1-aa4710ba3ece", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334759, "uuid": "9c194a08-38fc-4d2d-bdeb-979e36b44abd", "value": "49152:ljWYzXYzpmchqG9ucmsp4F2jX6s/Y1cZSA5Z:MYzXYzpmchqhcVp4I6sQ1csaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778334759, "uuid": "7daf7497-40ee-4d76-b876-fd3b7de5043c", "value": 2781184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778334759, "uuid": "2afa12e5-d862-4a7f-9acd-f7d2db8594d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334759, "uuid": "2ffd2b47-2e03-4ad0-9586-b2035d9ba1c3", "value": "Setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f764006b-4ba0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778329014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329014, "uuid": "5650ea46-e149-4d70-a410-185fd9a454dc", "comment": "Malware payload (Mirai)", "value": "bc1ff0174d8de244d8f2d08d8a9f0bd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329014, "uuid": "d41f6dd9-d4a4-4be8-999e-c36a42dc2043", "comment": "Malware payload (Mirai)", "value": "2511ae02b571575a01a9021f88e131f1ff0df3e17e96d385815cbf41c957f642", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329014, "uuid": "ec5790dd-dc3e-4265-9b8d-661ab3da636e", "comment": "Malware payload (Mirai)", "value": "3cd14273a8dacd77e89ac7345b7ede8708d174bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329014, "uuid": "4ea58e97-326f-4a45-b889-f9d3faeff47d", "comment": "Malware payload (Mirai)", "value": "1ef7c47109272e4a9829d97dae720ce174d21017b5053076665c95ae7eeaa5b1b5d0e50c59009a6bba7898f35f949b97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329014, "uuid": "8f39fcc6-6f12-4653-b2f4-d6bc8828e175", "value": "T1D733F2BB427EEBF2C473E4710E0D9499B5386D798D211F7A8BC4E3311A277815B50953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329014, "uuid": "038c1622-4e77-4022-830a-0821de533e33", "value": "768:F345fjQHshoiFRHaZhZ6Y0axIQoT+McMphwb2MUzU35XYlsZoDs9g08Vx0H7:FoREeE2CoT7n5MKU35XYajg0gM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778329014, "uuid": "a99dc099-2fb6-42f5-9d37-05235aa731fa", "value": 54332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778329014, "uuid": "881ec473-b8f2-4595-904c-a73a7b404d53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329014, "uuid": "b3005581-324b-4913-a974-5bfaa201d412", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d97d6d-4b8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778319938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778319938, "uuid": "7953e54b-82a6-4599-ba69-2b55d4e058e5", "comment": "Malware payload", "value": "9153a9d0f7e89641f0030685b633ad0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778319938, "uuid": "d6801c9e-7b4b-427c-904b-52500d31b8e7", "comment": "Malware payload", "value": "25d18a2bf31ff3ce40f2d042cbba8dc5a6cd4f680adcacc763c62d2e64168729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778319938, "uuid": "b0888027-8d6c-40be-949e-df0cf1be9d29", "comment": "Malware payload", "value": "7d7089025ebf35fce5198ab33cfc7a480d41e779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778319938, "uuid": "4866e72d-edd8-4229-86fa-3f6457249c42", "comment": "Malware payload", "value": "773a131d99227756abf913e285488a7068f8c2f2106ed3304d2bdc91eb7fdb4078ca0962caef332ef2dfcd38b8e7481c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778319938, "uuid": "dca4ae78-c981-46e6-ab14-4d66c0e261e9", "value": "T15FC73337F298993FD12497315AB28161553B7A11BC02CD4E92EC78D8CF762A13E3B64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778319938, "uuid": "5bc30ad4-8024-4146-825f-8c568c9df577", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778319938, "uuid": "3fbe45bf-5c80-45a7-9cef-1541bd3c77b3", "value": "1572864:oZT5vQnGbS5OtUIYjFbUTtp3+ngP5VsVkU4:oZTVLZuFbQlPjs+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778319938, "uuid": "3a88adb7-d077-4990-80e9-ad08c60abd89", "value": 56584656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778319938, "uuid": "ab2745a1-f83e-4738-91d5-957744e32670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778319938, "uuid": "83755a6f-259d-4103-986d-9751b4096032", "value": "OficioDigital.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc62f1a2-4bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778349155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349155, "uuid": "5b3d21ec-a50e-4a8e-9c78-50d89665b50d", "comment": "Malware payload (Mirai)", "value": "956dbe51ece451c7520381c79e4d3a86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349155, "uuid": "b6e8cb09-05d9-4480-8399-d07ed0816c32", "comment": "Malware payload (Mirai)", "value": "25fa0596593c87f5bc954514e3b9137134fd9f055a978f9b4300a686c019091a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349155, "uuid": "e2b59eb7-fb44-4c21-83bd-a43401c7b6b1", "comment": "Malware payload (Mirai)", "value": "385473115d9f3ab7d95f42a204a43ad654b5c9f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349155, "uuid": "a3faa600-4f90-4a29-bbbc-c7c55bda6675", "comment": "Malware payload (Mirai)", "value": "056fda710c6314b059942c56dee10e623f1324aed614a6d0828c964e6534dc9112f48c6696495c8f89d1bbf77ad22352", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349155, "uuid": "d95d6fcf-6a85-40d8-9efe-163c51fe2043", "value": "T186C34B86FDD28A02C6C61AB7BA6E428D372513B8D3DF3103DD111F65738A85B0E3BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349155, "uuid": "1d431663-765e-43dc-90ec-860a40857038", "value": "1536:79Xm+UGbcar25qngGwTtpXjTKcyFM9tL25HgNEbMLcPXyuHfljkMIvPOFhtNk7An:79Xm+XbcimTb/KPMcAEbEcP7j4yP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778349155, "uuid": "441b3e06-58b3-4da6-ae14-1e256893c44a", "value": 120760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778349155, "uuid": "b1365c56-aaeb-4d8a-887e-d367c1c584cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349155, "uuid": "acece704-fcf9-48be-92e8-cfda93ccecc5", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cad61ba-4bd9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778353209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778353209, "uuid": "094b2930-67e1-4177-b627-dfdaad8a9f92", "comment": "Malware payload (Mirai)", "value": "dc05b0ec4f5ec0159a5d89a650d60ee6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778353209, "uuid": "59bbef8c-e489-4769-b63a-4992fbe9911e", "comment": "Malware payload (Mirai)", "value": "2708d76730f4f5fed2f4da89a96454e9eebbeca6ddfadbecf827281780e1c787", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778353209, "uuid": "7078ed9b-fc80-4209-991d-b8b5a88239ac", "comment": "Malware payload (Mirai)", "value": "84caa9843b95b9a8d6765d43c0777c151f1a7e5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778353209, "uuid": "b8f0b09f-7c01-409b-95fb-fa65f46352f8", "comment": "Malware payload (Mirai)", "value": "04db49ef4b4ab0fa882af72812d98f51490411634edb788f15ee52047b81d84df76237805168252b0fe7743dee834891", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778353209, "uuid": "1532d491-9d85-4632-b9a8-f47e9b093545", "value": "T193E37CD2B402EEEFFC0B96B6445B0109B464B3617A530236B6D76C5FA93A0D06C5FF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778353209, "uuid": "0171ab7b-fed2-4752-9caa-761f6bf8ed8e", "value": "3072:YYM5koWJiYKRPvH7lHui3r8ypeiyz7C3V:YYGW+HH71uiIypvyz7C3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778353209, "uuid": "21c8dd26-3161-40f1-bf30-15df39a823b6", "value": 148252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778353209, "uuid": "824c101a-9eec-40e2-a7c3-55eb3e3f3bf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778353209, "uuid": "0cce645e-40e1-4300-8206-46e9a2e5d7b6", "value": "debug.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cf286f-4bbb-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1778340331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778340331, "uuid": "ec6529c7-8d05-4316-90aa-972688cf2f75", "comment": "Malware payload (QuasarRAT)", "value": "8887cf5ddfaa6daabc64b29454da9493", "object_relation": "md5", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778340331, "uuid": "eacd40d0-f14f-4e9b-af81-f4bd4df43b7a", "comment": "Malware payload (QuasarRAT)", "value": "279cffbda7c1a6ba3d06bebc931517b5a8df11c69a02e1dba63a023c2c79fd7e", "object_relation": "sha256", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778340331, "uuid": "8d3f6e3b-fcb0-42e3-8a58-aef42d01010c", "comment": "Malware payload (QuasarRAT)", "value": "168931e5103a7b836ec45519975ed64294e3a2a6", "object_relation": "sha1", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778340331, "uuid": "92783ecf-e33c-4a6e-8292-9d980cc657d6", "comment": "Malware payload (QuasarRAT)", "value": "f34850e55b07563f9f2a4ec03503c0303f5106f5eb6ccc515ed67d55f8cb03fe57de89c53504792d08db3159ae241e38", "object_relation": "sha3-384", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778340331, "uuid": "fd0053ae-58cc-42ab-b116-670d06e97d6b", "value": "T1F5E56B0437F85E76E16BE6B7D5B1501263F0F82AF363EB1B2581A77A1C53B4088426B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778340331, "uuid": "6b5fd44d-9be8-4b6e-9a73-1b6bd8c7250c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778340331, "uuid": "a6e7c0b3-227b-4b80-80bb-f4f0483fdacc", "value": "49152:cvVzn3r24paQe+GPhlz1Tt6U7PkDu1PuoGdr4THHB72eh2NT:cvtr24paQe+GPhlz1TwU7PkDu1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778340331, "uuid": "8bc59b03-80f0-4980-ae09-dbfe33b91514", "value": 3280384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778340331, "uuid": "95d7f069-16bc-4bdf-b660-14d4c8adfbca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778340331, "uuid": "ee91d19e-7022-4ab4-abd3-0d0edcd43716", "value": "Security_Update_Chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f10db2e-4bd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778349320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349320, "uuid": "1d73196c-a00a-4abd-b616-04e64db4682f", "comment": "Malware payload (Mirai)", "value": "c79531e7133554472a0dfca8a03d2105", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349320, "uuid": "3d5a3d9f-bcf6-4e9b-81bb-385d2a0a08d3", "comment": "Malware payload (Mirai)", "value": "296daf3565d56d80065162c52c0fbc4cf24d7fd0be66da6654acce44d26ee8e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349320, "uuid": "f7974970-3cb9-4405-a8a9-56da7833ba74", "comment": "Malware payload (Mirai)", "value": "7cc95c1920b7f7909b9f13f271d05eee8bbac674", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349320, "uuid": "5ddd7fdb-2745-437d-903d-fc5d8f72a61e", "comment": "Malware payload (Mirai)", "value": "2c34ff79045d58ae8d810c3bcd6d24f83339f9e8bc93c2af044bf9694df7d7004a91fe9c2fb07de57daddf03a074816c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349320, "uuid": "b96449b5-add6-47f2-b027-c830060d51ae", "value": "T1A2D39D62A5325CA8C12781B47035DAB55373972283031CF7A9A5CA7D8187EDEF63E3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349320, "uuid": "86c9d2f8-bbe0-416d-aa4a-a4053bc4121e", "value": "3072:r9bkS4Z5n0+59alwnfLcscRTIE0cc+5uEaBK:Zs0c9cRTIlu5uEaBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778349320, "uuid": "f3cbd40b-c5c8-4e1e-ae35-cfdb37faaf96", "value": 137200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778349320, "uuid": "2b27a1c0-c54f-4031-b74b-cd35d74215c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349320, "uuid": "7b167e59-efe1-4728-a79a-aa6685e57866", "value": "debug.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d485c84-4bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778342016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342016, "uuid": "a895bf07-a41c-4288-986c-dd00828c6473", "comment": "Malware payload (Mirai)", "value": "2c381ea12be5f3b86fe16cb4d406daa7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342016, "uuid": "a99e7daf-c02c-422b-becb-22dbbb9e079a", "comment": "Malware payload (Mirai)", "value": "2994ead74f4154fff213fdf3de98b71968350f517ebc4a679a55dbd584067a10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342016, "uuid": "02255514-2338-4109-a9ce-e4c1e5cc6f65", "comment": "Malware payload (Mirai)", "value": "47f6d2ef365daebdb79791492b72fd5bd4cceb99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342016, "uuid": "ef3f1359-eb13-4a0c-a437-0b79492620e5", "comment": "Malware payload (Mirai)", "value": "34970b8ae67fa7e23a4f9a7f3df2ac1c3819859bbaa983a4400c0483dfbd7f52a686c266af4e0c7832575c8cce6b25ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342016, "uuid": "92f46e7b-dc6a-4f42-a86f-0f749af2c711", "value": "T15D361950FECB05F6E9031D3144ABA26F53315E098B24EBD7EA14BF29F977692193620C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342016, "uuid": "9978a7d2-4dca-42f1-8af9-d222f426e9ed", "value": "49152:gF2ItAqee7182S4P1EiiFV8YommyEW6Wcq2IxaWWNTfAhvn:A2ItzeqYXq3AJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778342016, "uuid": "5d14bdd9-9eae-443f-a7ce-3568750bf907", "value": 4886680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778342016, "uuid": "3f843e6d-7ca9-424b-9ecf-930ed1d2ab90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342016, "uuid": "5c42f6ae-02c9-4a26-b5a4-e31ddf59319b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52462783-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778331314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331314, "uuid": "242ce3f2-0fae-41c7-9d9c-05137c118d0a", "comment": "Malware payload", "value": "f71db13a3c6057307217166643e1b399", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331314, "uuid": "26ecbb68-84e0-48eb-8cda-e0bce2cefa6a", "comment": "Malware payload", "value": "29d6096e76b30122042441d654bd8144ca8d39e44ae15b1d8abea5661dab999c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331314, "uuid": "53815a25-f87f-48d3-97b3-66d36bb5081b", "comment": "Malware payload", "value": "37a16f02710dcf30aac24b95fa1e56078fad6ec8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331314, "uuid": "2fffc0e1-9c09-4481-9203-5d0fa6aec281", "comment": "Malware payload", "value": "2c008a685889196e699137204c51bdfb0161fc946890a98beb9cd8068f9bb08d14c294266da2f3bf288b8aae2a7e5623", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331314, "uuid": "08af39bd-cfb8-48e0-8e0a-cf9cc0d6c6bd", "value": "T1AD91FD6EA625CDB42D4CC07813AD9C08DE5F1C1FE246E40E720FA5547F9BBA882BD294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331314, "uuid": "7b84b489-4814-44e6-9041-8f73b93b9fd6", "value": "96:mhiSGbe3Yp37hvBzIX0bd0NNFGcrcBc3gjXuc2a:mhiSmeIpLpi0bONNFGzJuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331314, "uuid": "12421760-6863-472f-b931-8024da95b1cc", "value": 4245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331314, "uuid": "99bc2354-d34a-4328-8ec0-a9ca3dc988cd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331314, "uuid": "ab74b172-0bcb-4c8a-af19-4f4aa5e7b327", "value": "cr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56676d99-4b96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778324449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324449, "uuid": "d970088e-1325-43b8-b8de-faed0d0b8847", "comment": "Malware payload", "value": "95c7c0381f29707480b37c8fe399e697", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324449, "uuid": "fd7aa4a9-4fc8-414e-a23d-f16cb9ac7d15", "comment": "Malware payload", "value": "2a15f459e9e0e9d40fae724cf3a85c4a23745193f7df0665f03dd1cd31b358db", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324449, "uuid": "cd1c42e5-f9d8-4e92-bbe2-f76af95e6ad4", "comment": "Malware payload", "value": "e8cda09a74bb83398a66f89e08b910c690246658", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324449, "uuid": "51658a1b-b3c4-4139-9724-a7f96cfd94d2", "comment": "Malware payload", "value": "42d70da201c23796fdf9fd7c29963a47648c144b7e6fb0e00f00d7d8b9cd1efdcf9dc860f6c3697afdb2e67a0882fd50", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324449, "uuid": "9342bffe-c457-4956-99bc-b6e3d38bfa13", "value": "T161927D0FB9514315D5C00474A5B2873FD6BA9476338454EFFBD88ACA1B682EAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324449, "uuid": "eeefa646-7e27-446d-aa0f-d309b0e146c6", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324449, "uuid": "2c0d7d9d-1d40-474b-afb6-50a05ca78658", "value": "384:oIkjLVlvadxqSDO5wtT0vu98t2rFJ/Bgav8U9cTG:8qx3600G9oJa0UyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778324449, "uuid": "f4cb5354-c4fd-43db-82ac-44aa18ca718d", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778324449, "uuid": "a8787d97-74fa-46c1-88b5-d5f89f901883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324449, "uuid": "705fca53-5762-4b90-a93b-054eb55d020b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e82b13-4bd6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778352144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352144, "uuid": "003f3356-4398-4e58-a75a-a5c500427bb1", "comment": "Malware payload (Mirai)", "value": "66f10de6179ac0b1fb622fd1d9c51fb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352144, "uuid": "da7dd698-f546-454c-92a2-2695bea7f5f0", "comment": "Malware payload (Mirai)", "value": "2a2501700478465ffd946a667356de01a1bf7f7acce55cf2ea1ae92cdb4edc0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352144, "uuid": "4d310b0f-2af9-49f8-9b8f-89b25197c4e4", "comment": "Malware payload (Mirai)", "value": "84c27099db0da3d91caed0b2678bb2d9d68d7f3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352144, "uuid": "b027e2c2-79e3-410a-adbb-20829c6e7198", "comment": "Malware payload (Mirai)", "value": "123398402031debbf237b3b49a176596fc13741d1129ef85ab0884bd30c34ca5e29b1563073e9d0b8ae57d190cbf5415", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352144, "uuid": "babaf5c9-5e15-4577-87fb-62dae6fba322", "value": "T13DF3C64E6E219FBEF768837557B38E70A3A823D622D0C585E17CD5211F6034E612FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352144, "uuid": "6d080400-3a6f-41f2-8be6-85ec5d8a8be5", "value": "3072:SXpf84saZUPRk2z5x2/WGDno0zsMMc4AI8GpK5J/JhTJbog:6faaZsAwpohzbog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778352144, "uuid": "90f9d71f-2f37-4de0-9698-665e2307c271", "value": 164244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778352144, "uuid": "073ee1fd-741f-4b07-ac15-84af1534a87d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352144, "uuid": "e6f1d7cb-214f-4a43-b263-c8dfd91965ea", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8114576-4ba0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778329015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329015, "uuid": "a673f1a8-6af2-45ef-89fa-9c2b58915a85", "comment": "Malware payload (Mirai)", "value": "d832d20ac1055f8e870335a9406ab37b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329015, "uuid": "91ddfcaa-ec18-4ea7-ba1b-cb054a1c611b", "comment": "Malware payload (Mirai)", "value": "2a2974ccdd715e1fdaacf1e65ee8a54568a306c07c53a67a8f81ba129244fa21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329015, "uuid": "45fd42ec-6b7a-4c71-9b6c-8bf94775957f", "comment": "Malware payload (Mirai)", "value": "caaebd3fcfed9a2d874f24d55e30b94bd559aaeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329015, "uuid": "116ddf4d-94fc-4499-9445-d66fe7be6cb5", "comment": "Malware payload (Mirai)", "value": "7ee73190b03e2a2775d99fca0888c71e5ee86ace3222cc205d0ab6f35562797007d36f2e34aa844e20e11939487d7142", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329015, "uuid": "bd58d3ac-7c95-4dae-b871-a65ac1636dbe", "value": "T1A5C3F185BB6369D1C1A242BDA4C00AC387916E318BE317080699F774387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329015, "uuid": "b5103002-5204-4dae-9f04-b60431fa8cd2", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnk:0OCDjXG9qTWywxlxTnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778329015, "uuid": "cdce1aa0-0e32-47aa-afc9-ec54ee15597e", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778329015, "uuid": "653f4e39-571b-4152-9f6f-d608cd39c398", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329015, "uuid": "1710d4f6-6ed5-4fe9-9ee3-20d39a22abf8", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e40c7c-4ba5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778330996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330996, "uuid": "52dfd10e-f2fa-48a9-bbb9-766ba6a4a09d", "comment": "Malware payload (Mirai)", "value": "cb6226375ef6fa28cc10004c1a6e2c6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330996, "uuid": "66d5ebc9-3f8c-4460-8a41-a8ebca20725b", "comment": "Malware payload (Mirai)", "value": "2abfd77fcd81e97c70c03c519fa23de09967971887eb5d73e118bc87b2a7e230", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330996, "uuid": "f575dc27-8b55-4cf2-9e59-048a8eceb5a3", "comment": "Malware payload (Mirai)", "value": "ab15dc61666981f4700e66ab0e65c4eba553ef00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330996, "uuid": "b4da1c5c-a7e7-4340-8692-4a01b25298db", "comment": "Malware payload (Mirai)", "value": "a95cb393e87463f583ddc1d3d94b461e478d8f5880ede71ae4dd20bd1040a131b7468c8032cbf2b7e264fe2f81d05aac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330996, "uuid": "46940ac7-96c0-4558-a883-dd65550608d4", "value": "T10783E856FD45DA93C6DC24B5FC5F52CA3342A398D3EF352BEC154620128E2AE0E3AE54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330996, "uuid": "8dfa024f-871f-4aaa-9618-ec137c59885f", "value": "1536:a6SL2DPCaOMK9Qy8jhn4eVVFDHNgOMwA/QJGhIVaTp8JrMEb5dXfqefqgqe+YIqV:4CbCauQy8jh4eVuOvuhI68NXfqefqgqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778330996, "uuid": "456564b8-b3a0-4af3-a9c5-2759d15e48c1", "value": 83844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778330996, "uuid": "91856783-0a5e-4c42-8377-663b6f8a4dea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330996, "uuid": "2df4b1a1-de34-42a7-b43f-fb99b23e94f9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20beb0f-4ba2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778329837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329837, "uuid": "860a7639-10d8-40e6-ad6f-e3e796811454", "comment": "Malware payload", "value": "c1ea3843283b8a8785edae904634672f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329837, "uuid": "e72c01e6-8dd8-47b0-bb40-c464937fe9c0", "comment": "Malware payload", "value": "2b8f8f2de85ca660139442dd1ffa7616838e3060330d1fda0ab294bbf60bd175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329837, "uuid": "79ad046d-e26b-4dce-b863-083f1e316862", "comment": "Malware payload", "value": "e488ce1bb53bda0a158b311939fdfa01ffb4e3b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329837, "uuid": "b26c1f26-4cf7-4bdc-8ffd-13d113f4a310", "comment": "Malware payload", "value": "da80a714a8ab19666f423299f6283140c680c2efe9d35086d1ae10c73c68f0870fae480fb505b81967d2a77066dee585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329837, "uuid": "be57e9c7-5f44-4f76-a9c2-064af5e5497d", "value": "T1FCF7330D41B45279E6B605FD5785BF16B280F72A5338C1CA352F7E18F3E1A87A02EA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329837, "uuid": "b9f9e376-3dc8-4606-8a10-e4e5a5debc9b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329837, "uuid": "b100af03-c5b6-47cd-be42-d75bf973c5d2", "value": "1572864:5t9IKPA6o+33RWYjAXMlma5M+18psHmbDWwTPjYw3ScE7:5UKYAHRWeAFgjKsHoDnrjYf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778329837, "uuid": "e4c34fde-7559-4cbd-9e93-4a34a00d0bd1", "value": 76938433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778329837, "uuid": "73322476-41bf-4f35-89dd-981a64c5f9ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329837, "uuid": "b43a2482-34be-4d5a-a06c-eca3ca7e77d5", "value": "loader_3.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82235cec-4bd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778349862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349862, "uuid": "2a8222e7-254b-4fc4-9a54-cf1fed9c97bd", "comment": "Malware payload (Mirai)", "value": "f4eace8d8d54adbf8f651b22684d6158", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349862, "uuid": "2d905ef5-0cfb-4b7f-822a-15aeec5fdc6d", "comment": "Malware payload (Mirai)", "value": "2c187f01d2e7405f1d5446d6d95d04b898ae1fff4c6c0cf5b75b68d50b1300bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349862, "uuid": "23ee0b54-1cc2-4e50-a704-32e4fe5efff7", "comment": "Malware payload (Mirai)", "value": "db4c8e3ea44a46c6efcd9a361fc34640a5f79fa2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349862, "uuid": "9c8a9535-4b09-475c-8c99-3fc7731b7f2e", "comment": "Malware payload (Mirai)", "value": "26f07fb354de2a9338dd7d0183cbc634cde6a6f285ff65d6e29ecbdf7b1635327ef49783165933f04ce874ca2bf5b8b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349862, "uuid": "5d2a9052-3700-44dd-a93b-6f646cf94c07", "value": "T12F9308B1FA878AF6D40345F100F6B63F9B31F92E4435C1AAFB646EA1CB135C52246768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349862, "uuid": "d3bde3c5-0310-4927-aa7c-b8fe06bd2646", "value": "1536:HEOWi8wGIypuyfq+/asX4LWv6PVvtRSqRfi2TNCpsEsDxg:cihGzprfD/asXHS5tRbRKONCee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778349862, "uuid": "53446f62-036d-4fb4-8f48-4a040c6bf4cb", "value": 90408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778349862, "uuid": "61a82d4a-0113-48ec-9ec7-0b483c7d6d36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349862, "uuid": "1dce5619-4222-4ffd-89a3-5fd07fac2e94", "value": "zyre.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b224b5-4bb3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778336844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336844, "uuid": "f62b262f-02e3-4933-82a6-aa70dedb220b", "comment": "Malware payload", "value": "8cfbdf8f5af41f3ad20eaea6bf04b0a7", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336844, "uuid": "081452eb-8476-4373-8d7a-9e2edd92a3a3", "comment": "Malware payload", "value": "2c38a3a0ffada9e1b029df2d22551c340f9dd67b7e7d2aab9bd293cdd602846e", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336844, "uuid": "b7598105-2125-44f2-addd-09e259b26a04", "comment": "Malware payload", "value": "7788677063dbee6871f04b31bf7e3a415545bd14", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336844, "uuid": "835a5ffa-8943-4396-a548-ce3d34f580f2", "comment": "Malware payload", "value": "783e39bf3feb43ac68ee1bbd49a77777288a741342f9456efe899d4ffcd48b04ed195d776e563135ecebfc7233d3f225", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336844, "uuid": "ef88519f-c017-4347-9abf-da7e6248a99f", "value": "T166463325EAF9D837C160C4789C42C6E18978B9783C274881F9F93DE67E164AA738534F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336844, "uuid": "fda776ee-c131-4339-b05d-17ab19cc3b8a", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336844, "uuid": "e374b36b-ba78-4dc7-86ff-369cc6c9420f", "value": "98304:4AzavCwFpqsA6YI/ozygaMfBvl2TymJa42wFpqsA6YI/ozygaMfBvl2Tyr1:lWvCwmZ9I/ozyjAl2TymJa42wmZ9I/on", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778336844, "uuid": "118fd60e-7f20-4d60-9403-9e2f4eb4699d", "value": 5754728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778336844, "uuid": "dc8a1c93-4786-4089-b21b-b04812aa5592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336844, "uuid": "f39e62d7-1979-4c2d-9791-b0d5b23a9d69", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d04ff7b-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778331251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331251, "uuid": "546fe5f6-d17e-4606-ba4e-ec9348563fbc", "comment": "Malware payload", "value": "4f543f5ee47ba7150036f3be1bd6ee9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331251, "uuid": "1483efc5-3e77-444f-9577-e7398523a3f5", "comment": "Malware payload", "value": "2d47e765a18e89bab6c3acac66c3ddb47c004c42e6d3230c5a7a102f2f424ce7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331251, "uuid": "ad83d807-eaaf-442e-ae57-268f95ecc69b", "comment": "Malware payload", "value": "036b91f2d05cfbf9dca058853c53b9b0c2134050", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331251, "uuid": "4ac77f70-62ff-4089-8466-a18b9f68a494", "comment": "Malware payload", "value": "189594970881e73ab6283b108e67bfd3469e3ef99de30e727ea316c824e2b747cd49944f617e1043cb4a3e76cfcc851a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331251, "uuid": "807a5222-e80f-4381-94b5-e4451c78b3af", "value": "T190466C4BF5A364FCC1ABC434475BD9A7BA30345802257E7B7694DA302E23F605B69F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331251, "uuid": "bf210041-81bf-4a85-8c1d-6dd75f580944", "value": "98304:6I6MUZuk9I7rX0G0weD2IzSkw/EvQcm7XMo1tLc+SR34CETbNf56Pf+GN2fBJJJs:6IZiULKUThIPGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331251, "uuid": "d8a0a925-891f-4078-81b5-454a06f33d1b", "value": 5564896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331251, "uuid": "69e970c9-7ada-4d2f-a929-12e98badda3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331251, "uuid": "0fe0d11b-5ecf-41f4-84b3-2615cff70012", "value": "javae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15bca605-4ba1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778329065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329065, "uuid": "3ac2629a-2f9a-431b-86ed-3b40e5194295", "comment": "Malware payload (Mirai)", "value": "89082638f8afbbec9b5643752aea423d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329065, "uuid": "0d453d24-bc42-4122-9084-1194829dc8ce", "comment": "Malware payload (Mirai)", "value": "2dd04925cddef834742fdb7cb7cba25829ff7d43a15e5a7028e42c1925e0c137", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329065, "uuid": "688b5df1-d230-471f-8ed3-2af4e02d2faa", "comment": "Malware payload (Mirai)", "value": "fe74f1f9c5bb2b7907ff5e15be89aa1951ce4560", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329065, "uuid": "6d00d21e-29e1-4ac0-a0ac-be0b1e6bfaf8", "comment": "Malware payload (Mirai)", "value": "ecd957d1f80c26bbeb587474041eb9c2b45dafe983009fe43bf7b222beed67952e92c66ca8790ba50fe66ce4b594b62e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329065, "uuid": "e3a5b067-f416-48f4-850b-0243421db282", "value": "T10AE34A0BB4C194FDC4DAC1740BAEB53BD931F09D1238B25B27D8AB266E4DE301E1DA58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329065, "uuid": "f69b002f-5c03-4da8-952d-58665e44683b", "value": "3072:sE6P9AaWQWhDGnpRldmofXXjzkeHPCjVopROmd:sE6P9Aa13LnzHPCj4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778329065, "uuid": "b388590c-b7a1-4fc0-8070-2298653b6cf9", "value": 147352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778329065, "uuid": "60ae4fd6-3da1-4121-b9d2-81d5a7150d94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329065, "uuid": "6afa0b7c-b0d3-44fe-8332-ad0e46983ed8", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f18918b-4bb1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778336087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336087, "uuid": "6c91add7-1d56-4bcd-8008-4ad88bfb34d9", "comment": "Malware payload", "value": "8048bb94381a8409f1e152b1f9d2ed3b", "object_relation": "md5", "Tag": [ { "name": "185-102-115-17", "colour": "#D4F2C4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336087, "uuid": "4c00e748-5f48-44b6-b985-20a5922fff66", "comment": "Malware payload", "value": "30483602b9f632e1192985b58aa0e7f8ee2286daef6c35abd13020779394e918", "object_relation": "sha256", "Tag": [ { "name": "185-102-115-17", "colour": "#D4F2C4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336087, "uuid": "0a027215-794e-4528-ba26-016e65e1c9ab", "comment": "Malware payload", "value": "a6e3fe879864165cd8ea696902cd1f4c2fb57137", "object_relation": "sha1", "Tag": [ { "name": "185-102-115-17", "colour": "#D4F2C4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336087, "uuid": "dfe61c68-855f-46d9-bb93-9ddc1ab8536d", "comment": "Malware payload", "value": "b068f58697a479e39efa7578fdf5bbaa47cf78ec76d1730cd07b9b9937da6c8d742fa98cb4dd589b2e1984eb425a116e", "object_relation": "sha3-384", "Tag": [ { "name": "185-102-115-17", "colour": "#D4F2C4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336087, "uuid": "5ee9dfaa-1016-4136-81d3-1f1d7f09fd0d", "value": "T19F6508DFBA2C62E0D8116FFA96816D11A7E07C90799B408ED1A2F7D7CD35943BF28142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336087, "uuid": "ba7105f6-359a-4b69-b868-16bee7b5d8db", "value": "24576:zDT5SsOAptC8aP9i2RE7/29Um8elGE2qntmk+xZyRro:bL3L+i2ikUm8eYHoAkCero", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778336087, "uuid": "85c0e721-8939-4fda-bc56-5cdcccc76c6e", "value": 1466688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778336087, "uuid": "a4b37cbd-84c8-4d88-89b7-73a50008474b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336087, "uuid": "eb28fd45-eeeb-4cd8-8f47-7484e0f0f993", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08bdf2a-4b46-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1778290267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778290267, "uuid": "d12a5a06-47ed-4435-896a-5b711dbf49aa", "comment": "Malware payload (Vidar)", "value": "9929dd9b673b7531cffcf3da5324c8ae", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778290267, "uuid": "ba035f0e-d5a5-4a54-91d0-3a237edde49c", "comment": "Malware payload (Vidar)", "value": "3339def7f554fc59bbf2658e323167188d579e379502f2c508c04bf3656a9e6e", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778290267, "uuid": "aed16b11-6958-4167-ae32-e97bce56741c", "comment": "Malware payload (Vidar)", "value": "28eda4d556e488009d6e9125d4eb3c0f60c1a553", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778290267, "uuid": "d559be0f-8adf-4587-82c8-a7ea054ddfa7", "comment": "Malware payload (Vidar)", "value": "756df91f3539ce87a74ee03b2cfc80b7d07f7e8d84f29ffcbf5b0d342e2bda93af21313f79861d0fb0ef37bd86a7ccd5", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778290267, "uuid": "8482d7ae-8b7d-44ec-9f47-a29e5725fd8e", "value": "T1EC24224219D8F34CDFB70EBCF7FE0A066312553C5912576CED5A04BDE92A71A2B0A4E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778290267, "uuid": "091640fa-fcc9-4b02-8de1-b26839e7c7eb", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778290267, "uuid": "459d0523-9a1f-4d79-8eaa-1b5c3dc72c2f", "value": "6144:9iaxy8ToWsMuMc9E33dKrbnYPJzdphvpY2MiZXjkIKJ:9Kf4C9Sdc01VexQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778290267, "uuid": "40bd4d8a-aa7a-418c-ba3c-7aa183f93cc3", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778290267, "uuid": "493cc1cd-38b4-4f9f-a70c-fd9b06872240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778290267, "uuid": "70fca4e7-055b-40b5-8227-b91081d8184b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7da312-4bf5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778365315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778365315, "uuid": "78cf097d-f41e-4ea0-96d7-0be7a45f626f", "comment": "Malware payload", "value": "577adcce4252995cb557d04edad4d940", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778365315, "uuid": "14d90f74-faf2-424a-b2b1-0b6d95781760", "comment": "Malware payload", "value": "335395a76139e584b3c5b583d0db2c637f0ff7f48ded689a9596deb43e811119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778365315, "uuid": "0340c9b3-2bdb-47af-8647-15d2e9dcb296", "comment": "Malware payload", "value": "cdeb52ec40b5266fc82ff82762426483fc7279d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778365315, "uuid": "9843dd7e-925d-4133-b8f8-49a219d0a628", "comment": "Malware payload", "value": "8410b936be0b7756653ee9044845c763750f00e4a5f69a9239e71a75cfe8bcf4d95974b79f8f9a0e086e8333b6167cbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778365315, "uuid": "9dee1333-bf8c-4c78-93b3-a9954aaa776f", "value": "T129F733A97250D11BE3BC297A13906EF2B754F602ED3549CFA8AF70143E62486713E7C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778365315, "uuid": "f2903595-5cac-43cf-8f51-4b8e97fc9897", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778365315, "uuid": "df4a0490-15ea-4393-b54e-211e5e294a76", "value": "1572864:vt9IKPOoGBBMfaYlshbOJ0QREEM/PmTwMoA/hXhYrtzXRXcaL7:vUKWoGrcaYO9r/PmMeZXartzXRjL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778365315, "uuid": "b44fb6dd-7084-4425-adc0-ba6c17132bc4", "value": 77082552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778365315, "uuid": "859daaa7-2f2a-4f57-bc61-1f1cd6d5815b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778365315, "uuid": "2aeaa79b-9c08-4f6f-981d-af2a0c911acc", "value": "insstalerr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae9e7f9-4bfd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778368882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368882, "uuid": "032b5e6d-4a9b-4fd6-8d39-9f83493574ef", "comment": "Malware payload (Mirai)", "value": "639e5f8ba85c978350bc2c9688f6074d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368882, "uuid": "563fe055-aa95-4e7d-a084-5c33188c907e", "comment": "Malware payload (Mirai)", "value": "339102ccb1a85d2de4b7472e5b24f10b328bdb1fdb15cf4d9c81b5dc3c996676", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368882, "uuid": "3df70b32-507c-4b9c-a087-4a257fa52868", "comment": "Malware payload (Mirai)", "value": "1774b9ae8d5b835396542b47c12252c1247ab8ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368882, "uuid": "3376bdd2-9015-4683-9113-066bb1bc4e14", "comment": "Malware payload (Mirai)", "value": "b061a28fa782936bd0705cc326718be04c3c8c92a46726c40e4ab9d0f7d0b734ebb380a967809ccde54a0f806c38b718", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368882, "uuid": "4baa5e8e-d23d-4ceb-9fe8-7d3b58fcd22c", "value": "T160361A97B8824A83C4E43676B87E81C433A35EB99B9B53576D04FE3C3ABE1990D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368882, "uuid": "2036c8c0-973b-47ce-b6de-ddd6aa25a50c", "value": "49152:VV+w4QoJsuZbMBIn2W1pe4a0KJG1UkEK+yyroda:H+vZsIn2W1Va0Kc1DyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368882, "uuid": "41bed34a-f290-46a4-8e8d-531f8ee70402", "value": 4915200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368882, "uuid": "ff405b27-1ab5-4446-8324-1d4346a789c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368882, "uuid": "8d578a99-bcad-40c1-a89d-207d1a79b3ce", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6ed61b-4b86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778317585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778317585, "uuid": "5b3ff929-2783-4a79-8e91-bc7a20723d6a", "comment": "Malware payload", "value": "a7d381db9d51a82e925919fc8d2d4173", "object_relation": "md5", "Tag": [ { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778317585, "uuid": "092d6b37-56a6-4a96-a177-a9ff9fc8af88", "comment": "Malware payload", "value": "3415bc316b67dce38fda922a745014268d133a47a61a2afec0e563454488cc49", "object_relation": "sha256", "Tag": [ { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778317585, "uuid": "751ddaf9-3885-417f-8b76-3855bd38c54f", "comment": "Malware payload", "value": "bc83e6ccf54edd39f0ecd7e2388c68a9ee770ab1", "object_relation": "sha1", "Tag": [ { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778317585, "uuid": "745143d9-6f49-4035-8123-c2417e22ce68", "comment": "Malware payload", "value": "de114c578920c5612c6d4ac30d346267195c2ee9c73d2d1753f6c21a38a2cee86b495e6d913d8875d2cd7aeeb81b2771", "object_relation": "sha3-384", "Tag": [ { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778317585, "uuid": "4dd9b6bd-e7a8-42e3-94c2-1492b3182091", "value": "T111C5832596327DD9DA33A7BFE1AD4FC09114E4E4E509EE2957383FA49B9130A30B2C53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778317585, "uuid": "146a597d-d4e2-4d6f-860d-ccea2e3d62f2", "value": "49152:nMTAY/iB7XWJxJyXFNrYNVVrVry4KzGPBs:MTAYqB7GJCXrYTVhmvzMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778317585, "uuid": "19759776-bb26-44b2-851f-99b3b9b9cbc9", "value": 2715648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778317585, "uuid": "dfeb9b13-7428-4aea-bcc4-4ea5e61c9fd4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778317585, "uuid": "5c08f0a3-54d8-4696-8d7c-4d0778e6e3b1", "value": "App-Initializer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0274404a-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778331180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331180, "uuid": "8685a5c0-e29c-4ff2-8ca2-f6a71cb2d158", "comment": "Malware payload", "value": "28d05ef01686eb1467f397ad8392ede7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331180, "uuid": "cec261db-353a-4c7a-ac7f-d38a037b6471", "comment": "Malware payload", "value": "3542068a03b50e90576f937bd2bdb4b7a16b40a1bf164c64046caf8effe1aaac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331180, "uuid": "877c0aa6-2170-476f-854b-de54e4b734ff", "comment": "Malware payload", "value": "ad65bef49b5ba426af74b866f683a44d24ca44c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331180, "uuid": "c254eaab-f2c9-431b-99ec-2470b2b09294", "comment": "Malware payload", "value": "7cb4d4ff261762638d57034e685d9047926a2ae1ced6f12a9c985cbacae3f2ef6c24e92ede96ec1c19624aab64db2362", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331180, "uuid": "7e8eecac-403f-40bb-83e7-fd7faae1b4c1", "value": "T195D3D18CD1A89D1DDCF70477A773C8024DC935BC8748EE6718E8A2660EC4D91EB6DCA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331180, "uuid": "413524c3-4621-4386-a21b-b7bdf964feb2", "value": "3072:9zTldYISzbEYIPPjs99q+jPN6ihqrfdq+qhMfpJJfD3mrk52a6k:9zHYpyPPjs9pjPphqrfDqkJfDuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331180, "uuid": "1695d5bb-c898-4b13-9343-a73408d255f7", "value": 135723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331180, "uuid": "f981af8e-b1d1-4933-a6d2-9ccecd310690", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331180, "uuid": "2a39099d-118c-4e27-9cde-a374ac302722", "value": "bot.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b944dc-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778331179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331179, "uuid": "3b84759c-5f98-4562-a722-862b5a108274", "comment": "Malware payload", "value": "c488e6c55ebf1e8895baaf542ce33d3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331179, "uuid": "5f21fd34-ff5b-463e-a8fe-ff61291aecdf", "comment": "Malware payload", "value": "36d37df9206516c1918dfef16aacfa6d432f2ae59e6364c00d8d7076ab62dfc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331179, "uuid": "b52445df-7fff-45cf-9cb5-3d6196d47ac7", "comment": "Malware payload", "value": "7f2c7572e18f4044e9c8b92ebf71f339affdd870", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331179, "uuid": "7e193efe-f8f9-4b40-a04e-2f2a511aba78", "comment": "Malware payload", "value": "a29fd099af9845738d572490961f730bc6193037d4dc90654da774f3dc402ade1066cad560df03a52e30293288858ccc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331179, "uuid": "f583ce7c-4431-46e5-be2d-4be4256fda5c", "value": "T175E3F160E2CFAB22F6A7D2BD36514A97F05B2C904FA6C76898038B0C44DF9D4CE554E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331179, "uuid": "5b9e4a74-eafb-415c-8b8f-9fd9b11092ab", "value": "3072:JYPKPi+wZhWUnKMSDuj8cJI5jVC1GX/CbSgveBWu:ePKPih6mKMSijFQXqHe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331179, "uuid": "14fa275b-2168-4b81-8805-279a458a4e83", "value": 148912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331179, "uuid": "239eb983-8931-4dfd-afc7-4f4204b37b95", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331179, "uuid": "16a73281-b711-4717-8f77-0ca3a566ecd6", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2044d0f-4ba0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778329005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329005, "uuid": "1dddf49e-f61c-4a65-a70f-6af7dfed8505", "comment": "Malware payload (Mirai)", "value": "822c8af8b8264096b79ed46b3a8468a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329005, "uuid": "db0491d5-f423-4ecc-bb9f-ac34b3d45e21", "comment": "Malware payload (Mirai)", "value": "375805ba163e500f09028ab34e5e46263788110ccf406e51fec97537ad49bee5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329005, "uuid": "29560ff5-201f-4a53-a53c-b39a3cdb811d", "comment": "Malware payload (Mirai)", "value": "773fe3037cb484217a6675cdabea8af53bdc27c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329005, "uuid": "b136066f-e5fe-430e-a824-eba83808d100", "comment": "Malware payload (Mirai)", "value": "07246cdc56ba4645b012f5289a4ca864019aeef89b366d9ca85f1a94b3ee3009d1fda644ab36a84a3e03f753f3f46edf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329005, "uuid": "2e07ef14-432a-45c9-a483-1711e3dfa411", "value": "T16723F851F881862BCAD023BAB56E968D3720A3F4D3CB7627DD610B603AC651F4D67F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329005, "uuid": "4af455c5-b2dc-4366-964d-38cba54ebde1", "value": "768:3RDqHmxKwKStVKwsYLEILHe7CI2WxUz1a+yb54wUBSMXRpVyrWdiwt:3WmxCwskHef2Wxu1/wWSMrwrWdbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778329005, "uuid": "b5ff08de-1883-4fbe-83cd-16dae66a3268", "value": 47016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778329005, "uuid": "8a36477f-3e64-49d6-b096-28e933735fbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329005, "uuid": "7b0950eb-6086-4d38-800e-6ef1b650dda8", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0313a770-4baf-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1778335046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778335046, "uuid": "30f7e060-5c85-4724-be27-b68ba04fefbf", "comment": "Malware payload (RemusStealer)", "value": "c61f89c112cad4944fbcb9cbdab74a67", "object_relation": "md5", "Tag": [ { "name": "CrackZone", "colour": "#A3FA3B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "solidgma-biz", "colour": "#511BF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778335046, "uuid": "9c5bcb02-1507-4697-8590-2a4f8a8c2c1b", "comment": "Malware payload (RemusStealer)", "value": "3a96724448f1b86cb6024e6b2ad190b0e87752733176116c3df346af880c5145", "object_relation": "sha256", "Tag": [ { "name": "CrackZone", "colour": "#A3FA3B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "solidgma-biz", "colour": "#511BF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778335046, "uuid": "4bb37e7f-ddf0-4567-a682-f42cb970dfb7", "comment": "Malware payload (RemusStealer)", "value": "1ce341fde3208d9c9879e9a256d8f0fae0cbfe66", "object_relation": "sha1", "Tag": [ { "name": "CrackZone", "colour": "#A3FA3B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "solidgma-biz", "colour": "#511BF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778335046, "uuid": "cdfa1817-f1ca-4588-a135-fec365cbe7dd", "comment": "Malware payload (RemusStealer)", "value": "5be5140748aeaefa92f60390b23decb85a0758880fbc337d7b33c0f59d39896b99f49fbed6442af1887f93663c86c091", "object_relation": "sha3-384", "Tag": [ { "name": "CrackZone", "colour": "#A3FA3B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "solidgma-biz", "colour": "#511BF9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778335046, "uuid": "3fb46e5e-677f-4da5-9ced-54640c3ec28b", "value": "T1A3A57D477DD044BAC09AB33199F622957738F8080B3627D72E616E7A3E72BD05C7A748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778335046, "uuid": "f684b5db-ac28-4644-8fba-b58d45f319a5", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778335046, "uuid": "aff9e9ab-bfb3-466a-b487-b4ebf82817d1", "value": "24576:nUhrBOxOVrKKzCTSOlbo9S665jILchB0k0N2CzhFheletn92gODchsg:nUh9kGGSCTSOlbol40Azjm3tPsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778335046, "uuid": "13f4533d-c5cf-40b6-a609-f277590a84c1", "value": 2231872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778335046, "uuid": "30b8afe4-6295-4843-b4ea-5249403cc47a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778335046, "uuid": "75eceba1-c823-4a35-a1e8-cf543341f2ae", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8670f434-4b9f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778328395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328395, "uuid": "8917bfdf-1c4b-4c61-b44d-a1d51766efe2", "comment": "Malware payload (Mirai)", "value": "7ae139b3a529f0c73dd62dfc99e6370c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328395, "uuid": "ff2bc5fa-52b0-4dde-979a-93f8f4bd07af", "comment": "Malware payload (Mirai)", "value": "3afcf7fb250ed4cf125d69f55e741f40ad93d6e885c0497c37bddf583e02761e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328395, "uuid": "7b700fb5-8e0d-4270-93de-0712fc367bfa", "comment": "Malware payload (Mirai)", "value": "9d6cb104d03fc23b32dc0215292926fd00e4a718", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328395, "uuid": "383df5dd-2382-4efa-847c-946c119af76f", "comment": "Malware payload (Mirai)", "value": "c4acd4fc93d2f17d96d6aded16b915a19d4890a4524b9197ad15d650bb14d0ebcb9d17ce7fca18afe82ae1bc20ae3b82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328395, "uuid": "83edd0a7-c7b4-4a0d-bffa-f37a106ccb4e", "value": "T19A145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328395, "uuid": "33d5b6ce-9f17-47d0-85b7-7d4b540bd9a6", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXkUaN:HZ15BTYCrYq1QDY6V4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778328395, "uuid": "b798810b-db73-4dd3-b41c-4d765e36bd61", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778328395, "uuid": "68ab035a-e918-461f-9ee7-eb411ee70774", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328395, "uuid": "d802528c-9ba7-4ffe-a3ef-23086d673144", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4982e60-4bdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778355128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778355128, "uuid": "29f2b312-d0be-4dba-ad5b-e34ac02f9e2b", "comment": "Malware payload", "value": "2b7fa55d8eef0e780403413bac4e44dc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778355128, "uuid": "82c2588a-d2a0-4f85-81ab-a5265eaaea35", "comment": "Malware payload", "value": "3b9d2f4b65f0943e31221ae1d937ea29d3da8b556dd6b7c4d7846444d7ba3001", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778355128, "uuid": "6532b7bb-a635-4aff-b1e7-2bb259bc1c1e", "comment": "Malware payload", "value": "299c5429117ec3f08d4fb3b89320faff41a37650", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778355128, "uuid": "072425e6-0b25-4ff9-9694-d2c12ab2e8c1", "comment": "Malware payload", "value": "8badaca2d2134472c76a6cc441f5314329669a3af5c72a4419f1363a87a27a8fa8f9b19027d91c9360223c2bfd574e17", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778355128, "uuid": "49726b4a-0343-4b05-8ffa-1fb93606b73c", "value": "T19247220D4F610AAF016DA16E13AC0F0F97EC9D48016AC5555BEFA99A8D1EE0CB7097FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778355128, "uuid": "bacc0406-811a-498b-a448-fbe85d67ccd8", "value": "49152:ldUdqdYdjdKdBd2dMdEded3dGd5dFdSdzd6dMdZdYd9d0dLd9dxdSadodWdNd0dj:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778355128, "uuid": "4b44f7c5-efba-469b-921d-6feebd49b2a0", "value": 26891920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778355128, "uuid": "453f201b-5de3-44f3-9253-b9136dc6bd62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778355128, "uuid": "3f24dc77-1d3d-4e7e-8068-c86d28acda31", "value": "Michael_Williams_Taxdocs_2026.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051ed88d-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778331184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331184, "uuid": "c1d8fe2c-0e37-4502-919c-da26eae976a5", "comment": "Malware payload", "value": "10df2fd9548ed9814ee9d67a12d7e3d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331184, "uuid": "c3fd7c30-3e11-4acb-aeb1-9377288e0d0f", "comment": "Malware payload", "value": "3e2f1c9a8d34ec8d10cd604b70fc61c6bc593685495ea75e5732c0d25dfa9f24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331184, "uuid": "d45d178c-5f85-40fa-a06d-4b483fc56320", "comment": "Malware payload", "value": "6c32884f633770c128d95b4b6bad0dcf9dd6f867", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331184, "uuid": "1fcefc63-4483-4b0c-9210-ecdbb58d59d2", "comment": "Malware payload", "value": "19562b95faab1b040b6787505398d371a2d0278b05a37c4375fd37a85758384a033636a35d5a7c200b06e544b0535f59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331184, "uuid": "ed27fc56-2726-42c3-8fa7-adc8b7760b14", "value": "T101C3E1E64BA1F1B9E9859C704717DBCDDFB89E33450D85B9E07124B29CE013320BDA9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331184, "uuid": "7d907d3b-5950-4a10-9396-245f0cba7c6a", "value": "3072:1U/suahz+F8kyxw7OfRwKZwl4I4hemRGKUBg/rlw:1dLSNg9ww7RGKFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331184, "uuid": "907605c1-9080-44bc-84cb-f31883213c31", "value": 123505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331184, "uuid": "27c92c0d-1ec4-463b-8371-2c2d0fd3cb3c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331184, "uuid": "96af4123-cdba-4741-9bb6-ece1efd0ef8c", "value": "bot.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbdac2a2-4bfd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778368884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368884, "uuid": "54452e8d-2d71-4b77-8004-918298dc9c3f", "comment": "Malware payload (Mirai)", "value": "bc62dc6688a58ccefb9e072e9cc6a0f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368884, "uuid": "eeb6911d-4327-45e9-800b-58e3512f28bc", "comment": "Malware payload (Mirai)", "value": "3eda9cd25e467a10e6c9eeb061c20f4d7075e5d3ab91d1be59fdb7ad0087c8e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368884, "uuid": "7e13de64-6883-4793-abae-35bf35a9593c", "comment": "Malware payload (Mirai)", "value": "3cb127ee9235c7d02514fb38e7dfe83e3fa7cb66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368884, "uuid": "61dc60e9-84a0-423f-8a16-99f77a7cb8bf", "comment": "Malware payload (Mirai)", "value": "a89176926e8c0f5e603827574b3a5fb0cd6a778a310345479da31c7b2a05f19f1b57143e2d738b6180cfeed960ce2fa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368884, "uuid": "58467684-415c-42e3-ab82-8220bee1aed4", "value": "T186266CA9B81D7452EAC87EB86B2541D4B335FC49DF4183273614F7AEA9F2358CF21260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368884, "uuid": "aba3fc89-3b91-4712-9b6f-1f49f679d757", "value": "49152:/n8CzBkAfBxJi9f5OFK+g25PAx5Ek16g+E+y:/8CFDBxJi9f5OFKZ+PcEry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368884, "uuid": "dc5d4cc7-ae1f-4f45-9d10-4e3d4e18801a", "value": 4653056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368884, "uuid": "7813e7bd-e844-4c4c-841c-85a98630beb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368884, "uuid": "c54e2cbf-4b35-4736-870f-8a28601f489d", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9334bb2-4b9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778327165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327165, "uuid": "fa58b681-ff69-4d64-92f4-826db30342d2", "comment": "Malware payload", "value": "43d00ede8773e97bb9ed498ec42063f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327165, "uuid": "b4d459b5-717d-44bb-9db9-1816b97ce1be", "comment": "Malware payload", "value": "3f43819da97908bd2de104271f3e7232ebe20caf83ea8e2a71d0cc7ac2b53926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327165, "uuid": "6bb008b9-532a-4ea2-a95b-4ba921728a1a", "comment": "Malware payload", "value": "cfe1d78f6a169a3f6b7413e42fcaf6a6fa280d5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327165, "uuid": "263e2d30-35a3-40c0-bcd6-1e66ec0f9c99", "comment": "Malware payload", "value": "737dacdd2c0c2bb17ed215c85378d939072dfb5d3733c423db7b8bbc54de9168cde84844daa813bac64d56bae537ed9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778327165, "uuid": "79a3fc65-bfc7-487c-b065-c7fbbcab920f", "value": "T173F73345AF40AC9AF45DD1379AD09E06E5777C2929C14B8F13F80A752EA73C8893EB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778327165, "uuid": "ef6ea31a-5ffb-4fe6-8574-9885d74ca5c1", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778327165, "uuid": "b759310c-10a1-434e-a8af-9b6e2371ea02", "value": "1572864:LTIAim+vWlM9ojCrD4WWJvKSc/JUNncr0oZ/hvWvc3xgE715R:LCelKbDSc/iFQDhvWvc3P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778327165, "uuid": "256d10ec-55e1-49b6-97b1-871ae0dc1b04", "value": 72709755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778327165, "uuid": "324c0f4f-1610-49dd-95ea-272bcb07d619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778327165, "uuid": "e37be6b0-b030-4aed-82fc-a7564371c8f9", "value": "SexGame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb67afb-4bd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778352913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352913, "uuid": "a2bd53aa-12e2-47dd-808d-a5d34dac7174", "comment": "Malware payload (Mirai)", "value": "2af3e0d2329f5811b1c39f1150b0db10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352913, "uuid": "debd9749-b91d-49f0-b7af-bc5f94be784d", "comment": "Malware payload (Mirai)", "value": "3f7833a21077a28c230ea56c129a876ef34484808f3af4ee8d83df425991b892", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352913, "uuid": "64f36364-ba17-400f-b505-f6eaf3c198dc", "comment": "Malware payload (Mirai)", "value": "de5532f49084a110ae96d8b5a9560fa5b8fe620d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352913, "uuid": "80b50607-9ccc-4650-bcbe-e45a7f895e95", "comment": "Malware payload (Mirai)", "value": "0569b45e150136e296dbf578571eb645d9e1fef23e894f564d33f03e9969674b2e4e1e4b86b6b4ebbd27c0408a7f556d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352913, "uuid": "69b898ed-e87d-43ec-b31e-e9e28dfc8acf", "value": "T14ED35AD2F4029DAEFC0AE7B6805B0909B470B7117FD3167AA7D77E67A9360D09C26E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352913, "uuid": "1205c779-1664-416e-a778-426190217096", "value": "3072:A0Bfw2z+fHmrUOhwZIwOunssrmtBH2XdyJg7x:Xnz+v4w//qjHsyJmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778352913, "uuid": "ddeb75ee-dceb-4807-bbe7-6192f19953b2", "value": 134196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778352913, "uuid": "62e3d6c4-8084-4268-a71c-fb8a1512e285", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352913, "uuid": "781d14dd-b21b-4312-b1c3-41891f1484bb", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b04780-4b46-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1778290301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778290301, "uuid": "1ed8cae6-a7d5-47ed-ac38-7bf6a1a45a64", "comment": "Malware payload (Vidar)", "value": "4b73124cd33bafc506d102a316a63643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778290301, "uuid": "f11ddda0-2b44-4807-9204-e1da761ec18a", "comment": "Malware payload (Vidar)", "value": "3fa483f53405ca08a41ac9c0eae2d484b46001ea7df71c987dad848f3963e639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778290301, "uuid": "69893f36-8d08-442f-a94d-8c34a6bfedcb", "comment": "Malware payload (Vidar)", "value": "b24c19e20a4f055da39294652560004169765a8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778290301, "uuid": "7dd4b7be-f481-455e-8f70-3962084f2df3", "comment": "Malware payload (Vidar)", "value": "51225c16761998c37736b6631f18bb114ef2413cb3f1b28c9459705a1afcb789c0482b85185903c8abd8647eb5395753", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778290301, "uuid": "3b8b808c-f434-4adf-9632-29106cbdaf00", "value": "T1AED42ABD9C60E336F60CD0BAD287E7539F2138001236B99319BDA7241246572DB677EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778290301, "uuid": "2eda5371-dea3-40fc-9495-a70fe369596d", "value": "12288:Gq4DrYI6HlXEHDm86s9MrOXrzTPaM+W31CAG/JUQI1:h4DrY9lXEHD96wMrgrzQoG/JUT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778290301, "uuid": "8da38e52-75db-4cc9-a6f8-68cfe677c58d", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778290301, "uuid": "8666e143-324f-4dac-bc66-3af03833a55e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778290301, "uuid": "fbb0d25b-f39d-4794-9a3d-a5f7bcfd919a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396f89c6-4bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778342009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342009, "uuid": "953747fd-0dd2-4cd8-b4f8-e74d74c6de95", "comment": "Malware payload (Mirai)", "value": "f02eb4d29b47a1a4d797fbe66bdd12f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342009, "uuid": "95a0dad5-e5a2-44a3-a6b7-3c78a17ab83b", "comment": "Malware payload (Mirai)", "value": "4024c47237472c6140282f323e29e51a72868739bbf2213017981f55a4fc0afe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342009, "uuid": "142c3b4e-d61d-4569-af1b-d46c89c6ba51", "comment": "Malware payload (Mirai)", "value": "117d96134229501e85e54b1f91238aeca467b3de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342009, "uuid": "3bd42016-6869-477e-bbde-fc6174380c20", "comment": "Malware payload (Mirai)", "value": "194bb93dd12b6873690c590d7b4796600e10cbe213167b26fd34593641c270c0b80f1b386b9350efe780eedd14f589c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342009, "uuid": "4d7a2fc4-3b5d-458c-912f-215b65d22577", "value": "T1354619277A28DB0ED228213458B1CE99673A2C4646D7A527B391F30DA8F20BC5D5FDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342009, "uuid": "c54c8b97-b8d3-45a7-bfb1-97ff8f988e33", "value": "49152:Yb02CbccirWGBnPRts2wzNdncsBeG0xjvbYNAMj260bAW5rqXkdQhJ69LZcB1V07:LGUtEK1V0n7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778342009, "uuid": "e40cf96b-7e08-4f62-b8e1-38f13db9394e", "value": 5570743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778342009, "uuid": "d5dff056-1d5b-4218-a318-49510e88f2cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342009, "uuid": "916bc173-2a74-4d55-be8d-a1c7a660f2b4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc4911d-4bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778333747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333747, "uuid": "e1f08cbb-d5f4-442a-9af4-40118df74fa1", "comment": "Malware payload (Mirai)", "value": "1684f82169b1f569795c54c52c3e6906", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333747, "uuid": "8fa5d08c-9211-4dcc-896f-205af6fd6628", "comment": "Malware payload (Mirai)", "value": "416f29f8ec390d263c49bea0f16a6f4c20d71d2e74c7a14d0661ac66868d23f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333747, "uuid": "fd798261-6d0a-45fe-9c04-2fb806456d76", "comment": "Malware payload (Mirai)", "value": "d531019649c8eaacb8986025314219cf9202442c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333747, "uuid": "012ae401-cfd8-4ff2-bfb9-2c95b7cab53d", "comment": "Malware payload (Mirai)", "value": "1756086675da118946c2991d53016e3895df716f931460607bf951776f4b265271e9d3c382774262d16203e8890f0b14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333747, "uuid": "764f86e8-77c5-4e55-8aa6-269dc3c57f41", "value": "T1CA148D68FE4F78D2D2C7E37DAE4A0FA2312779749565C0B51A00A29FD5EAFD488C0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333747, "uuid": "3f8cf74f-cda7-4f2f-a31f-6ac0d6827168", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxx:bOVfbEdxm4iubr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778333747, "uuid": "513b9ca3-3d40-45fa-8d93-02cba904c5be", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778333747, "uuid": "5d73458e-0cdd-4d21-b733-a2a04e5bd219", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333747, "uuid": "1018c2c3-415f-420b-aebb-99cc67f8b0b0", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da6625e-4b96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778324434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324434, "uuid": "105ec80d-83db-4a21-b875-e2213137a0fa", "comment": "Malware payload", "value": "036ff0a2a9cf4b0500cb8bb6d4c69dd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324434, "uuid": "b6529958-37a1-4cf6-beef-c945950d58cd", "comment": "Malware payload", "value": "418e0048c5109357961783e987a795e8fa39923f0dfaadcbade68a3712f530d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324434, "uuid": "387428de-6cdb-4434-8567-f8582b454e6f", "comment": "Malware payload", "value": "e49b4401d4ab06757b48fd2f270c0c8434369a5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324434, "uuid": "e8e9499d-1c12-4eee-8983-5bf193297993", "comment": "Malware payload", "value": "00ca8aee7ebd8cc9dda07ff6f660bb0571ce5c1a885f22ff4c32d5474d25716bfcb6ef4e738b95e9b4adc9bb679fa652", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324434, "uuid": "6aaea8c0-10dc-4a68-a26b-36cf8f75bd2f", "value": "T1B8060977E59550E4C1EED174C6269223BEA13C8B073433D36FA1A7A11B76FE46AB8310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324434, "uuid": "c39c0376-d67d-41ea-804e-9c567cec6456", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ0:cqYUQuVDt0TZED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778324434, "uuid": "cba52e3a-90f3-4e1e-bcd0-2b6bde787e6e", "value": 3735552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778324434, "uuid": "8162782c-3a5f-41dc-baaa-c36ebba4217a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324434, "uuid": "ce611b6f-db03-4140-9137-aa29a6ee7e50", "value": "418e0048c5109357961783e987a795e8fa39923f0dfaadcbade68a3712f530d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3c4cc4-4bfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778368057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368057, "uuid": "9f18d8fb-2b12-420e-ba44-149e0bfa6563", "comment": "Malware payload", "value": "6f48f590115c431115ba4138a3760796", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368057, "uuid": "3e91cc5b-3ae6-4069-a385-b29945883c7b", "comment": "Malware payload", "value": "44de15a30c4cc5031e1e17dd0074dc1b25978ef21c790eb42a8936396ebdfe88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368057, "uuid": "0f189f47-e931-407b-8989-2d37801a3f1c", "comment": "Malware payload", "value": "9bd05f356622fad5d71909de0854469d8e366a88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368057, "uuid": "67d006de-1612-443c-9422-2c6655b25a97", "comment": "Malware payload", "value": "4ec3f94aacf23b0b4b94d142ea54b2e2cd7435818e9a332f4c6ce23ef07bd5b13d4bbe943c91d6f29264674ddbae7e89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368057, "uuid": "7a602eda-8683-4aad-9306-8d79bc86074f", "value": "T1CC860A05AD842BF6C82D8E3584EACA9612705D101AF2863656A4FF6DBC772387F57CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368057, "uuid": "6c269020-7726-4e06-a20b-4ba48233ee5c", "value": "49152:9Q3sEoIq8ZWn422KWEZvrmnYc3CmS7tqTF7OJjbXiy1i05Eq:iqSD5Yc3CmJHtGEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368057, "uuid": "e1c99887-096c-41e3-8ab9-c304b498c67d", "value": 8388801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368057, "uuid": "14b956ac-c0b0-46e1-b8d0-c31e529dfb8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368057, "uuid": "008352ff-601c-4b6f-b312-a051b89a223b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35536486-4b9c-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778326970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326970, "uuid": "a7399ba2-20b1-4c9d-9470-b77f97da3b03", "comment": "Malware payload (NanoCore)", "value": "df61ffec12ee5b72a197fdc4f43aa1e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326970, "uuid": "12f9d2d6-e39d-4e34-be12-3db913bc0cdc", "comment": "Malware payload (NanoCore)", "value": "462da039980a8f166fbd27d15437fa093ab9c369ba13055d7fad90bf3b9d1627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326970, "uuid": "583bdcfd-6e39-4429-b364-3ba975e90ba1", "comment": "Malware payload (NanoCore)", "value": "a1d708a472c77128596552695c930427f4411342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326970, "uuid": "120a14df-8f2c-4692-aa2e-ce8dff47e058", "comment": "Malware payload (NanoCore)", "value": "8aa7799bfb2997468afdd77a981cfbd6b953fe69a60c57fed07614852bd594f1b46d3c9a9df0b941791a8164fc814e8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326970, "uuid": "6e1d9890-8ba7-4bfd-8ff9-2a9eac9cc029", "value": "T1E664BE1537A4B52ED28D857963126176437489D2ACC3E3DA28C872FB7A7EBE005371E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326970, "uuid": "a88cbe20-bc4f-4513-813d-fc789a03b035", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326970, "uuid": "9684c064-0f4b-495a-85e5-957557078fda", "value": "3072:KzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIQHDfGPiZiUDNuml3k6mTKYO55:KLV6Bta6dtJmakIM5lfhiUDNt6eB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778326970, "uuid": "9f3f3742-bb03-4d83-9657-0540af592df4", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778326970, "uuid": "001d4c09-ccd5-4056-8f63-2c482180600d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326970, "uuid": "7d1178ff-bdf3-4b14-95d0-270afb6353d1", "value": "playgamesonline.in.net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63848f3c-4ba1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778329195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329195, "uuid": "501db6b6-b568-4487-82fe-8082a98fce7a", "comment": "Malware payload (Mirai)", "value": "81d92c7c9efef2d799f349bc11fb898e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329195, "uuid": "11d3c50b-115b-41ea-90bd-03e56cea8986", "comment": "Malware payload (Mirai)", "value": "464cb7488405b11303cc6c4a1e53f6c9e24bfcfa09d119ae8cbe82bc46bac27e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329195, "uuid": "20b62aef-e9a3-4ab0-b276-80525ac4f43d", "comment": "Malware payload (Mirai)", "value": "4aacb7c2b9ddb68c814db4c2e0bbecba5af6d87b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329195, "uuid": "d0b4684b-8d1d-464b-bd0a-9adfd25d1f7e", "comment": "Malware payload (Mirai)", "value": "b22368fa2dc9a2e9f304d378fb5ee2bbbd867219306d1a02a0e22735b3eee71f16e57e3ed0373d4bf35d94888ad83c43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329195, "uuid": "563a03cb-9c1f-4498-a05a-9edaa8386939", "value": "T13CD39D62A9325C58C12681B4B136EEB41333971183431DF7A9A5CA7C9187ADEF63E3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329195, "uuid": "dbaa1805-6a36-4c0d-a316-ea1d6c00761d", "value": "3072:27SzSTZ/VgBK0quE2x6BjTLcs5j7fhHJuErBK:5og80yLcs9dpuErBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778329195, "uuid": "7eff3ccf-9c63-4dcf-af33-d56dccdeba60", "value": 137200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778329195, "uuid": "153d389b-2f06-465b-a858-0e46c0f102e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329195, "uuid": "7f657168-2e7e-4b2d-ab90-5fe64a56db81", "value": "debug.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e881e6-4b9e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778327991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327991, "uuid": "b50a0597-5f7d-4c82-90d7-5d3b32f2c4db", "comment": "Malware payload (Mirai)", "value": "7e30c0e83770414bba2baa1653277667", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327991, "uuid": "4a07a67d-aebd-455a-aeaf-b0dc971017d5", "comment": "Malware payload (Mirai)", "value": "465f7ef04fb15bf0a0e89b7c587805e0e807c06644b98b3eccc87b6399e6e7eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327991, "uuid": "eee07b2e-ab6b-4496-981f-1691b6fd40d1", "comment": "Malware payload (Mirai)", "value": "54ad7fa1869fdd98c70c5bacbdb2fcea30f5b469", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327991, "uuid": "8345689d-77e5-40e9-8e02-6f36ffad85a0", "comment": "Malware payload (Mirai)", "value": "a3a62e52e1fea4e3c43daaf1fd814126f4a919330a5e16aebe9275bb529752e264c3b90bb48162021e79a1cb5d8ce04d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778327991, "uuid": "544289db-5f73-4945-ac89-70767c23beea", "value": "T16343F1616E1ACDA585E04C37E7565FC6B2387FF880877C9317A91318A822DC32F5A387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778327991, "uuid": "fb12e15a-2774-4f54-ba2f-b7a55ede510f", "value": "1536:4KqPa8mVGhw5xXF7j5WKI2oN2YD4vmOfjDgn2pL9:hgajoYBFH5WKUPD4vmO7DgyL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778327991, "uuid": "453087f9-c516-4453-846c-eb070922f939", "value": 57164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778327991, "uuid": "3b23d311-b66e-49c1-b977-7703fa57d5a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778327991, "uuid": "3ffeaccc-7fc9-404b-91c1-bf35c337f50d", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58960d1-4b40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778287698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778287698, "uuid": "bf41b304-999e-4cb4-b287-0b8327f0f45a", "comment": "Malware payload", "value": "998963b875e74218a9eab252e4667807", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778287698, "uuid": "fcf754cd-b3d8-4ad1-90d9-ba14cde2704e", "comment": "Malware payload", "value": "47b9224be12dd456d2748203e49a92d3e7e02663bb8914059b0ec410e98410c5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778287698, "uuid": "87930e3c-141d-4ffc-89f3-1c0647b6fa7d", "comment": "Malware payload", "value": "0188c48e75882da63a3f099cf15c7c32d25ab913", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778287698, "uuid": "346c2510-f63f-4c4a-b84e-5be054f37f87", "comment": "Malware payload", "value": "39299487c90c82498318a68876edee1e68d6625ce69de3bba9c4e082d723e70d26cedbfc04d4edc758e9496b9381cb97", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778287698, "uuid": "ac3148cc-56ed-4136-9fe8-c845a145227f", "value": "T14F137D6966817C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C596DCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778287698, "uuid": "e4e376c3-f4d4-427e-b409-9fa4095b374b", "value": "768:b9+579GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:b9+qco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778287698, "uuid": "610b6933-5ba5-457b-a59e-012ca370d51d", "value": 45420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778287698, "uuid": "4183947a-8b08-4bc6-b108-c760a40c307e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778287698, "uuid": "7bc43402-ac46-4ea2-acfc-f4d7808d29d0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7ed163-4be4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778358018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778358018, "uuid": "f8d0abbf-5161-43f7-81e6-f36223da18e4", "comment": "Malware payload", "value": "1762c79683aaeb9f49af60be4660c1af", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778358018, "uuid": "5d8a7eaa-bc01-4b56-be82-60613db67d68", "comment": "Malware payload", "value": "47f8abd1b6c50ef79dc8bbeec90a9b9cd0d42b6230258ef945997ede979147f0", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778358018, "uuid": "9f2687aa-f978-4fa7-af72-2e7f4cb6bda6", "comment": "Malware payload", "value": "bac4e1468e029fc73e89ca5e6b03a65aa4a55f97", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778358018, "uuid": "1a393a4b-74a4-4855-84de-b8f3602cc01c", "comment": "Malware payload", "value": "9a1b5bba2816d923092953790330b218e91767415ab4f27cda45b3312359cf7c336c34b6038bbf5119f104aac0fa5c62", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778358018, "uuid": "b3733d43-6551-4c42-afc0-93187c310024", "value": "T193966C0718970CE0D1E6E234A0675295BB21BC4887353BEB6ED09DB12F3A7D46EB8771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778358018, "uuid": "b5ec04cb-39f6-449f-8d65-8b988959da55", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778358018, "uuid": "f4adb4b7-98d0-4e2e-853d-05b067ed4187", "value": "49152:WrbZ0NQfQKNC0EfoR4n04ZXOtspt3h6Ou1g4cMICEHrMhce:W3NIKHGnXZXCs78EHw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778358018, "uuid": "5ee829ff-5817-406f-bdc1-d663e9c7b808", "value": 9209480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778358018, "uuid": "23aba843-be63-4df7-98f1-a90a595465b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778358018, "uuid": "b8522dfd-b338-4b98-af9b-c95eb493a807", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b302a73d-4bd4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778351233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351233, "uuid": "a80ef3f6-17d4-4e5b-b6a3-ead6459cab38", "comment": "Malware payload (Mirai)", "value": "c9d55d795fa5946987157c3858e7ed1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351233, "uuid": "e186264f-0825-4abb-ba1b-7cb89d094cf2", "comment": "Malware payload (Mirai)", "value": "48309192391380257bc990ec913b65ae83d526ab444f16809b46cf27144d34d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351233, "uuid": "8f64b333-21d9-4f8a-b197-277e615715a8", "comment": "Malware payload (Mirai)", "value": "6bfc1527d288d34d0d39738903c1ef62f5c9ebfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351233, "uuid": "4af0e1e0-a086-459e-9c78-08219fb98826", "comment": "Malware payload (Mirai)", "value": "57bbba64a294015a338ae59678fc0dac7b78a1a07d745b9d7eafeb0b65b6179ccbb6e3ef9d0a19d77bed934f7686fba8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351233, "uuid": "fd4db4d7-6370-4b63-b27a-4a35b890587d", "value": "T13FB32BC6A313D5B5D8050975607FE732C97EE6391019EA81E3A9EF3DFC12A02C527A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351233, "uuid": "4cc024cc-e5a4-4bfb-96b8-8eb4991c4836", "value": "1536:giQVvOURfXgb98c4Z9W9pV/F5Yal4cAcIgDWC6m7AKLo6UMl0NAl7TD+AvrXDw3m:glUeXY8c4Zo/F5Y8ie7Ho69uqF0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778351233, "uuid": "354791af-60f2-4c29-9302-d07175d2373f", "value": 112428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778351233, "uuid": "08e9f0d5-841b-49ea-b1c6-3eeee15c97df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351233, "uuid": "aa471fae-b1fb-4d11-a256-d70a1a191b50", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d77ec0a-4bd3-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1778350606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350606, "uuid": "d1fd7c83-681f-4837-bb5f-07c9c7c42e03", "comment": "Malware payload (NetSupport)", "value": "9bbafb846efa9c3287c56dcc697dbdb5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350606, "uuid": "775d5e46-8eeb-4525-ba7c-fe23dec82571", "comment": "Malware payload (NetSupport)", "value": "4893de26be7c3014e1f48c6ad171743b30bedc9a1ad5ebdc739dad9dda87caef", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350606, "uuid": "7842c760-93b0-4834-85ae-9eacc367710c", "comment": "Malware payload (NetSupport)", "value": "9c71a031c5e767eff3efa5530d8dd674870f2b08", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350606, "uuid": "4bff81c7-b8af-4af1-902b-802e7881612a", "comment": "Malware payload (NetSupport)", "value": "28be5f3abf27475cd90af48824fa6d72d557ebe2769da6cef8c0ac7348cc4ed50e5a1b3e19662565017faa5b647bb8f4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350606, "uuid": "1cae5c07-7572-4c6b-b6d5-2c57041182d9", "value": "T1AFB5333D3BEB6A66DF8B5872A7C59B750798CC721B0D1B08B02776F92630710D0DA99C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350606, "uuid": "e77eac2f-5d0b-4b51-a895-946132ca0db2", "value": "49152:s4n5z0BA/OmaUdSZeD3ckBvJvpJhDuMrbuVfU:sEFYudDQkBJhLGVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778350606, "uuid": "e9a6c4fe-7a08-4e54-9dcb-989afa6892e1", "value": 2473984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778350606, "uuid": "b9f19b5a-2f9e-4ae7-be49-0586226710bc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350606, "uuid": "32ba07b7-4cd3-48a1-9972-91f1cb8d11f4", "value": "installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a84fa0d-4bc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778343380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343380, "uuid": "1b8e90b9-4288-4d34-9f45-284d21faaa08", "comment": "Malware payload (Mirai)", "value": "22074bebfb0f64eb6a398499cd46703e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343380, "uuid": "8271102c-8390-43b3-b1de-24ab55e3027b", "comment": "Malware payload (Mirai)", "value": "4978040aa94b6f06a004165013157656ab5777d14f96706bbae60607c84e1ca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343380, "uuid": "c57d2b27-34f1-467f-8ca3-48a0f62fad58", "comment": "Malware payload (Mirai)", "value": "80ea464d3faeb12e2643b798bc72af58f08beb6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343380, "uuid": "5d08c4ed-d687-419e-bc7b-4bd8eb8cfa2f", "comment": "Malware payload (Mirai)", "value": "8bc8969ec6758a63ea0dddc64f98d3b1c353ced8bc87c64f4a3896a7bcc78e68703a566470241501ab08680079aa66bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343380, "uuid": "8fb69f52-72f6-45b7-91c7-abb57d9d62ff", "value": "T1DF83199EF4E24A1DC5C00BF6763E934A33A553B5C3DB7653DD004EA8A68B50E4F36A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343380, "uuid": "5a50061c-e1be-409e-b6e0-cf1cc5d946af", "value": "1536:rTi81QZTh20Ef5JcijxfMKGRDFjo8eAvrXDwM:S81QZc0jikBFoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778343380, "uuid": "8b9f3899-abe0-471d-a4fd-f9924c74aba0", "value": 88204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778343380, "uuid": "b1b9aa67-01be-4347-b6eb-5461b0ff90f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343380, "uuid": "ed75af21-6a46-479e-918c-3d63d818f5ab", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8af465e-4b4e-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1778293770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778293770, "uuid": "d6705524-2cde-4afa-84de-466829050907", "comment": "Malware payload (CoinMiner)", "value": "e43b38b314acef0d158e99884cd5710f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778293770, "uuid": "44abfc67-58ac-4433-b3f5-e5a3b4501007", "comment": "Malware payload (CoinMiner)", "value": "4a1dd2bf737357ff4c32df5b739cc5d8bb0003bcb35fbacc3174d36b2ef77cc0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778293770, "uuid": "de365907-9db2-4a07-929a-a41739afef22", "comment": "Malware payload (CoinMiner)", "value": "be53dce9613bb574702079f49d457936d6383463", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778293770, "uuid": "09a74ca1-7410-46ea-ac85-198c09616cb0", "comment": "Malware payload (CoinMiner)", "value": "29de41cba8d1634e2fb39acb7af1d14ffe31fc5825d696c4ff437eee169702b03fe04b2fe011c215d253e7e070f22b31", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778293770, "uuid": "edf486e9-dffa-488a-a7eb-56e8ff43931d", "value": "T17AB39E41F3E242F7E6F2053100A6726F973662288764E8EBC75C3D529943AD4A63D3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778293770, "uuid": "c9cccc1c-a335-4c0d-b85a-ac0746fb7587", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778293770, "uuid": "92efbc58-d652-4473-b1e9-2d1868767193", "value": "3072:D7DhdC6kzWypvaQ0FxyNTBfSiyp9oX/NF:DBlkZvaF4NTBasPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778293770, "uuid": "bebe4616-113a-47e8-9e3b-7bd18841b2ed", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778293770, "uuid": "b1d5e65a-f55f-4e49-b4e3-01e852d1daab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778293770, "uuid": "a8095ae9-45ee-49eb-9203-783493322f8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e50f19-4bd4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778351130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351130, "uuid": "2ef1c8ec-918b-4e0a-aa4d-5359a51a9529", "comment": "Malware payload", "value": "224a727c94d3707f602b45ee35779b94", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351130, "uuid": "1a89bc54-056d-42f2-a5b6-4e5adf525bfc", "comment": "Malware payload", "value": "4a3ca849d25f29324dc2b86aef1289fca56f6ada0d55c4b63bbe6a5479ab480d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351130, "uuid": "a442a949-67c8-4558-84a9-5cdae51317ff", "comment": "Malware payload", "value": "42d43e2d909f62a23ed4384d6a5907c2af2c5c65", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351130, "uuid": "1a5337a2-dd3b-41ad-85ce-72cfa02cdde4", "comment": "Malware payload", "value": "c88ad6411f2ab583b1092af551d081118a3b41f28faa0a4ee3824e9f7ce349116beed601e81d896c45d3ccbb4c9a822e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351130, "uuid": "79e010f3-9d37-45d3-bf98-aad7c4cb028d", "value": "T16505951EFF6BD478F343927B00C0856FBD69C588A783F63799B0E8AB2964D510B099C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351130, "uuid": "860888eb-425e-46c5-8666-3136575b0f48", "value": "12288:VPyoQTGB2gH1B4kJau8FhLEMxvf6e+b58:UJggfu8FtEMk98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778351130, "uuid": "5743de0a-73e8-400c-9d13-0d86db22d96a", "value": 797103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778351130, "uuid": "73ec9d14-3ee0-4472-9818-4403b98349de", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351130, "uuid": "18b1ea00-c489-4394-9f73-f5bf66a6c1cd", "value": "meteor-client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad3282f-4b6a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778305827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778305827, "uuid": "fd41f32b-3ade-465b-94d1-21ac0ad19eaa", "comment": "Malware payload", "value": "63b80d5743cb747f9606567109b09ea2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778305827, "uuid": "5007afe2-5241-41cf-bd67-7c43c06e2d9a", "comment": "Malware payload", "value": "4a8e50d8cdd3714be1ff3a00e406b5cfffbc391a92b18b29602cbbd3d846591f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778305827, "uuid": "94a248b0-1297-4a3e-867e-81da113bad6d", "comment": "Malware payload", "value": "33615a4ed69434059aa927f9368b37196487e6b4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778305827, "uuid": "261ec55c-3dc6-4078-a3a0-023713d39e8e", "comment": "Malware payload", "value": "ecf7c64e60e4df5fff650e906600ff6130a32fbcbafa5db83eb9b4e8bb9c59c05b58ed14601a6ac94149e64a772096d7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778305827, "uuid": "112d367c-b0ca-4390-9bc9-cbe90a09f9bf", "value": "T17F136C6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778305827, "uuid": "4a2041cf-a3f7-465f-8751-6acbd1e5f8cf", "value": "768:bnXRWNGxVx9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bhlxIco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778305827, "uuid": "6fbc528b-55a1-4888-86c7-cf6d1ebcabcc", "value": 45432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778305827, "uuid": "ebcd4d18-6764-410a-aa0b-4f4184fdfbc1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778305827, "uuid": "46622db5-bbec-48f9-9f58-f525b97de955", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f589492-4bf0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778363199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778363199, "uuid": "8bd04d5b-7f68-42b9-955a-242933611671", "comment": "Malware payload", "value": "dfb86e059976eb7219412f4aa13c5135", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778363199, "uuid": "28e651f4-dc96-45da-b21a-7b913b2742b8", "comment": "Malware payload", "value": "4afbb402e0c4b26ee33f3958ab654f7529441c987f97967119e61e5f04e51d3f", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778363199, "uuid": "8eee3fc2-6f21-49ac-a9e2-c59d7ff9ca32", "comment": "Malware payload", "value": "2369e91322a81a34f1c28539fdbbb757e2a9bde8", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778363199, "uuid": "cf5bb4c9-a415-4f6d-9665-7e89e95e6596", "comment": "Malware payload", "value": "1ebd38dbe34e0545b8e28142ef7098cdcfc4f0bd761993c776f0ce778b209c7599baf88ba8d3b37e3c6ba247a7b441e4", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778363199, "uuid": "045a64d3-55eb-4275-95c4-be254f49578d", "value": "T13BE5331BA8A12F149A32F3BA7257863829A1476F3F96D43CE9EE7779C1317129533007", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778363199, "uuid": "c98831c8-7ef2-48eb-9be5-ebf1612adaf7", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778363199, "uuid": "723cd38f-b939-440c-b52e-d32603a8a571", "value": "49152:uGbCwKN0yH0F7emjS7kAobodsxInrf7MsYwqezFXLewCEex22zx:u+s87bQw0uxuPMFwq4hdN2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778363199, "uuid": "aab5c0e5-c51d-48f6-953e-39250d236ce7", "value": 3204608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778363199, "uuid": "40ceba62-54bc-40ef-a917-14baa7398332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778363199, "uuid": "a0ec3243-e2a3-4f4f-a306-b66cf0cf8299", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f3f9db-4bd4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778350995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350995, "uuid": "dd58bba4-df58-4bea-8732-b2a29bde3d80", "comment": "Malware payload (Mirai)", "value": "c37f2714aef99c7f78c070b1f6a449f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350995, "uuid": "5b1cd6f7-3c22-4379-8ed4-462e3852e8b2", "comment": "Malware payload (Mirai)", "value": "4c7e9c5384078e5a703c47591da59cd5633270e40862e4b6100d29333a1beb76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350995, "uuid": "a70935fb-6169-4c2f-aaff-f725cf9a61d6", "comment": "Malware payload (Mirai)", "value": "2f5e37557ab151d11715bc42b06c498d9274f50c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350995, "uuid": "d8e29f70-5e26-4b8b-9669-1d509f1d469d", "comment": "Malware payload (Mirai)", "value": "67d59a54fe0af7c6ec85c7c50c6aac4224a1da9a372b7b682e82bbe0187313932808a1b3d63cef63d2d4ef75c4746673", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350995, "uuid": "136870fd-a363-4298-8e63-601c4ffa370d", "value": "T11AA3F886BD428B13C5D221F7BB9F028C371A57B9D6EB3142DD26AFA027574D70A3B250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350995, "uuid": "908f9547-50bd-4feb-b4a1-6314027d56f2", "value": "1536:n18Fit3bXY3rxhZFhNJ8SpVfppWCclSF+aKOfhV7LPbOwMmFo6AZZdqOVzRSmycp:n8rG7GV/TMBX9ycZjpmOHXgtt6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778350995, "uuid": "7a3130d7-122f-47bf-a24a-fb1d8fd1dd1c", "value": 102868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778350995, "uuid": "5a7df12d-5f21-4353-a639-2461bb0a8293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350995, "uuid": "abbc22b2-525d-4698-befb-074d61b7d02c", "value": "zyre.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e6420c-4bb1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1778335986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778335986, "uuid": "60790f29-35db-40aa-8974-d0541a6c3895", "comment": "Malware payload (RemusStealer)", "value": "2aa353d38c6e37c61ada324bca0ce857", "object_relation": "md5", "Tag": [ { "name": "comples-biz", "colour": "#201400", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778335986, "uuid": "547b117b-eb21-4d4c-9c84-708b5941fce0", "comment": "Malware payload (RemusStealer)", "value": "4d499d3a99fab53e3393eff3bcf9b5410e62112c003306c6efa0240382789d93", "object_relation": "sha256", "Tag": [ { "name": "comples-biz", "colour": "#201400", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778335986, "uuid": "fb35696b-50da-4f14-92be-11bf2272512f", "comment": "Malware payload (RemusStealer)", "value": "d4441ce894890fe9f5a7e3820cff46d62878a00c", "object_relation": "sha1", "Tag": [ { "name": "comples-biz", "colour": "#201400", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778335986, "uuid": "87aa6355-dde2-4709-a251-6f49089291ae", "comment": "Malware payload (RemusStealer)", "value": "be8eacb01e78fc6b82b2f0a22179009fc855dd74e9af80f67b7a79bf207d82698de3ecc07c691c7763dcf51f8531c517", "object_relation": "sha3-384", "Tag": [ { "name": "comples-biz", "colour": "#201400", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778335986, "uuid": "32f6ab2e-fe87-4154-a310-be1d0fc67f93", "value": "T1BB954B07BDD454FCC4AAAA31897265E1B7317C480B2123D32A917E787EB2FD05DBA709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778335986, "uuid": "b46a1221-751b-4b62-94a3-c5d0247cd005", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778335986, "uuid": "1378d568-3d98-403d-853e-de25c773189c", "value": "24576:nXx6GrdHWiQRV0nSNwS6l44Prp3dK0jyCYOtP2tFBjH:nXx66HfQRV0nSCSmVPrp37jyTf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778335986, "uuid": "df1de7ae-7556-461c-a2cc-ac78c7ccc05d", "value": 2038920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778335986, "uuid": "e68cb6d3-91e6-4137-9bc4-8a23822cca2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778335986, "uuid": "ce806ecb-204c-4fb9-9e62-3e797b282813", "value": "Setup_2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068d1f40-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778331187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331187, "uuid": "ebc61e84-fac2-423e-a6c2-d1910e39751e", "comment": "Malware payload", "value": "3fa5b8f0d15d2ab8ef61892c05a8c46f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331187, "uuid": "94165f24-cb00-4029-acc6-a9b9559c2a99", "comment": "Malware payload", "value": "50b17e69cadc2f076c960680296d7cf863e235f0e1c24844c36583ed875e09f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331187, "uuid": "f6071973-443a-4dc6-bee1-52bca36186ec", "comment": "Malware payload", "value": "27accaf82280168907102912847cbb08be3b8862", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331187, "uuid": "42275386-695d-4646-91bc-9ee3dd08c14d", "comment": "Malware payload", "value": "bc7b0a343b60bafe21e08ba8521f47ef99cb12bc2072ccc15f8ed9f9315a15ec774656963cbbf12d82b242e52b870a09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331187, "uuid": "b4e2248c-25c6-4a8b-a230-c71876efeaee", "value": "T17214E08CDADD01BACE6D4FB9056621232ED844ED99F6D75E3B680C84734F24C5DCB82A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331187, "uuid": "b32e17c9-090c-4e15-9df4-f0bf71f304bd", "value": "6144:UbIPVkIRqpBaBdCA0+eQasFlmVDJuoXwAUrZDNX:1vq6DCRPhAlxoj0Dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331187, "uuid": "075f98f1-d0ca-46cd-acb6-6258a675cfe9", "value": 199459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331187, "uuid": "85220004-b6f5-43fc-b6e3-d6408acc2500", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331187, "uuid": "f70938d9-eb30-4d32-a093-2e4d983325dc", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8a5806-4c01-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778370549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778370549, "uuid": "c305c03d-edf0-44e9-b9e1-72446bb4ba3a", "comment": "Malware payload", "value": "368664a5cf6f4e5544f8b6a40d3c9b62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778370549, "uuid": "6a704226-8645-4fae-b21e-18677d2e9971", "comment": "Malware payload", "value": "52398a77eea826287476ceedab58d0e72410724206b6523aac29c85212ce5f30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778370549, "uuid": "9218d078-494b-4491-8fcd-18cb6544315e", "comment": "Malware payload", "value": "9eeb981c6f926f279ed271d9075339d380f6bfcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778370549, "uuid": "01491a8f-879e-42b7-9899-74ccb07aeeb1", "comment": "Malware payload", "value": "7a689d8d639685d1315a85d6357db8bb04b07180704a995d70e98c220e7e8329432d767843d9955b5d81b1ac96b179af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778370549, "uuid": "4c9c7504-e308-4006-b0a8-800c89cc947f", "value": "T14D257C1477FC6B1BE23E4735C2B34C2913F260939A61C74B4E92E84D1F66781AE166E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778370549, "uuid": "075aa34a-abd0-4ef7-8904-7ebacc65eb7b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778370549, "uuid": "8d53ca79-fb2a-418f-8f68-c037b96e9299", "value": "12288:5apJjVNcFpT21N6WJDVPO21N6WJN81D8wOFpF:Gx+2z6WJZO2z6WJNkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778370549, "uuid": "887ee7ca-8a42-4a08-8222-733ce6ec148e", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778370549, "uuid": "4f9f7e59-0c4d-4d5b-92d8-89f76bd8e75f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778370549, "uuid": "1eb319fe-26bb-4118-9f5e-773b7d49ee3d", "value": "52398a77eea826287476ceedab58d0e72410724206b6523aac29c85212ce5f30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573cf8f4-4bd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778349790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349790, "uuid": "24227eb0-4b6c-4717-91b9-99e13cab86d5", "comment": "Malware payload (Mirai)", "value": "7c9db18d0062210a17c69b06928a8da8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349790, "uuid": "b1f80883-f5a6-4fd4-8cdc-14597351da36", "comment": "Malware payload (Mirai)", "value": "53370b905387ffe659ee2a3e79a369e8ffdd6a8c3e913cec2c0a767c9dbc7add", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349790, "uuid": "5261ed30-e34a-4828-91ac-c08babeeed9d", "comment": "Malware payload (Mirai)", "value": "d5fc75984bf444cf7d1fa6fca27fa4320e7cf1ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349790, "uuid": "656d1f99-454f-42e3-867f-42e40c2a6451", "comment": "Malware payload (Mirai)", "value": "b274b10fe7d4d36ed22216e8e1d72751ad31604455909197cbbb04ab55104b43e62bfaa02905b4e06be39e746a3177f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349790, "uuid": "7e801920-8420-4bd5-b946-4d3624844d48", "value": "T1AAC36DC38353D5F2D8150970E037E336EE79C52B511AE981E3ACDE39E896A029523BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349790, "uuid": "a1092427-ba80-4354-8bf3-f870da224a9d", "value": "3072:7ohm1fg9oRY8OTb1TF0Cfh8W8mPrE9IhJZkyCOVtBo8:7ohm1fgGRY8OTJx0C+Wn7COVtBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778349790, "uuid": "f4044a56-0278-4c44-8e3a-c65ed6a8a0f6", "value": 128844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778349790, "uuid": "04f109b0-5bc5-4bfc-9a63-77397e7925ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349790, "uuid": "64ba2906-7d86-4ce2-805c-f3e9eeb13a46", "value": "debug.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac14d8ff-4baa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778333182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333182, "uuid": "a7efee9d-3a28-4dfe-b13d-a1c77fe972d9", "comment": "Malware payload (Mirai)", "value": "40a9e1e3422bd27082e404fe410a16b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333182, "uuid": "408777ef-71b5-46aa-8bc9-f08f1dd3c8b8", "comment": "Malware payload (Mirai)", "value": "53a315d9f70de87b98ab91bf25a0cca47c6f7a3f183ae51ee32af3a0bca90086", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333182, "uuid": "5e7304d0-2769-4282-a0bb-444fc36ba66d", "comment": "Malware payload (Mirai)", "value": "801bd0509ab158436c92d4676eb012a3909a5a40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333182, "uuid": "e36a024e-029d-4fd5-95d5-da78c1d8f61b", "comment": "Malware payload (Mirai)", "value": "cd7b1d75f75ee78134f9bee6cc9b99bfa08a07e03178eba99e7033a273f660a688bc79a4f453443f900abbb875bc1d59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333182, "uuid": "30517c02-12b2-4ee7-8ff0-636ac3fb4964", "value": "T1BDE36C537AC180FDC549D1B41AEFA136D9A6F0BC12B4365B77C0EE262C4DDA04A3DB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333182, "uuid": "98587476-813f-4747-b7ef-fddcbbf15559", "value": "3072:BX5BZcmTDuRFN3Qll87X94/WaqIP8Xl/RF6Gss:BX5BZcmTGyWN4/1qtl/RF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778333182, "uuid": "9a6cb180-b1ea-418a-95cd-5d73e9ae3793", "value": 146456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778333182, "uuid": "a0273c8e-4567-4157-b729-4856a733c10c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333182, "uuid": "b046b304-9b91-491b-a92d-5d25f0cca6e4", "value": "debug.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3779b553-4bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778342006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342006, "uuid": "efdf855d-f98a-4742-9f45-8829bef2201b", "comment": "Malware payload (Mirai)", "value": "ed088414bad8eb417322e4d1cb366522", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342006, "uuid": "68b5f2ee-e34b-49b2-b87c-3a2390b7eb39", "comment": "Malware payload (Mirai)", "value": "53d61d6d15fe08b11023d3703265f4a34b510bb240a0b42a3671e3efa80efedc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342006, "uuid": "45ccc964-d1a8-48c0-b404-cfc233616cfb", "comment": "Malware payload (Mirai)", "value": "eca6a59882998cb903af524f215fa73d6d250ab9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342006, "uuid": "9b8f26e5-05bf-47f8-bd40-ed6bc06140f6", "comment": "Malware payload (Mirai)", "value": "f475c0c8e6fc451a8585f6cdacf30c29e34937b192688289a9101db95d6528c4a53b2d933bcc19fcf320b9b7c73c21cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342006, "uuid": "4bf2076b-9626-4716-ab41-6b2dd78857b9", "value": "T126461857B8D24A43C4E4367BB9BE80C433631EBA9BC652566D05FE383ABE5D90E34344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342006, "uuid": "c8cc3b03-c3dc-406e-9c78-509ca51dbce4", "value": "24576:nPzCDEw/vuu7eKFaavTXmCQbeVdVOkfrcrmlGaHxHzb2Ax51yOip1VYUXiy4DaB9:0ZCoVxL/4oPH2rz5NNUOxoOfrUi5EM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778342006, "uuid": "24543639-03a4-43dd-8495-a5edbedd46a1", "value": 5701816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778342006, "uuid": "c8e0f044-e4bf-4d9e-93c6-4bcaf4de8849", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342006, "uuid": "5f3a5495-dff1-40a6-af7f-1a958e084903", "value": "android_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58b660d-4be8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778359800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778359800, "uuid": "960234cc-a173-46dc-8846-b690abc0d31a", "comment": "Malware payload", "value": "c1df44818275712551036945db05d08a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778359800, "uuid": "37f6f0c5-f343-4897-a7c8-50101d9a50ec", "comment": "Malware payload", "value": "53f9ab7962531f91a57e11fa7fd384ab06869f16e615167b4c6071f6b8ec900b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778359800, "uuid": "755798ba-3522-4d11-b37d-444b95048640", "comment": "Malware payload", "value": "4fb353dc26db5f3b03a8060b482d7f32feef9ee5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778359800, "uuid": "a6258afb-4376-46a8-9571-6814012ebe02", "comment": "Malware payload", "value": "91d4ab1a989be8d0a6b97f41399ae82013b62b9fc187f0df8666320bdf168e7b202c9ebd8fb6b16d5a814eabd9678332", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778359800, "uuid": "32cb8c3b-463f-47ff-a7c7-b6bb07bfe15d", "value": "T13E364A57EC9145A9C0EED231C5629252BA717C485F3123D72F90F7782FB2BD0AABA704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778359800, "uuid": "6d6c6cad-5d4a-4018-9577-06bad47887bd", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778359800, "uuid": "26b6d07e-293c-4c3c-9842-593cad127510", "value": "49152:8LtLyRe/Y9TdpEav+kf9RWt1wLvTIWSMZbTv692Y5EXUFT2PqX97/SYUW:X9fqkfPWaZSMBGREXxqtW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778359800, "uuid": "694ae3f3-667c-41d4-8d95-ce1c72c974e7", "value": 5159424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778359800, "uuid": "ad2fd072-6f1f-4516-adab-8455c3d59ebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778359800, "uuid": "d2612479-0ed5-413b-a895-00fb44970bdb", "value": "SecuriteInfo.com.Generic.Gorat.H.549753B5.92961727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba774d8c-4b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778324187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324187, "uuid": "090f768d-9798-47a0-b6b5-836adddd5dda", "comment": "Malware payload", "value": "02efec9503567bbd88342e21c46662df", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324187, "uuid": "49a1fce4-dbe2-4e96-ab3c-0f8936a5ec25", "comment": "Malware payload", "value": "5699e80ecfd4e8fc6eeaf5fe5d1a9cb984d567c33f89b952bb08df2cfaa68d8a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324187, "uuid": "5f31931e-4770-4a90-99c3-59fb6fbff111", "comment": "Malware payload", "value": "4e4b92ae873cbca935319454403b15425b7ad323", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324187, "uuid": "46216080-7ade-4c14-875a-c3da21ba0e21", "comment": "Malware payload", "value": "a0633b78b35d5fefed080a9b802b1ee286a00f1020dd9e39979b05e709fa4285aebb0278ab6d988fe63a16532c1d184c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324187, "uuid": "6e1170ca-1fba-4dd0-af42-127043dcc681", "value": "T1C4926C0FB9518315D5C00474A5B2873FD6BA9476338454EFFBD88ACA1B682EAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324187, "uuid": "0d923987-d747-44f4-9060-42c1cb0df83f", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324187, "uuid": "cf073a52-0811-4ac6-be10-39afcc9a3c6f", "value": "384:0IkjLVlvadxqSDO5wtT0vu98t2rFJ/Bgav8U9cBG:4qx3600G9oJa0U4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778324187, "uuid": "35d62e21-9a23-4246-8129-da27a0e7a5aa", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778324187, "uuid": "0d2b4818-842e-427f-86b6-27a7784718f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324187, "uuid": "c6988293-cb47-4b31-9d03-51a6baf5296e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9276508-4bbd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778341392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778341392, "uuid": "13d0024a-28a9-489d-ba10-98f702f3007a", "comment": "Malware payload", "value": "c33fdabd10c137e21aa4c1de6cc0a30b", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778341392, "uuid": "883c113d-89bc-424d-8dfe-662ae8440dd9", "comment": "Malware payload", "value": "5acdf527cd7b2c11d5d90534a30b087549c451f6fe6aefbc71017b20eac95e0e", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778341392, "uuid": "66cf449c-e05c-4b0a-bca8-95cf443c04fc", "comment": "Malware payload", "value": "af6ae048ffc29b764ff8dbad0e3bb0cd70b1e291", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778341392, "uuid": "635b65cb-48e9-43b1-9be8-9122ec386ed0", "comment": "Malware payload", "value": "e9cb90ac610c03bb5a3d225f7beef304ecf4f72c3c4a7f8b4d34182d6304adcfbcb1e473a196f56a93525e88b31a976a", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778341392, "uuid": "39479fd4-f7f6-41ed-87b8-83e09180bfd0", "value": "T15726AF05A3C44EA9C457DA79C61B9732C2B2B9228B35C18E1B96CB0B5F77B428F3D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778341392, "uuid": "a33b1f8c-d442-4b59-8d21-662d13d1c9f1", "value": "ed89c4be221274e5734211dbad9d93c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778341392, "uuid": "e49c60a1-c91a-4a85-b917-9267f5171ad3", "value": "98304:lmJeV/amA9xA6e+PQTUbQ5hYg2WRwG9tCwBPhCBOn4s6MMk1LzvdX86NoGFruJMX:6eV/amADA6eTjRw2tCOPMBdMMALW6aZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778341392, "uuid": "94d74e85-68fd-40ef-86cf-aeb478ca0050", "value": 4713984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778341392, "uuid": "0602d723-2d6f-43af-bb6d-d281fe72198f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778341392, "uuid": "d8980bf9-a81e-4699-be1d-ca6870ab4b38", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e40541-4bfd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778368881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368881, "uuid": "587dab6d-884a-4f4d-b71b-b13e55e59df0", "comment": "Malware payload (Mirai)", "value": "0526c17f6f2fdb59e47bc6275e510377", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368881, "uuid": "202c45c3-f87c-4829-a1ab-3867dfea6c5c", "comment": "Malware payload (Mirai)", "value": "5bb655f82a8cfd65a9c493143f26ed8b476fe487ee4c4f7faffa4167b26952e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368881, "uuid": "b62752db-3a8a-4ad7-9e34-ef4acb32a333", "comment": "Malware payload (Mirai)", "value": "9d36bb7d689e9ae8f1ff857e353438ea11eaf3a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368881, "uuid": "19cc4b55-79f6-46d2-9d6b-d8e68ab5c306", "comment": "Malware payload (Mirai)", "value": "3cd391644f00741cfc20453015ad72c0ad8294f107519551601710022592295af6f48a2465baf32e7d84ad09655b3291", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368881, "uuid": "d39870b4-8dc8-4ea8-af0e-9cc93b4831ac", "value": "T1E54196DBA2E090B3C469ED41FB54B4C4E19D86C361FFAEBCFDA45562489900CF1B6B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368881, "uuid": "ffce1746-93a1-4a17-9926-569c3086418c", "value": "48:ZEcynr1qbFbWoISiopGp3836KKPp8KP8a2v942v4m70BHpp8cXV:uTnWFl/aHDxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368881, "uuid": "cceb9146-a3bf-4ce0-8a19-2567b116a754", "value": 1948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368881, "uuid": "2885d490-1cf8-4f9a-9126-bb6b49219e2a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368881, "uuid": "063dfc54-172c-42c7-8275-c5397040f309", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042adf2c-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778331183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331183, "uuid": "89293efa-6562-445c-9401-2006f9be8553", "comment": "Malware payload", "value": "ce079284f047ed1577c4fd3b57b092f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331183, "uuid": "ff47e20a-9f00-41e2-9be9-3e762bd894ab", "comment": "Malware payload", "value": "5bdca67cfcf4d77c2d9901d5280b043bb009cffcae3c2ad307fa7348b034202d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331183, "uuid": "0922c177-6382-4a30-8654-42a2922245b6", "comment": "Malware payload", "value": "b4fa67baa87ba32f12b60c57df8d40f2160bb94a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331183, "uuid": "8c231b0d-edb7-4fd8-a6cc-758818df6c8d", "comment": "Malware payload", "value": "dcd7e2bc02ca7a5842bae97e82ca6299631d0ee1fb6d1b0536fb0471efdcc6f317bf98ee99418bc6ab9d1fa33bde2d78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331183, "uuid": "394f99aa-6186-45e7-8cdd-8f9b243432c8", "value": "T124E3BF927519E2A4FCB91933E493B6D383F8573B30609B1CCEBAFA335D295211197A07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331183, "uuid": "380c9c3d-f072-46e0-a102-bc523732c245", "value": "3072:DnRFd1RZGTqcCo1B9E/EQulb+VE3sAOcfNmsM9F/vcEd1b3DFKKk:1nA1BS8QuJ8qdJYsM95vZXFKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331183, "uuid": "1510f96c-33c4-410e-941c-36a508ce124a", "value": 155317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331183, "uuid": "880ad0f8-6c69-4975-a168-d7788c9904f2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331183, "uuid": "8e015c10-c66c-4b33-86c0-7f989dda09d9", "value": "bot.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91633456-4bae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778334856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334856, "uuid": "05aeb6ec-cd85-41f2-9cda-feb0912856e0", "comment": "Malware payload", "value": "fb8833a1f9f1d687c2bbc973345e2246", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334856, "uuid": "1a61aee2-d35f-4c8f-af50-cedc42fe5aa6", "comment": "Malware payload", "value": "5c78c9229953b2ee7745ebd76c5da095316ea685deb4edc400c65175b56b99d7", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334856, "uuid": "f4a84846-85f7-4132-8954-11ddbb4d7d02", "comment": "Malware payload", "value": "3434c455f66a7b98c802d4d7122c554945a639d1", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334856, "uuid": "b0506b15-750c-4aef-a670-d3507baace08", "comment": "Malware payload", "value": "51576eaf2a3a297ce5e61a9c25818ddaf6dacdd99805ff5386f4e93c2f81b84b70b143753f20e659c89e96ccd6d9439c", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334856, "uuid": "8759f854-2f31-439b-90f3-0a889330761f", "value": "T1B14733FA5170C25BF33FC2B2D0A6490E45D85C84C857F22CEAFA43C54E8FA56295E46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334856, "uuid": "1d04130b-de39-411c-8c93-b7e879214a8d", "value": "786432:JS7glhAYmFaphtR6QOwZEzqqrOR5eNndQHhaITu:o7glTmFaTtRTgrecldmLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778334856, "uuid": "e88a094b-5980-406d-bda0-f6e5a1b741c4", "value": 26444773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778334856, "uuid": "9aa2a527-3df6-4080-99c0-bc42adb95839", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334856, "uuid": "0fa27c3a-b13b-4590-9763-d4e3715f1b46", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fc346e-4be8-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1778359803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778359803, "uuid": "38dd2621-975d-4e57-9c46-f0872e8bd354", "comment": "Malware payload (SnappyClient)", "value": "00e76783681627c9266b2bfda208666b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778359803, "uuid": "74751ee8-3d93-42fd-a2b2-5d29baeb0a37", "comment": "Malware payload (SnappyClient)", "value": "5d28c2fd5935069b2fb82d745ce4ad46cff7db43203fed0af9d594c0e4424d19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778359803, "uuid": "e974083c-7f7f-4676-a2ba-f133e3be6017", "comment": "Malware payload (SnappyClient)", "value": "ac17d42a4ee82a601832e7144d8d798139d36363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778359803, "uuid": "0cce9603-c81c-41e0-9246-4920d16e2282", "comment": "Malware payload (SnappyClient)", "value": "9cab0cd8685d362b9d4a44d1a8b4766bbe8b4bb4c82174cd15d8b0f44d91e07b93f0a6e3ab8e23f24a84b97ae04c90bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778359803, "uuid": "86e0dab4-10ef-4bb0-8435-58e06db2667c", "value": "T13D761D19CCBBF758C804907DBA2F9070347E2489FF5A52E71BA8BE141E24AD505BB5BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778359803, "uuid": "d3036fb4-d08a-4e3e-8c2b-21df72cf0ed4", "value": "412c31f0a743f689d79feead4c90902b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778359803, "uuid": "c3d86915-72cf-405d-b19c-ebaea25116e7", "value": "49152:cdnPhtHhwrVzlKyQEyjxu19Q8ih2xOsXRZJGbVT+I5d:cdBeZuCLcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778359803, "uuid": "540d17e7-c220-4b11-99c3-294887fa0b3d", "value": 7752704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778359803, "uuid": "478d5a1b-c961-4bc3-a697-f2b73e07a29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778359803, "uuid": "0ed7f583-7510-4949-866e-ac30743c10ee", "value": "SecuriteInfo.com.Variant.Midie.179810.28929.17303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a11c43-4b99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778325728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778325728, "uuid": "dd2c00fc-d3b2-4818-89b2-da3435357c48", "comment": "Malware payload", "value": "e322bf9bb6d6571ac6d98dbcef6f7bf1", "object_relation": "md5", "Tag": [ { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778325728, "uuid": "fe4d8c00-1432-449a-bf85-34587c973eb3", "comment": "Malware payload", "value": "5d706781fc6bb741045e8db41d0a8d9b6252f2908aa0e5df2595795a64e6c60e", "object_relation": "sha256", "Tag": [ { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778325728, "uuid": "b74f7f4e-ace8-467a-b1db-2eb1a72ee0c6", "comment": "Malware payload", "value": "b075479b4266a59a02de0aac3cb75467eaa4af05", "object_relation": "sha1", "Tag": [ { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778325728, "uuid": "479f503f-9ba8-46e6-b281-e085d1aa5c67", "comment": "Malware payload", "value": "851f7e5d3b82550c792a8f6d08f13f8098740b8520dfdb851d619ff5465f2a2c269260abd4a76ba2ed8a13d6548923a1", "object_relation": "sha3-384", "Tag": [ { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778325728, "uuid": "62c74d2f-5c1b-4048-a9de-e464f152bc7c", "value": "T1D2F312D4A78A2FABDDA31A6650747776C08622D358F7273CEE3C5A6C2654C871FBE040", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778325728, "uuid": "7f5e742b-519b-4670-a8cc-ea00d04f67b7", "value": "3072:5XrE+3fQ+k8F6J8F5ivQbRJAsc7ItEUZMp9m5brWs3Q8PPjtGZyJIQU03Daw:5bE+bk8YCzeQboss1Ab3QAbtx6QKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778325728, "uuid": "e930af16-69cf-46dc-8e95-b59bac087c9e", "value": 157313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778325728, "uuid": "e4f728b5-826f-493a-bda0-e5f02fef3922", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778325728, "uuid": "322c70c6-5afc-4521-939d-e339bc639322", "value": "\u0417\u0430\u043f\u0447\u0430\u0441\u0442\u0438_\u0434\u043b\u044f_\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438_\u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0441\u0442\u0438.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5cdd49-4b9e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778327871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327871, "uuid": "0e38a2e4-152f-4ca2-991f-e60fcc9fa683", "comment": "Malware payload", "value": "844f6823b06c70dbae2d81b44d69adce", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327871, "uuid": "be6fcc07-3f2f-4cd2-83f6-cda8482e7e3d", "comment": "Malware payload", "value": "5e14b3dd4e81b1e61e32e4252970d1b56dc7c27ab3c011e3013eca4a7f4640e7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327871, "uuid": "3464f862-a451-49ef-8850-ccbb25e24cde", "comment": "Malware payload", "value": "a21c75a11f8dbc92c12b1333bd9f388b250bacab", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327871, "uuid": "bbdd1cd8-1381-4c2b-925e-930edbdfbf20", "comment": "Malware payload", "value": "7f558d19b7b22e0aa203eed889c6cf7904cf440d62c16e8395555a5139ba7b1f30e53ea975ab809ec5db7552992025ca", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778327871, "uuid": "a53c9f64-5509-477d-b2ca-999122b8769b", "value": "T11A51B4CA1B4291716CA5982F7EB5C849F3D8AECFECC02D0458D979E894DDF08EE42653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778327871, "uuid": "92e326d6-7382-4065-b040-1c1750c8f735", "value": "24:xjl8cWJ8WffIJ8/KJ8cBEDBJ8R+J8Nt8J87n2J8SMJ8BuJ8yB9SKOJ8TiFJ8KS16:/WVf+5wnLTtYHfOKEfj+Ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778327871, "uuid": "3e42cfb8-0b49-4dfc-9c6a-93562f219491", "value": 2546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778327871, "uuid": "83e3b666-a6fe-4caa-a7d5-f1faec4e27a4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778327871, "uuid": "3e312abe-ccc4-49c2-a6b5-850bbedfc841", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f77083-4ba5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778331058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331058, "uuid": "17fb3526-ffeb-41d2-a4c9-82b5f675ece8", "comment": "Malware payload", "value": "9c67eb69320df4996f67f577a55fdd47", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331058, "uuid": "0e0c5f17-5f8a-46a8-a23b-5c82adbe70bc", "comment": "Malware payload", "value": "6257c5693b0768470c5a1a0ea7c8efa9feb6dcda395ea8c768fef11b458ee7ea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331058, "uuid": "cffd59fc-0c45-447c-91cc-3374c0c53d51", "comment": "Malware payload", "value": "d0318832cb573cd4ea4d2182bc3811291ce33022", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331058, "uuid": "9f36922a-d8a9-42c4-b402-e1872199c752", "comment": "Malware payload", "value": "3b384ddfaaa26363fd5a1f92735814ebefb408fb31b310e46164b6da0b34e8c554c6a380b3ce2219f1b8b175b20bbbf6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331058, "uuid": "d7ec6b74-7d27-4b4d-9bff-e53d4c471b9d", "value": "T14A1126ED19B794B7C023CA42B3A5C8C9D28C97D03BE49E3964840E73748DE41BE35B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331058, "uuid": "fc1e161a-074a-4662-8ca4-c04361e39749", "value": "12:gGqQomGqfomGq+omGqd4OomGqdomGq2omGqZomGqx0omGqKRKuomGqFomGqU1uoD:guLoiw1Qx0CRKQdGQ+PBbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331058, "uuid": "419b4a6e-a82e-4253-87d2-dfd2e4a72433", "value": 973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331058, "uuid": "fcb0100c-71c0-4289-a328-76014536dfb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331058, "uuid": "52043c6e-7657-4f8d-a613-5038b3bed21b", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e30161-4ba8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778332145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332145, "uuid": "2c0cfa7d-10c1-4a8c-999c-d4cce8fbd2d9", "comment": "Malware payload (Mirai)", "value": "77b52be0bc65814f91d14ce84fc0c5c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332145, "uuid": "6e323ebe-5886-4aba-909f-52c48c5561df", "comment": "Malware payload (Mirai)", "value": "637b64d25ec0a4bf85e9d6b9444049578d0b10db6f730214da8261ec89ac19a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332145, "uuid": "cd57c15d-977c-469d-807f-202773fc9de2", "comment": "Malware payload (Mirai)", "value": "f4ed067de83e91aaabea476351284d15dd3db981", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332145, "uuid": "ecd9de61-0191-47fd-9153-3fa4593858ca", "comment": "Malware payload (Mirai)", "value": "52fb255f98208d7992628a2b7c50bfa5dc208d3b667da1237c00eed6075098c92c194177ee82240c58e501635bf96e9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332145, "uuid": "0308b044-9ba7-4ea5-8e46-5559694b2e9e", "value": "T1F9F33ACBF800DDBDF81AE33B08130909B530BBD154925B37625779BBEC3A1991967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332145, "uuid": "ab316bba-b057-4817-bece-8aca83a600fe", "value": "3072:froAgUEFxOAaLfPd5g8FhPsiQJVHjbiYLQP6GzyJV+9nx:UAgUEOfPd5HFOiQHLayJw9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778332145, "uuid": "00ac2961-33e9-4808-8030-77d66ea2b8bd", "value": 157504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778332145, "uuid": "fb075420-9b19-4bc4-a42d-58f0df7864e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332145, "uuid": "ee12dbd2-aca1-464e-86dc-77802234127d", "value": "micro.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29b66de-4b4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778292042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778292042, "uuid": "731e6f0f-0766-46d4-a0ca-08a5c826990f", "comment": "Malware payload", "value": "5874d0b1ec17bf4981e61568ef805a34", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778292042, "uuid": "b9e5c1c1-7d76-4881-b625-083389b19b34", "comment": "Malware payload", "value": "64901be5d14f453599de1caa6b5e7a9d1a4c4f8b99c519bab58cb2108a8a7221", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778292042, "uuid": "f7c89a8e-6f41-4c19-ad5b-0ba1a0f29b91", "comment": "Malware payload", "value": "814e76f5424a11ee53ff4e42f8c2838d69d0de3f", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778292042, "uuid": "f4af0982-95fd-49c7-9fa9-f1536e5b5b1b", "comment": "Malware payload", "value": "11535329a7a87ce3acfd66f60dc13cfa6d0c274b8705b60009805e0c342eb305a543dd0cb58fdb4a6ee0a6d41dcf3411", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778292042, "uuid": "c85bf59c-4f53-47e2-adab-821bfe2db2d8", "value": "T1E0E4E115EBA414F8D17B813FC9974A06E7737C560760AACF23900A9A2F27BD45E3E742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778292042, "uuid": "2a2b8246-45c2-4f38-9e64-6c731afb2598", "value": "4bfc91f3e74bbb889bcf3811fa31cc44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778292042, "uuid": "266016b5-a827-4988-88d2-9adb1a6d14f0", "value": "12288:+bhyTI8EyWtqENtc45hm5IarWx9vwsDl1wLo04bcPIygelVXX2MK:WsRw4ZSarWLDl1wENbcgynXmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778292042, "uuid": "6f9a0bf1-07a4-46d9-a1b2-143cc7a4ff34", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778292042, "uuid": "b977ac19-db6d-4d12-bc45-4c670eaefa65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778292042, "uuid": "3cdbcaa1-3daa-4a5a-90ce-5ca48a486bac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241afb57-4bc7-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778345410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345410, "uuid": "70e99c43-b00f-44e8-9e1a-9cf155d8cd2c", "comment": "Malware payload (NanoCore)", "value": "ec8ccc35aa7da38339eabb7da17f7c93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345410, "uuid": "e9d8d604-bb54-4233-b58f-fe06ddd21863", "comment": "Malware payload (NanoCore)", "value": "6591fffaa8da18ce4d83b3f63b1382b35d28d899c1d691ecaad00cd838e72e96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345410, "uuid": "d3a0fb40-8772-4d22-af35-e9539043b458", "comment": "Malware payload (NanoCore)", "value": "2ee42ab832b934274b03fac2b62fb1298e3d3975", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345410, "uuid": "fd8b5184-96c5-4863-bb8a-435e70bd7a34", "comment": "Malware payload (NanoCore)", "value": "b46ed54905a02bcdee678919d79c42bb9d869fb84cb12394a69e7f7c08e4953ae8af7f9de5939759c60d06a34a67fda9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345410, "uuid": "84b9ba18-e342-4b09-bb75-0e2f66551fd6", "value": "T11D14CF163BA88A3FE2CE8679611212139379C2E398D3F3DE18D455B79F667E50A071C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345410, "uuid": "7a437f72-fe7e-412c-a5eb-4f5f7c910e61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345410, "uuid": "bcbadd3b-dba7-4010-82c7-383b08f37eaf", "value": "6144:MLV6Bta6dtJmakIM59R/4/hpQBhhVLy7x:MLV6BtpmkGR/4/UBh2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778345410, "uuid": "a6efa228-065d-441a-b174-a2ccecd98856", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778345410, "uuid": "c272fd34-33cc-4b50-a96f-62635f533503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345410, "uuid": "3212c42d-9f07-4b2e-97cc-a5c570efa153", "value": "u88o.com1liaw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791e98c5-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778331379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331379, "uuid": "f99e54e0-6e6f-49c2-84f5-8b491ab9bca7", "comment": "Malware payload (Mirai)", "value": "f996f389b8d67c3b11b4a1b8b3aacff9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331379, "uuid": "c34fd949-76df-4f61-9641-9a35ce77d5fc", "comment": "Malware payload (Mirai)", "value": "6618fa629b66739d438426d18e6898e150845eb0e710c0094d60c0617986fab4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331379, "uuid": "aefb58b8-d390-4be3-a617-46e18a5af7aa", "comment": "Malware payload (Mirai)", "value": "c5f54531556442fabd42a6b6c54008f3b4b33ede", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331379, "uuid": "73e6314c-de53-45a2-94ef-f02659e839bf", "comment": "Malware payload (Mirai)", "value": "0ae11541d2a284436763998e44ac6565918bb43adb04b470265bd6c777646688c2fde89aa5e135c9471ed0b3cd5f98e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331379, "uuid": "ee066d2f-08a7-4613-b964-3ed269eb44e5", "value": "T125B3E085B210AE55C02672FCB1870A90A3B17E7B4B9A150B4473F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331379, "uuid": "fab25dde-c872-4b12-875a-f382e7ec4d2f", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuH:as5zqhr5Nzy7wE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331379, "uuid": "f807183e-7a01-4a9f-ad41-c0607f41d4cb", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331379, "uuid": "645d7c5d-e9f1-4dd9-a1b3-f47aa4256186", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331379, "uuid": "f05283ba-5f14-4953-834a-8742bfb60811", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250535be-4b9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778326513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326513, "uuid": "93837cc2-5e3c-4ff0-a75b-d6f8fed5d8db", "comment": "Malware payload", "value": "2f655cb73c6e1338ed34f19be45d649d", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326513, "uuid": "a7afc4f3-84f2-4487-ad72-f9b68e824b6b", "comment": "Malware payload", "value": "67c2aace4b861db99e5f90ed418d0233d903e9c871b4b76a6364dabcccbe9b25", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326513, "uuid": "466f379d-7b1b-4ebe-aef9-41b12c941be5", "comment": "Malware payload", "value": "26de2c241e3c6f5ce374445b2e0924e73c1b70d1", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326513, "uuid": "2cf0b3b9-1c57-49f6-9234-243085542fba", "comment": "Malware payload", "value": "b81192e52d59148109f763570cc179d28c8ba5ec811890e5dea82e3e7cac6526fc04f2e848d0dec15d3d61c26313cc58", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326513, "uuid": "cf4fab51-e57b-4e1c-8e2b-855c2679afc5", "value": "T1B7E423678C6364028391EE51BA9439007B74B8A5F6F2DA376CE8601F6FE4F78D382D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326513, "uuid": "815be87b-9cb5-4f00-b380-e32df0992df9", "value": "12288:A4RFwujSs5rtI8WlTEf/h2a+Fug3WSo6/fXIyXHS9vGszS0O1g:A4RyujL5adl4fYa+vi6//9Svl0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778326513, "uuid": "10fa24f0-e48d-45df-98b6-de3d407cd881", "value": 695682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778326513, "uuid": "32060641-a2fe-4447-aa4b-e2e76c0144c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326513, "uuid": "c17eeb83-ffbb-4f7a-96ae-495dc85187e2", "value": "\ud55c\uad6d \ubbfc\uc8fc\uc8fc\uc758 \uc784\uacc4\uc810\ub300\ud1b5\ub839\uacfc \ubc18\ub300\ub2f9\uc758 \ud5cc\uc815 \ud558\ub4dc\ubcfc \uacf5\ubc29.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77f8ee7-4bae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778334973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334973, "uuid": "a20b7a14-5414-42db-834f-f11e32b2d59f", "comment": "Malware payload", "value": "34e58d421564508f809255fa597e69f9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7625", "colour": "#47A094", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334973, "uuid": "fcebad02-3053-475d-820a-88ef26a7a2a5", "comment": "Malware payload", "value": "6c989d270b75cdae099776d63b942640495670cfbe996162aa3514e8efc4a7c3", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7625", "colour": "#47A094", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334973, "uuid": "a7bf866d-926c-4a6d-b470-0864d9bf634d", "comment": "Malware payload", "value": "6c5b973e917357d07449f7d1e41d443e21118e59", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7625", "colour": "#47A094", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334973, "uuid": "2f076e81-5408-4b0f-9afb-101754b8fe59", "comment": "Malware payload", "value": "a2032cb96322a66f8e67991d3d5c745a2c99ef274f06fe0777482af71861df070a7141dcb3c03c6e4c85d9712084d3d4", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7625", "colour": "#47A094", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334973, "uuid": "1ed49be8-4a8b-4779-9224-4e4940b77a2c", "value": "T1440633EB1F19735FC093697DEB2C3996D94926E93E43B310DA81C8688D6D41122D73F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334973, "uuid": "6b3000d2-3a22-49f9-a0b6-7db5eb6d1003", "value": "98304:pY0eS6Ck0prZU/a57f82FMwAz+GG0Tak48RhB:pY0olcC/E7NAz60zJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778334973, "uuid": "d0404631-6ff8-409e-b7df-ce598c84f7b8", "value": 3913651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778334973, "uuid": "f44a6701-a231-410e-9856-daf05f1b88ce", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334973, "uuid": "4cf30e15-3266-42cd-96d1-5c49fbfc8f8d", "value": "file_install.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe74852-4bb1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1778336168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336168, "uuid": "7d2ba4e0-fbef-4943-ab75-9c6d681596f8", "comment": "Malware payload (RemusStealer)", "value": "93d57d97d119b8abf1c44d73c44c2d1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336168, "uuid": "4aa266f4-7398-4668-a5f0-7ecb9e94337d", "comment": "Malware payload (RemusStealer)", "value": "6d4ac4fab3ba6300532f552d595f3a3042a359c9c3f344528228f7cfe80e39a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336168, "uuid": "d66726b2-9f61-47b4-8ed4-54ca5c2f2608", "comment": "Malware payload (RemusStealer)", "value": "b0872d3492f86aba60c08e390e38a02ae8546b09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336168, "uuid": "d228de27-16e4-4d9b-a978-ed731b359d51", "comment": "Malware payload (RemusStealer)", "value": "806264e723849a72f46e4d5aaba5fada7b75d0d65515e037ce82e02619a67384d2b61bd6e17e68e2c7ad55d0e9667d90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336168, "uuid": "890ab01f-1b56-4571-909f-ecf470489c2c", "value": "T1F1465C17797941F8C1E1E239C9277263AF19B889933837D31AE29D602F363C01E79796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336168, "uuid": "1eee7420-abaa-4586-923e-cd2d6854537b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336168, "uuid": "d4454834-2c40-49fa-8231-5c8596f5a87d", "value": "49152:2Il9ohMA8cYMbeDDTM9jdcIpN+C6BltcWv:28bVozVsC6Bz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778336168, "uuid": "fdc725af-2ca9-410e-8274-6856da9f8540", "value": 5829768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778336168, "uuid": "e8dbd574-a209-4180-9200-66eb06d3de07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336168, "uuid": "71e27c85-a591-4f5c-80e0-9aac614b3049", "value": "WW26A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47415133-4beb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778360931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778360931, "uuid": "49dcef45-6559-4bf8-b36a-0e1f8a83c166", "comment": "Malware payload", "value": "be430657cf97c5b1f3fa1abd496a4f3b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778360931, "uuid": "d0e5c165-49cf-4d48-96a3-7a714647ef4c", "comment": "Malware payload", "value": "6d975c05ef7a164707fa359284a31bfe0b1681fe0319819cb9e2c4eec2a1a8af", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778360931, "uuid": "b7c48903-d5d0-4be3-9eeb-79ddff5a5ec6", "comment": "Malware payload", "value": "6839bd5a42338c41e81bb9aff8c4ed853d93801e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778360931, "uuid": "8cacee3b-8455-4b18-9ebd-e2fc30d65aca", "comment": "Malware payload", "value": "6fd9e718415c5dbb771f2a8a705efa25365e0e176726f3e5cf4b95365d9a6082fde7043d76bf0125bb148b064b11737c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778360931, "uuid": "53601794-cff2-4667-982f-3dbb412042ab", "value": "T1968633E79116C5BB847A729E4B61326411E923730F60DDB9F62EE0073B89EF4C06D26D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778360931, "uuid": "4914b90d-3564-4589-a58d-17f07eeee67c", "value": "196608:cySFlbt8/T0RynDYKSIkLWDZkIOm+7c1/OvhNKhhr:cLRtlM4IkYZkIOm3kLK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778360931, "uuid": "2174247b-c8dd-44c3-9ec3-bf18e7e0dade", "value": 7934496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778360931, "uuid": "89ee7b4e-6c09-4c48-bea9-67c0d0ac351d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778360931, "uuid": "78ff27d7-7662-4024-bc62-92c1ca952a70", "value": "6d975c05ef7a164707fa359284a31bfe0b1681fe0319819cb9e2c4eec2a1a8af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0bcbb9-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778331250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331250, "uuid": "ca92c37b-10d9-49cf-825e-b9b3220e05dc", "comment": "Malware payload", "value": "125bb29e6c86d1c28bcc243c51fe09a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331250, "uuid": "0687e777-c494-4e9c-b85e-eab9675ee183", "comment": "Malware payload", "value": "701b534d427c89c37c68d10aa92eb2a7470346e59a0dcd21eb092e8a0091f65d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331250, "uuid": "6b65ac12-6693-4d2e-bd65-4c8419b8f533", "comment": "Malware payload", "value": "5eed9edfc12fd5aa3f7794696963c67167b5aa18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331250, "uuid": "8e1e9dd1-2348-4146-ba80-f545f939907d", "comment": "Malware payload", "value": "00e20c307deff95a11321fa832135ec33549cd221d1e6f041eda9074cda9e9dccd95cafcce97587e6ed5b18c2f7cd842", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331250, "uuid": "cccf8aa0-0e3f-4cb3-bd91-f151857726c3", "value": "T10AB3C0C353A4253AE669C3F049AB977912227D98856032856F8CCFB4F546D00AB3FB77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331250, "uuid": "a37be749-bf17-48ad-8113-f240451384b9", "value": "3072:tPMSB3hE+04ocapJCu/RjKL0l5mai5y4sR:tPlB3hI4epJl/ZKL0l5mdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331250, "uuid": "da6a463c-d177-45d1-a9cf-7313979aba15", "value": 118134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331250, "uuid": "8289a1aa-f2e4-42e3-adcb-a06e57fe4cda", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331250, "uuid": "1b126866-f416-47dc-948c-98325726602c", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032a5d98-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778331181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331181, "uuid": "54af3de2-6568-4cde-bfd8-dac9a95d2e93", "comment": "Malware payload", "value": "dc7be959761996d3bf5f6522380acf38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331181, "uuid": "6a864636-82c4-41f2-9ff2-256c2911b0e1", "comment": "Malware payload", "value": "71723de3894d19a898b41dde1bd5ed0815ae428c3478be27469a5db3e2dc4748", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331181, "uuid": "b13573ec-0bb1-461a-961c-32923f067321", "comment": "Malware payload", "value": "621b00fce6a9979260293d2dd5a9f63b89a199e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331181, "uuid": "ba330f80-7940-428e-ac90-0ced0a8507de", "comment": "Malware payload", "value": "1ea112cae6066c59105e1691b5b71dfdf158c940a18ff2ef19f1fe264af503b984bd354d6fb74f8eb92278141a290844", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331181, "uuid": "b31ce20c-659d-4c38-b32f-30afc3ee8cc8", "value": "T193E3E0D4F0F0E7A9F7F1C57DB74E1634721B43AAA0DB7A13851486B017A226F0E2B598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331181, "uuid": "7dc62ebc-fff0-416a-948a-ad738dd85e03", "value": "3072:g8icHMgi9QyJ2/OrZ5NzTxkH52hAsPqLxFH7WAnQC7RyHYKLPVbdL:lr5GQys0Z5NHyktCHTnP8YKZJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331181, "uuid": "8f5273cb-acdb-41b5-b410-4cb8826e0138", "value": 143802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331181, "uuid": "3f1ac280-7ccd-4107-b20d-217b9ef53bf5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331181, "uuid": "754d4c90-d859-41bf-90a9-50497ef2ac7a", "value": "bot.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbaff0e3-4bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778349154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349154, "uuid": "2c27daf6-7f7f-4303-a286-6a8302c9ce98", "comment": "Malware payload (Mirai)", "value": "0d38b0a7e7f282f54dd16f85feebe05e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349154, "uuid": "37172a5b-5d3f-49b5-822a-b4f595c88c37", "comment": "Malware payload (Mirai)", "value": "71f32d87d7ed3fdcca545dcaa33592e54711d371f1c29f9f3497a39ef5f3731e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349154, "uuid": "8ff343ec-79f2-4110-b684-349bda7ccc35", "comment": "Malware payload (Mirai)", "value": "f88a55ce26336a7aa4806aa68d0f6111313ce8ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349154, "uuid": "1a3d2e85-dc3f-461a-a841-8bbf80bad77c", "comment": "Malware payload (Mirai)", "value": "17979b4798d9e78f037f70d7a42a4ddf7fe2817397aedd1bc50e09cfe7e98252cf8eacf19e4d5e5dc455793be6b2ff96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349154, "uuid": "82dea951-6dbd-461d-8670-c406e80134a1", "value": "T14B836C23B5746A17C0C0E6B701938336B2F72B595188D35EBE724D9E9F1938016BBAF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349154, "uuid": "c10a4348-b8ac-4cde-a0f2-84c7250585ba", "value": "1536:zzZtLtssJ3kRS/uiUL/teE6/VOs0IyGSUCujQGyvGwAAPrnDAwb:BgW/N90SfANb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778349154, "uuid": "0e3588ba-04ac-4f2f-9353-bd258b662a01", "value": 81756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778349154, "uuid": "4357ca6d-d3bb-4fbd-9a54-9fcc9cd03e0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349154, "uuid": "006837fd-2947-482d-ab01-a460beae5535", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39c7d90-4bb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778337597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778337597, "uuid": "71cdaef0-cb29-4f08-ae77-58e88c9bc808", "comment": "Malware payload", "value": "81f4bb81d20fc2c06ecfe43bbee1e2a9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778337597, "uuid": "f3443647-4ebc-4dec-bbc1-9c6847ca7fe2", "comment": "Malware payload", "value": "74a739ce0be6f3261edcedc55e3462abaa075fbb66f205ef94b7f1c87d7178c4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778337597, "uuid": "79dea3e7-2f95-4c13-82b6-e0c0a21c5257", "comment": "Malware payload", "value": "cf7c231bcd36df75a00c2f7328d649aa75187f83", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778337597, "uuid": "133f7126-8320-4337-95de-66e7139a6b27", "comment": "Malware payload", "value": "38da8705a56e517444f99d26985c47c68aedb557e82309ba9a85a58a6755a87dae3188404209c885516d7513eeb55b6d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778337597, "uuid": "0d564ec2-3bf2-4d99-b98b-2a03f4bc948e", "value": "T1565733AAC052421BD837C836C999E052D279FD8BA842CD472572BA76C5FB3C425FF58C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778337597, "uuid": "3938c3f8-6bd8-4cc4-9d7f-f7cd42d6a0fc", "value": "786432:Rm0RvlVH+cwudw8zbt29NCSVKIUXXyKKwlkI7HUSLDIGE:RDllVecwP8zKYSTmypI70O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778337597, "uuid": "07587271-8d8e-4ae8-a3a0-659238a17a0b", "value": 29016064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778337597, "uuid": "fa735d39-7a43-4c44-a1d1-64a6efb58531", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778337597, "uuid": "0c925901-f361-43ef-8ab9-1dfca6908374", "value": "University Rush.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dea6cc9-4bd4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778351117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351117, "uuid": "0e7c62f9-a765-4575-a83b-61cc5365a67c", "comment": "Malware payload", "value": "49a5e767dd3252b53a276d08cac9f973", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351117, "uuid": "6b1f070d-2f5c-438a-b2e3-a390331ae462", "comment": "Malware payload", "value": "74ca73d1e21488843821a07a4fc3108b2e05e17bd24196ac9c465f0090718e12", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351117, "uuid": "14a67d72-fcc8-456c-95cf-e35204e702b2", "comment": "Malware payload", "value": "ac1555bd6f0dc7736e82bbda7847dd99cc9fef8f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351117, "uuid": "fa478d88-604a-4d30-8b34-1647ca6e3026", "comment": "Malware payload", "value": "6a8e77cf90f5542496fb7000acc3b364f5a0b5ad6623ff0c969a948b975a7fe34756ca4b8135542efb4e786df422ce3d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351117, "uuid": "74404878-85f1-457c-ba15-30a0b01c5fd2", "value": "T12EA4D919FE95C73DE493A13C0010DD2B672D80CCE487EA3B15A5885D0AB2EE55E9FEC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351117, "uuid": "99669426-b909-4be4-9466-ba5b38a46348", "value": "12288:tj2E8NchyOUjwPw3NfndyvPcVFZM6gbhzt:J228Nfdyc2zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778351117, "uuid": "87b2a619-9b78-4228-b391-188761e4c219", "value": 464908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778351117, "uuid": "2addc709-55e0-47e3-b38f-c6485d9897de", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351117, "uuid": "8ee69051-c11c-4db2-907d-f83d21c30c59", "value": "float-client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2eb528-4bdb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778354072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354072, "uuid": "fb492dc9-b0dc-4af9-9749-423a7b7356e8", "comment": "Malware payload (Mirai)", "value": "02857acc8c51ece35ed84fea240b05c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354072, "uuid": "5d4dbb09-842e-4066-a42d-536f76dd555c", "comment": "Malware payload (Mirai)", "value": "788705db4278e7cfc1377bdce0c95600fd30d37280a03ee5108031e1d90805c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354072, "uuid": "80c284ea-fd5d-4f3f-a490-5eefbf42cc0f", "comment": "Malware payload (Mirai)", "value": "f7aaad6e2b793aa349602923f18b89a77e1576a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354072, "uuid": "6b3cde3f-f2e1-4e59-a0d2-4507e65800f4", "comment": "Malware payload (Mirai)", "value": "6a0da2aacb5fab9e18e7de786fd02214b9984a79c3d8f59853b2c8ea0f5f0aa98ba3506c00f49642fe6febaeea2944e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354072, "uuid": "9812e1d7-332d-473f-9189-88e412eea192", "value": "T131C36C43773D4E43E1A20EF03B3B67E583EAA59321E9F4453949AF1E81B4D364906EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354072, "uuid": "b6f63d8a-ea2a-4c01-9662-2f2c87b05408", "value": "1536:6kfiXtkAQttuxaeLaxU2jomTCcB3ludVZrvk7TQQj+3oDcVzQ2tOrPy3oPAvrXDU:HUtRMTUeomWceFrcvQQ7cVnOrUt1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778354072, "uuid": "d020d976-5367-4653-a9ed-456d69ae893c", "value": 126068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778354072, "uuid": "6ab996b2-29f2-4c49-96d3-84408219998e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354072, "uuid": "fb709d61-63c6-45af-bc15-e1080710a8a1", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f42f498-4bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778342019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342019, "uuid": "2b64615f-ce2a-4e87-aa53-be102f47c812", "comment": "Malware payload (Mirai)", "value": "c52591140b2457c7637447aaf646125f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342019, "uuid": "374141a2-45cc-4019-a49f-d751e69d9a14", "comment": "Malware payload (Mirai)", "value": "788998f80b411d39c4956bdd54a16a144000d8a9fb9c82803937c609df0575b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342019, "uuid": "fcd65674-875d-4fb0-b358-2483ef89d94a", "comment": "Malware payload (Mirai)", "value": "5cb86f26b6855d3e9628508643244da647c0f488", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342019, "uuid": "0de1c98c-f36b-4b03-a1fa-2a338ef53734", "comment": "Malware payload (Mirai)", "value": "266509e7f96bdf44957aa115ed5545d75b39e1b3cc4a20f953e50a3594219ea9d626f210e415f5368adbc0b88e6813dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342019, "uuid": "1e4680bb-86c0-4724-9f2b-d190fb55e4d9", "value": "T15F463A9CF81DE5A2DDD8BA747BA141867639BC45AF81C7232600B76D75F33D88F22260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342019, "uuid": "834ebfe8-872c-4721-a7bc-ca517bfa924f", "value": "49152:JnuqtyQfieR6bqHSKQDKhFzfC5ErUey4unqi4u:Vuqt3fi+6bQSKQDKhFzf4EEqiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778342019, "uuid": "4202b4a0-6800-4a13-973f-9e2e093bb552", "value": 5374273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778342019, "uuid": "1953e032-fc77-4093-9906-943a01586bd4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342019, "uuid": "80661e43-da1e-4055-b96f-fc0ed6884eff", "value": "android_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de5b57a-4b9f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778328354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328354, "uuid": "d2e247e4-4d60-4969-96cc-f425e69b4ca0", "comment": "Malware payload (Mirai)", "value": "d1bbf17bdc867833160e536416b4d9a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328354, "uuid": "bf9cbabb-6fde-4647-a040-f6ad23d8825a", "comment": "Malware payload (Mirai)", "value": "7bb8198bb7d23236888579a8a29e33bb67106835dd1f6728a3a1c858469516aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328354, "uuid": "38998f96-181d-4176-b4b4-6566550c2ceb", "comment": "Malware payload (Mirai)", "value": "6a20c04632696641efb5cfcc16ba67089018d948", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328354, "uuid": "90e5d8b1-ca0b-42ca-9bf2-70bb928c78fe", "comment": "Malware payload (Mirai)", "value": "310fbd24292a8f9dcae4746a90370339737f29d80dda1c318f5ee5657a17300e0bf03a9e1533c45d9dcc3c04f29cc6f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328354, "uuid": "73a1cb48-6726-47a7-b6d5-623bfba6039d", "value": "T123631247FACC0F9CFCEA2AF807AA66DB17625030A4B281E40DE55C89C16F9B115D78CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328354, "uuid": "147eb604-ce3e-40a4-b5e2-accb248e89e0", "value": "1536:Ja7MbwKNGjjH+Xq34n/q8Zu41zmX3sDg63SmrPC:47Mbp2L+Xqdfoz2sF3SmrPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778328354, "uuid": "65da8f7b-b8e4-4e0e-9b96-494fcd9eb259", "value": 70852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778328354, "uuid": "bed79064-5583-49de-9385-d98fa3a62b03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328354, "uuid": "d5f32caf-f151-4bec-8c6e-6c3019a9c383", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850c4cdd-4bde-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778355451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778355451, "uuid": "e403f894-df29-48dd-bab6-b8290a398300", "comment": "Malware payload", "value": "88d54d9d1fd9bba55ee1c96516b85441", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778355451, "uuid": "8b23bce4-9215-4b33-880f-11e35568857f", "comment": "Malware payload", "value": "7d7948005af45b2fbc59a20c266ffd70f584d0fba1a28e048bd9994ad9353bdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778355451, "uuid": "4b11c8c4-cd59-4d27-9f17-22e29ff61be6", "comment": "Malware payload", "value": "dd2f7cbec8e36f5e7ed28632aa084b33cd79e7bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778355451, "uuid": "f0172118-a071-4696-8203-6fba1f552033", "comment": "Malware payload", "value": "de952aef61c77ae677a5f551e28e1b4ead1ac97cb2bf7a7c803e9b737b8f4c7a196d70f1124219a620982feb3bfaeece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778355451, "uuid": "e92b2f41-ab26-4497-b52f-fb50ddd9a9e5", "value": "T102A2E54E339714EED21BD174F4F65775AA60FC320C798B3E0260D63B1E359904A69E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778355451, "uuid": "f4dec1e4-84de-4494-90ab-56ad767ce4be", "value": "3ae4edc93391abcb2137259c649cb13c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778355451, "uuid": "971685e3-fa3a-4923-92e4-26130792aba8", "value": "384:BbkExIgHUOyTTl0X9n0sIqO7+lXqmJcPE:9D+gUTxtdFwXqscs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778355451, "uuid": "1fc61d79-fcb2-42dd-8233-a75307f799d8", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778355451, "uuid": "14027606-0f6e-4e2f-9172-b55cd3046d86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778355451, "uuid": "22ed2089-1d64-4c01-920c-2336b1686ee8", "value": "sysconfig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad83dc8-4bd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778352561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352561, "uuid": "112df11f-3f08-4856-9d2e-39e804825bee", "comment": "Malware payload (Mirai)", "value": "2acf917114feaa66caf705abc34191ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352561, "uuid": "ee3782a8-b4e3-45d5-8328-b33eca180083", "comment": "Malware payload (Mirai)", "value": "7daaba3ff30f0981f29ebc2dd9e1f5f11d0a94d1ba22f2646339c5886f2fee62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352561, "uuid": "ebf7136d-05b7-4d8c-8834-5eb6eaa4dc0f", "comment": "Malware payload (Mirai)", "value": "aeefbd18b5dadfb6f21d29f91b8eb7413ebfc83f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352561, "uuid": "a9ed4200-f17b-4151-95fa-d23cd6686f66", "comment": "Malware payload (Mirai)", "value": "a6df1293298ff22690115b043487e1f8061f99e417395e658af848067af87b32f1051a4c056f059cae763facf1aa0ff6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352561, "uuid": "8f078692-df2e-4221-9990-77be9442546b", "value": "T1B0C3284AB9429F12D5D325FAFB5E418933135BB9E3FB3102CE219F60238699B0B77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352561, "uuid": "3439b040-e3e7-4cd7-aa28-38840198001d", "value": "3072:7YrbTPxaiMB7+55UVa1AbOBmYmSpXuJdELhE+fZamnC1H:Es7iWVa1oOBmYmSRuJkE+fZamnC1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778352561, "uuid": "9f71302a-f94e-47ba-8b5f-c4737d339735", "value": 126412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778352561, "uuid": "a6ecfe2b-1828-4d8f-9375-2c3fcbf3741f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352561, "uuid": "a88dc24f-78d2-43cf-b92d-08e2b3d1535a", "value": "zyre.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71233e98-4ba5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778330936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330936, "uuid": "8786ea9a-c9b2-453b-bf1e-d62720619ffc", "comment": "Malware payload (Mirai)", "value": "b93202979ea54c579b89d1c2f1c3c476", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330936, "uuid": "375b4924-cb51-4aca-a8a1-5236f5421484", "comment": "Malware payload (Mirai)", "value": "7efcc333b44ba273c80b4fe8fac6f9107b7dafef830d616262667e2e56b831b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330936, "uuid": "fea10784-4c79-448c-91a9-ce1340ca8e6b", "comment": "Malware payload (Mirai)", "value": "7b17d31f078c1d043994c69d029818de36b2c26d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330936, "uuid": "55d3ffa9-49bd-4cd7-b6b4-981d3744d55b", "comment": "Malware payload (Mirai)", "value": "46e56742a782b40bd503be125f2f710f8e4aece5eb7fd767e2c076dc838bafe5235086c668c19d4242523c60053c0bd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330936, "uuid": "e3ebfee0-ae62-45a2-8cea-33202b8ee083", "value": "T14D43F1EDBF20B74AD4AE8DFD165CAE70654434F103FA5A4CEA2A0C06234C95B71A7539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330936, "uuid": "de35cbb1-1b3d-4223-b446-3ae558e51831", "value": "1536:z7aAaJzNunemIrevu5FbeSq8H9X74ns20JS:uJunem6F5Fbp9r4L08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778330936, "uuid": "83aa8324-72be-41cc-af8f-71a61d541c62", "value": 58052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778330936, "uuid": "258e22fb-9e69-4bac-9893-310609f445b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330936, "uuid": "cd756c2b-25c5-4605-bd3b-7e9d8eb71b15", "value": "micro.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781b1f36-4bae-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1778334813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334813, "uuid": "3e96f7cf-68ad-4182-b02e-0a4e2072ae49", "comment": "Malware payload (LummaStealer)", "value": "56ceaf9b3e7e10a1096853328711c1a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334813, "uuid": "5d49731f-8508-4b41-83ee-1ce53768bab7", "comment": "Malware payload (LummaStealer)", "value": "80d0658fe84de7066bd8115804e75c6ac5aa7562fbcd3321e21f6c609a596448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334813, "uuid": "1829bb38-b373-43e3-83c0-160df95adda6", "comment": "Malware payload (LummaStealer)", "value": "45e8b8bf7dc659da2dc0dd80109033b9eac81bfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334813, "uuid": "5aa9ebef-8d1c-4ac4-aeba-f193578e27b5", "comment": "Malware payload (LummaStealer)", "value": "8db765a00f51f8e8cc01e73846eb2639beb3582cf0ea4beef6d9584dd106382bb00101aa6253971788021848652ee89b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334813, "uuid": "f0c53ed4-32f5-4075-b054-3d747f50cf92", "value": "T109360901BB9184F2E5432E3221EB736FAB3C6854073DAB6BCB50BFA9E0777511923546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334813, "uuid": "6fe26303-231a-46de-9f6f-cda24d87ce4b", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334813, "uuid": "a4bc5b07-4e2b-42a9-9c0a-2e3c2aeb486d", "value": "49152:jw/hZKnG1BuuHYdfBevJriWJPM0mXW+B6EEsOE8d:c/hOGKUJBmX39E3E8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778334813, "uuid": "bf64e863-8c90-487a-804c-d15698c648df", "value": 5136520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778334813, "uuid": "2a29407f-970d-4929-bda0-1facb1b95d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334813, "uuid": "ff1a1725-4349-4b18-ad56-21426aa66a84", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8d9c0f-4bd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778352755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352755, "uuid": "86814f0a-5ebd-43b4-b7f2-aff861fba7a1", "comment": "Malware payload (Mirai)", "value": "ebd6ea39cf32176bd9dfc9b29da2ee5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352755, "uuid": "03ceee7d-c2ad-4bf5-b0a6-9c74a519a43b", "comment": "Malware payload (Mirai)", "value": "8299de80e6257677f999b812ec57452e7067943eafa015cdd4a6a7989aae6c2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352755, "uuid": "d4fc8c04-801e-4968-8974-6efc843426d7", "comment": "Malware payload (Mirai)", "value": "930003e2e0a5b14fe69f4e92f275168c45eb2347", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352755, "uuid": "c300b3bd-938e-4e17-a13d-d9bf1b007836", "comment": "Malware payload (Mirai)", "value": "5217a2e9a92192c28c4919c4a186d27f081e2370810a3d2f493cf147f2826ba943c5a875aad67f8226382495630ed10f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352755, "uuid": "1a851b70-c843-4c34-aab0-fade6519d81a", "value": "T111F3AEEFB68F1690C04702F00B8F8BAEAB9720248DAFD5E36D5DB53B452A5DBD015790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352755, "uuid": "4d3f070a-4315-49e8-a173-6fdb354a5730", "value": "3072:Ws+LTwAAgp9Ad+UtHrzPVB786Y/n7C3rtDqQhvgq/qw:Ws+LTwAAgp8VhUCxXn/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778352755, "uuid": "e695bab2-6164-4993-9c28-722808b8b9a7", "value": 157560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778352755, "uuid": "74058b4a-f30c-485d-9a12-c10e14083507", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352755, "uuid": "f3fb1b9e-908a-4974-9640-8163516beab5", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07fc24e8-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778331189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331189, "uuid": "eb213a4b-8fbe-4bf0-83ac-dfd632dff220", "comment": "Malware payload (Mirai)", "value": "1d28a364ae382ccd269e4887def2eac3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331189, "uuid": "7cea1b58-fd50-490d-9998-f358bba8c4cd", "comment": "Malware payload (Mirai)", "value": "849f1ca6e286c4e11d8f7b6188ef209f64e3ed65b6450531b45692ea010269a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331189, "uuid": "d23e20c8-baf5-4056-8d2d-5faaa9d230be", "comment": "Malware payload (Mirai)", "value": "4cfcd2c2d85bfa6e5216ad3f776c1cbe29a941ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331189, "uuid": "b881a9ed-f51f-4e31-9857-2b78d750c059", "comment": "Malware payload (Mirai)", "value": "8e0659376b31a6966a7ec27dde8c5d82bf435ec3c7d0dddd29f13c6ac6915220bf96e88809ebd2e181eee89b5038c8b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331189, "uuid": "5bd8b546-4d6d-4d09-98b7-ce5c95b9da97", "value": "T1F804392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331189, "uuid": "e5a23864-b854-463c-9887-ba0d620781b5", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wFUXS:7eJpJUVD1A8n0YNgEJi5aGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331189, "uuid": "a9f98c69-08c4-4702-800e-de9308a31027", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331189, "uuid": "1c54e775-4eb4-4c25-a141-db8aff6c7d17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331189, "uuid": "4343edcf-719d-4364-9a7c-5b5ba9ba4fcd", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad300b85-4bd1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778349935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349935, "uuid": "e673e520-6ca3-41c8-b60e-62f7ffd30257", "comment": "Malware payload (Mirai)", "value": "a890b336449a5b8a064dcd174c11775b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349935, "uuid": "da06788f-dc58-46c0-9ef6-beb47584d75d", "comment": "Malware payload (Mirai)", "value": "849f675771247c8f855212c043435751680d8438c1d49b8b2dcfb6e7d3fef7e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349935, "uuid": "6d7bb30e-7772-4d95-85a7-5ac1f4b193b1", "comment": "Malware payload (Mirai)", "value": "ccb9a865492014e7f58ebc4daac4e5ad8aa00bf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349935, "uuid": "5758c05d-2110-49cc-ab11-443a5285e53a", "comment": "Malware payload (Mirai)", "value": "7427a05d7d690af545f116842227308415861da9d4f2a21bc43a569474d19134b2604b86160aba0aec500cdc075c57df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349935, "uuid": "011d91ab-87f6-4396-b973-c74b6d06a7d9", "value": "T12D932A85A393D4F4E84319B001EBFB396A34ED331264D95AD764FFE2A9236C26015F2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349935, "uuid": "0c14a50d-4218-446e-9c5a-6b222707658d", "value": "1536:Fnn2aEkvZAL+hZhKLPZmcptpeSO27wfwTMUt31ZXQfdCXBr:2wFhniPZmMpeSO2xrXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778349935, "uuid": "a689850a-f364-4535-9ced-6b3d16128ba6", "value": 94508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778349935, "uuid": "31bf295b-9194-4856-a911-cab94c145b93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349935, "uuid": "762a950f-e756-454c-8b6c-526b9b69409a", "value": "zyre.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fdb7f9-4ba8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778332209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332209, "uuid": "8334fd11-22b3-49f6-a305-86d41afc66f8", "comment": "Malware payload (Mirai)", "value": "b1e56f390006d64685b5aba5519492f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332209, "uuid": "97123a31-30be-4a45-831b-46cdc2c8b29e", "comment": "Malware payload (Mirai)", "value": "850ec8a14709a545323e3455ca1d00059727cb23ade27541e8f6e29b15c5175b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332209, "uuid": "ee382f05-b4e6-4dcc-92a3-763c516f4825", "comment": "Malware payload (Mirai)", "value": "ad640d8aeb7d93f045f2fb725711e4cbf3f76424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332209, "uuid": "02425c17-490c-4fcb-9263-40cf4f0efc9d", "comment": "Malware payload (Mirai)", "value": "0822c9cb738387c245a30a252f2261495bcd1e6c7321e021de09796508c6d7f8ca6dc47cc3cdb9e30837b9b294d111d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332209, "uuid": "d1c2a761-4394-402e-a656-2d3dc48b1c60", "value": "T11FE36C0677390D43E1A31FF03A3B23E1A3FE918212E1B58175499E1E40BAD7A5A47FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332209, "uuid": "34b4d401-0f2a-482e-8bbb-68dd84503dc8", "value": "3072:cw/nYWTOA2nwRBULurUnS10JwvBT2RhwUG+5dXHL1kuKZBcf:ceYeOA2ni15TohzG+51HLquKZBcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778332209, "uuid": "e5bd6797-d822-4c86-8a9f-7b35f537ca3f", "value": 149532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778332209, "uuid": "0ad88e14-b279-467b-b57c-dc1d4539e7fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332209, "uuid": "55198be7-7de4-414c-a029-4d5204d38c52", "value": "debug.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cbfaa8-4ba0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778328957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328957, "uuid": "d9d4f425-af96-4eec-b879-39f04a4b2d67", "comment": "Malware payload (Mirai)", "value": "185fdecce4787a9f610ddf6bb5c2e64f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328957, "uuid": "1db5e3e1-6725-4c7c-b459-ca94a9227e13", "comment": "Malware payload (Mirai)", "value": "8517dd223395537aea6217d43fb112b7859c9e02dd780ed43b5f8b19bb209c30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328957, "uuid": "3a4c9b37-d7ca-4ad4-82ef-f825b4d5aa9d", "comment": "Malware payload (Mirai)", "value": "f66d41da204ce3c46824b9cbccbed1c5790b3e3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328957, "uuid": "f5921b8b-3a14-4da1-9668-1ce329efb738", "comment": "Malware payload (Mirai)", "value": "f3096551e5b5d31479edd34de713aa98890f6e62fb3f0060217c0acb773ace4c5b21bb8086ad8a0acd170bf83066b9e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328957, "uuid": "0fbaf98b-7368-4ddf-bb19-083f46045cbc", "value": "T1D492D1E5F2D67431C6F00A39DAB9984379E307FCD1E774066A608734621284BA8B978E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328957, "uuid": "5a6ca016-b084-44da-9e2f-8d42a453e3b3", "value": "384:yfflokIjiIlZpIOyF7m7mrSMN5MQYW4EqR9mhymdGUop5h7V:ZNiInATmK59MR9ms3Uoz9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778328957, "uuid": "530d6dc6-f7f4-4a4b-8b1b-b2f151870f02", "value": 20504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778328957, "uuid": "473fdeb3-81bd-4753-bfbb-e33e5265dae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328957, "uuid": "14a60689-73dd-4e71-bad0-3c260619e8eb", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4985559a-4bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778367806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778367806, "uuid": "db85ed9e-a2cd-4b49-a607-091f739b037d", "comment": "Malware payload (Mirai)", "value": "e775f6d1b2b7aa2cf2fcee3304de2cb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778367806, "uuid": "f0f81a9b-07a3-4eae-8140-3565dfe15e8c", "comment": "Malware payload (Mirai)", "value": "88a36e0423fda596ef8a70c8d1cf732f7b6475ff546b68c32a62abaf6bfe2984", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778367806, "uuid": "5b98d82f-0bc7-43d9-8799-286e2efc8fbd", "comment": "Malware payload (Mirai)", "value": "aac36f7224e942952de059ac4b7cba0b6230fddc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778367806, "uuid": "3b97477d-7127-43c2-95ed-36192df746b0", "comment": "Malware payload (Mirai)", "value": "a58a25ddeefbf336122f0e63719f8760ea501137f42e0e450ad7428c47b20919c6f0cadde48735bc7eb7624c1c5e7467", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778367806, "uuid": "fc712a97-8812-4538-aa14-4e41cb0dc6c4", "value": "T141261B87B8924983C4E43676B87E80C433A35EBA9B9753576D04FE3C3ABE1990E35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778367806, "uuid": "bdf25bba-a25c-4766-9ded-c96395a914f4", "value": "24576:MZL0elvVA+6FzudFg3qehmCNGtxKr7wrauZD8p+nXsHulklqgytXxnsxOy+YOAEu:M10vIcu1FUfd4ahonyeFkOVFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778367806, "uuid": "561b3de1-3478-47de-a92d-719258778ca7", "value": 4849664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778367806, "uuid": "ba20f06c-4b34-450a-86c4-6c4e995d245d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778367806, "uuid": "f70ad25c-7643-471d-bf48-a4cde098409e", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea1bdd0-4bb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778338582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778338582, "uuid": "6ffd210b-3b51-4d4f-9a2b-65dfab213aff", "comment": "Malware payload (Mirai)", "value": "2c0c96a4b8c6db0542c31b7f2c7c8889", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778338582, "uuid": "f9842f0b-1991-45b3-a12f-5fe40f7503e2", "comment": "Malware payload (Mirai)", "value": "895326a97fae909638f08ec86acf68de011576ceee4ec6bd3ee00080f00bf0e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778338582, "uuid": "f919fb2f-1605-4dba-aa7a-17313fcccb81", "comment": "Malware payload (Mirai)", "value": "a40d11d603be3fc8626a3df7a6a667e9a00af53d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778338582, "uuid": "fab1874e-0765-4aa3-9a6b-8d3a507f71cc", "comment": "Malware payload (Mirai)", "value": "a95c69d4db381c7901fcf098d5a802807f0e1c150bf83a5e1325f12df018da3abc68ce8fb482dbb4764ad64e12d82cf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778338582, "uuid": "0e2f2c75-08ad-4439-a735-019e9c641ae3", "value": "T123C36C56B603D4F1CE0109B0101BFB3A9AB5A431005DDDA7FBE9FEB5A862B82C41779D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778338582, "uuid": "175565c7-53f8-4569-9b99-a700d1ec3cca", "value": "1536:PaMwpZYUWHmT+2jBifQSHdP8J0O0xMPh6dr8odiMUM31EiaFAvrXDwRr:S5pZr+i+CUHdEixMJIBiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778338582, "uuid": "d4ce5126-8619-4c21-8075-55012ab0780e", "value": 128852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778338582, "uuid": "21fb1d3f-7612-4e45-9d48-4427cac08202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778338582, "uuid": "b098cb6e-7cb9-477b-8357-ddedfb702363", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6018bf-4bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778342013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342013, "uuid": "70aaee22-4211-46f3-83e2-e72c22feadaf", "comment": "Malware payload (Mirai)", "value": "fe54d27309b62c873dd6cd73896d482a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342013, "uuid": "0349b709-4298-4994-ac05-020009b8e817", "comment": "Malware payload (Mirai)", "value": "8a34648ad3a12582b5922510d4f0ccfe7426a81b65ae1a7bb6310649e7187d6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342013, "uuid": "09a43bbb-a9cc-461c-9ba1-ab3abed2e6fe", "comment": "Malware payload (Mirai)", "value": "73913138778f85c892b910ca1bde5b54b041b56d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342013, "uuid": "60fca1bf-f40b-44c8-b1b4-2118b0a4415c", "comment": "Malware payload (Mirai)", "value": "7151cf052590f291c44f68e677336d3e35d92f939f5963954ef7dbd4dcbdbb2a799a64805d81ba1118aee35ab8cccc6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342013, "uuid": "b6bfe161-424a-4928-a0e2-aaceb3e73108", "value": "T101363917EC9145E9C0EED631CA669252BA717C485B3027D32F60F7392F72BD0AAB9704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342013, "uuid": "7427d3d2-4fad-42e2-be36-0102906daf07", "value": "49152:Abx1XdgoyTVQuhnfYmMhP9u4M6gvCShiZQUDoa5EPczU/eq51T9xQH+G:mEauhfY9n6vCSotowEPhTDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778342013, "uuid": "16d3891f-09e9-4cc0-a7ef-87efbeb7b740", "value": 5030040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778342013, "uuid": "7a32a046-2609-4f99-a872-7ced76b14d39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342013, "uuid": "d12cc1be-5783-4177-83e0-3746d603063d", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4898e12-4bd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778349491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349491, "uuid": "934b4c4f-5a60-4bc0-9066-b5bcd197a57c", "comment": "Malware payload (Mirai)", "value": "431013a84f1a6b7a3ce64bbdd6f0ef89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349491, "uuid": "097e5fd6-6381-45af-b538-9e0510e2755f", "comment": "Malware payload (Mirai)", "value": "8a562870998c89d36e96cf5ab5468f6d509632e700a3fcec1c42bb7bc40e1b46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349491, "uuid": "96a63859-f950-4fed-876d-5d40f2b98d9b", "comment": "Malware payload (Mirai)", "value": "0a0634fbbddd551871635260b24e12a9cb12b996", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349491, "uuid": "49dfa0e7-b8bc-4552-aad6-3714d2ba801a", "comment": "Malware payload (Mirai)", "value": "6273302e08b2fcf073805b23641d94414355d7ca4f5734c9fcf042e7b89776e3b926829cabab658ae42c010c691b0c92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349491, "uuid": "1dff567c-686b-447b-870c-1a01c91d2944", "value": "T154D3299AFD529E06C5C606BBBA6E128C372917B4D3DF3103DD110F68778682B0E37A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349491, "uuid": "1c0939aa-a2df-4d64-86e3-cdcf57c3a33d", "value": "3072:GXUi7jJZrpQaTDuDm7c1UH8mgs+IOTKffuyaB6:GXUMjJZr+aTiuc1U8mgs+TKffuyaB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778349491, "uuid": "c4200da2-ef49-482b-ae25-fb2a2c350ffb", "value": 138088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778349491, "uuid": "2c3a250e-b019-4cd7-a230-6f28bfa2fe8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349491, "uuid": "4c22128e-655e-4cc4-a263-4f08b18983b7", "value": "debug.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc6f577-4bd4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778351120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351120, "uuid": "08eee647-d0ec-478f-b7bc-b753d9f36da1", "comment": "Malware payload", "value": "f8ba63095e9d2484a60b947af4ac28b1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351120, "uuid": "18367d49-1422-44d4-90cc-976f1fbb9b21", "comment": "Malware payload", "value": "8b3cab3350e1236c6659081481cb7335f37d2583ee2c21354892098ed715a5cf", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351120, "uuid": "eb0c2568-5361-49ec-99f7-1ef9f20a06ab", "comment": "Malware payload", "value": "f22dcc5fa811a8e4f15dda11056031569e58d20b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351120, "uuid": "a3d0df37-369d-43db-83a7-55be2c30641c", "comment": "Malware payload", "value": "5d501bbfa2dd1121751bb0d88ab52ad29ffdecc01c9add7de9395301d07dcb7cc04b49c351abf5f640adb86eae3a1eda", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351120, "uuid": "a96414d5-963c-47ef-be58-d74fdc18cdd6", "value": "T176E4A635FFAEC47AE053813A54815637B896C18CF352E777C79C4C082AF8B558A13AE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351120, "uuid": "4b44b1e6-4a48-48c6-93e0-3c0f63d3278e", "value": "12288:BMth/iuPmKHlW/u6KMIRiIqrxP3LzY+wPt8AkQITCpF:Cth1JqpXcHiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778351120, "uuid": "4c68af2a-de1c-41a4-946a-3cb99412136b", "value": 682071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778351120, "uuid": "a63f124a-b995-421c-8737-d256244a2b7f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351120, "uuid": "8bdc259a-d676-4195-a936-78a4094d11e6", "value": "solar-client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380ba163-4bae-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1778334706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334706, "uuid": "e348bef0-eb1a-4f6b-b2ba-3b7195a31c1f", "comment": "Malware payload (LummaStealer)", "value": "b8a6fe89be8d8feb128b4e7846fc1e60", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334706, "uuid": "317847d5-5381-46ff-a0fe-d5e2aa9d71d5", "comment": "Malware payload (LummaStealer)", "value": "8fa813514c7d9312f35ee6f2f35a570c93ca40cd29dffb34526119f2274c6911", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334706, "uuid": "c473526a-edf3-40b1-aeed-e5da6f3a1a96", "comment": "Malware payload (LummaStealer)", "value": "0eb399a76518fa474c2cd24e8606fa8603761f34", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334706, "uuid": "e3c35d33-829d-491b-a9e0-521bee28f0c7", "comment": "Malware payload (LummaStealer)", "value": "c8cb7e195abc455d93545376febabfa4ce682b496d0d232139bcb7f3dbb6e3109774373508dff87eb7732f12ce8548dd", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334706, "uuid": "66e8c884-b3af-4146-9d7a-0c02ca6b4a6f", "value": "T1C2A501C63FBA604BE864CE3DDE8910E131247148F73651B2D995A33FCAB5150D4EB2AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334706, "uuid": "41da8c6b-a82b-49f5-8a7c-b8132c1266ed", "value": "24576:pb1NSOl6otT+uEcq89pRefuJs0De+Uxe39/Zk1o1jWtXDS2yX26HYy6mJwFp59p:pb117UuNq89oss0LUx+9/62jgXeQy053", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778334706, "uuid": "898afc6e-43a9-4eb5-80b6-d38efe3f8e6a", "value": 2232143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778334706, "uuid": "0bf2b1a0-586b-44d0-bf37-a1d6680fa978", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334706, "uuid": "a2c5c3af-e1dc-4a15-aa55-c6d7707e8392", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5aa0186-4b8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778319938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778319938, "uuid": "c9898ec5-e7c1-4442-93c3-83d6d3d39942", "comment": "Malware payload", "value": "dcef3c1477ad0dea6439265a5d10023e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778319938, "uuid": "a3d7daa0-4356-4a78-9f2e-985b70001df9", "comment": "Malware payload", "value": "9062c792d28b5dcabbb5c523bbf2a98a2c7994f5c9daad87940b7068ebb65ce8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778319938, "uuid": "ba109d18-f764-4170-a681-25b797754258", "comment": "Malware payload", "value": "b87f7deb2ee5977b62f66c3e6b0f786ae7196801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778319938, "uuid": "d43b8a56-9009-4b01-9812-4e8253d8747a", "comment": "Malware payload", "value": "916aee7a77473f228aff78399195e02d0e3cf295de33f2643a4cf990886392c99d97208fdfe2be0cd5cdec722c6621e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778319938, "uuid": "00e67142-4bbf-4935-9b5a-f2311cb58446", "value": "T187083351F87ED522CFC5BAFCC3605362A874CE1B283436651BD3D005269A0A5AE7A73F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778319938, "uuid": "38dd60ab-5e1a-40df-a12b-ee6d401965ba", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778319938, "uuid": "8b597e38-5bda-46f1-962f-cc72d1f0ce18", "value": "1572864:Ntxzo0Ac9/NQnXRTx5+oT/kYl6vIXZOoeXAD/6Rai8Nv:NfM09/Gnhnf5qsOoeAD/Fi8Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778319938, "uuid": "4e9b107a-2e94-4d29-b0b1-2748832a20a3", "value": 81260696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778319938, "uuid": "9d50998a-1553-4bcd-b647-ad02b9270c07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778319938, "uuid": "ced127c1-70a4-4014-b1cc-23c8ef0cc753", "value": "Ledger_Wallet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9221f57f-4bdc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778354614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354614, "uuid": "ab6da1eb-8d79-4319-8cbb-c250f5524fed", "comment": "Malware payload (Mirai)", "value": "65b45ca587ebe35962be16c4038f7e18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354614, "uuid": "e739db02-55d4-41d6-91d5-8a96db617a00", "comment": "Malware payload (Mirai)", "value": "94efd7b9e7280d8ab1cf5755d9d51a99d822cd1c2bd80d89ef66ce172eca2d82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354614, "uuid": "c7aaf497-e6cf-4a1f-9eff-54d0d8c30959", "comment": "Malware payload (Mirai)", "value": "79e637a6603b525e7fa959eda6b347d7bf7db253", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354614, "uuid": "14bd4994-c32d-4190-be11-55a2350144a5", "comment": "Malware payload (Mirai)", "value": "3cd28f1b91a079c78cb0f1101f23b795943cfa2b8693eb2e60d1decab1dc2298b5182fc65c9925f7d671c460c5105e50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354614, "uuid": "8276c636-db85-46c1-b6e7-a0858d734278", "value": "T1FFF3E80AAF210DFBE8AFCD3753E9070124CC955B22A83BB57574D858F18A18F56D3DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354614, "uuid": "a5e41550-2caf-4f21-b7ad-e811dae859df", "value": "3072:dev04zFKIXGrLcPB0eKU8yur+TAL6KAC:dev04zFNXOLSB0ANo+TAmKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778354614, "uuid": "3fbfde2a-09a3-4b26-90e7-569c049cb5de", "value": 165636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778354614, "uuid": "0ee4b111-5189-4ad3-a2a0-78bed9855253", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354614, "uuid": "20f35e5d-1161-4f3b-aa36-7e72f52cd1c2", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c985b54f-4b40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778287705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778287705, "uuid": "9d882914-a5df-4dff-a2f6-2b0884b76a4e", "comment": "Malware payload", "value": "080cdba5e8ea08b478c6289042516445", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778287705, "uuid": "8dcec3f1-11e3-4999-a711-19fd3600f990", "comment": "Malware payload", "value": "9812b46aaa2535f26907820655d781cf9fc31ef19f5bc5a794d3b4caddae9667", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778287705, "uuid": "c64fdef2-c7b6-4331-9f3f-304d44f7bcab", "comment": "Malware payload", "value": "5a20ec6b0bf0302664b6abe84b5cbbdd5e23a50f", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778287705, "uuid": "e2d039d6-dcc6-4b0d-8399-3be23ec46e16", "comment": "Malware payload", "value": "d471ae6b6e625565ef46846fc3c5b37de59a82ca74c233f4ee9e84a7f8c54c83c62b1dc7063edfb26e95b8633273c4b2", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778287705, "uuid": "85308b59-2a33-4909-a9fa-2720c8755fc4", "value": "T1F3366B17686600F9C5E1E231C467A652EB65B889873827D36ED08EF02F367C16F39B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778287705, "uuid": "7441d396-8cd6-4827-b870-c8b576507b62", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778287705, "uuid": "2975d6bd-a19a-49d0-b35a-ff164c812498", "value": "49152:nuSpF1IiEgvZhTc47pNMm3FAG+uyJqGbXljt5xh4ibFwcXl9U:n1mPgvZGyNMQAG+uvGrljt5Ruh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778287705, "uuid": "4861f167-659d-4f83-8a54-79c16df25269", "value": 5014664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778287705, "uuid": "f1b70614-6a5f-49a3-952e-eeb1f0dd406f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778287705, "uuid": "3922f891-9e5d-447b-9a32-591cd3dcd204", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0464a1-4bad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778334576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334576, "uuid": "a4c34aa7-c660-41fa-a4ac-7f0bfdf2c282", "comment": "Malware payload", "value": "4240aadcf55e640bb604d9feb1a77086", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334576, "uuid": "d5e8545c-18de-4a82-b3d2-93073abc7e87", "comment": "Malware payload", "value": "98df649e45499277096af00182b7f966295f236b5c720686d19efedd8e436afa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334576, "uuid": "d432983b-21b5-4bdc-9ac6-a51c3f1a1542", "comment": "Malware payload", "value": "b91edf7fa5dbfce661ea6ecb225bc4f79be6d896", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334576, "uuid": "9d75768e-cd81-4f4a-8e72-0664627ab29d", "comment": "Malware payload", "value": "f29668fd5ce9e520066a11dd8021be99a07bf17f9b53fb4006999b01b06286639bfe4d25aa9e22f71b2a418acc1dbfa8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334576, "uuid": "04edffd7-4839-4828-9f2f-51a905d8ffeb", "value": "T144A66C6F72526064C47AC1B75D6CA15789397A361030C02FE3DCFE2F8735AE1AA57A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334576, "uuid": "c6b69189-b95b-4a42-9754-0c5d9c3d3aed", "value": "bfbff861d27f35a91d19a5a58e3fb3ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334576, "uuid": "ca8e3fc8-aaea-492a-a0fe-c1d187eff05a", "value": "98304:2MWj/8O/TsoNIsjR9hNNV3yi0YYdJIhN7gRc+tR0C11jCeYgn4hxmcEFO1QhY/2Y:2RnhTZnH4c+NI9xmlFOOhzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778334576, "uuid": "df779a0f-6f32-4430-82f7-6ab82dba74f5", "value": 9541720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778334576, "uuid": "b714c9f7-8643-4428-8331-50cc0231256c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334576, "uuid": "37d6a98e-1bd3-468d-bed8-f898d3afb602", "value": "libvlccore.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6027727-4b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778324180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324180, "uuid": "54545d79-fa27-44c1-bd6e-c0ac6f5a26bc", "comment": "Malware payload", "value": "892e998a16c7289c49e9d34a7a369258", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324180, "uuid": "c59f4563-0a8d-454f-9b0f-09166d1a3122", "comment": "Malware payload", "value": "9fa686fbd07f44862ae1c092c5a33049ed819347caeb8c7f251607dcb99b0788", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324180, "uuid": "a060ecd9-7ebb-453d-98b0-18d26629e220", "comment": "Malware payload", "value": "88fcc688526094d5f92eac921285c13459e1b6d0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324180, "uuid": "3be0cf2e-72ec-4abe-b9d3-3d8d36e392bd", "comment": "Malware payload", "value": "f6f45a2b18505bf00052f641922afc3a5b34227f19766d066029f0a81ccb00e853d5a3089fce6e239eba3f0db0ebf429", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324180, "uuid": "3e14cb66-9b96-4086-a1ee-a8cdbc17d4bb", "value": "T135926C0FB9554319D4C00434A1B2877FD6BA9876338054EFFBD88ACA1B682DAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324180, "uuid": "965e245d-e3a1-497e-b853-124662baccd8", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324180, "uuid": "aab1297d-131a-4856-ba25-cd5cdde765d7", "value": "384:4Ikj7VlvadxaizO5wxDSZvu98t2rFJ/Bwav8U9c7G:Max3qAUG9o5a0UmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778324180, "uuid": "209e5039-4882-4c2d-86cc-bf317124abb6", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778324180, "uuid": "0affed20-2df5-495b-8b2e-75db78398ed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324180, "uuid": "e153ca95-3b1d-4480-87f8-39a9b2a44788", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207880cd-4b94-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778323499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778323499, "uuid": "9fbfed35-c859-4cc3-b191-8120a7f96423", "comment": "Malware payload", "value": "d7f49c652d0d07620566529fb9f3a1d8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778323499, "uuid": "7413767e-8369-4110-bfed-5cfd77b6e1f5", "comment": "Malware payload", "value": "9fbfb430a2039c7a6ce28873fc31fc5cad2b341a83eb079c38a515c26c30b5e4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778323499, "uuid": "4450dc34-1d6a-4bec-9dfb-8dde48b76704", "comment": "Malware payload", "value": "47c65c83b1fb9977b735e3b1271eaa25d6daf98b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778323499, "uuid": "d35a2fa2-f7f5-4b62-a63a-5223436c7ceb", "comment": "Malware payload", "value": "e86cea3af161f9f4b57111897b430dc99e0d5fa25738c2cdf829107f8425e0b12bd1ef567b43acdb632b4de3c2a858bb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778323499, "uuid": "ebb9181a-9d7f-478d-89c3-77b59857dafa", "value": "T1C7137D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C55A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778323499, "uuid": "52f70e5a-ecec-435e-b62b-14b79fe8fc48", "value": "768:bEs9NyXsZztCF9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bxHusZHco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778323499, "uuid": "0897a54a-3a20-4f46-b576-41016b3836d3", "value": 45428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778323499, "uuid": "ead76b6d-1e89-429f-9cc9-c40c81405357", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778323499, "uuid": "e49720fa-e19c-495a-bc2d-6afa0acc650e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e0e747e-4bc6-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778345104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345104, "uuid": "14b7e5df-dcda-4c23-81ab-939d2a59c315", "comment": "Malware payload (NanoCore)", "value": "60999c5fcf5a909fd9d0917340396f56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345104, "uuid": "7ffee2b0-6dcf-464b-b98a-8418f2227347", "comment": "Malware payload (NanoCore)", "value": "a1ca02180a356786ddd54955faff2f5b0193321cde73014511058dea28ee28a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345104, "uuid": "754e4e59-9c8f-4398-baf1-01b2a9b8da18", "comment": "Malware payload (NanoCore)", "value": "baebdf403a604010177007a2c434864a45be78bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345104, "uuid": "71c1db77-ba60-4fac-8b64-f87eb071f8d0", "comment": "Malware payload (NanoCore)", "value": "fc80a2d7651652ae4adf3a68bfbf4e35f49a19596f64622d2afa2a31fdc81d44805f0b17cee8fbb712fd026483736776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345104, "uuid": "1bfdd036-9ab8-47c9-af00-f61722777d98", "value": "T1D514CF6537E4492EE3DE8678701242028379C2E3A8D3F3EA28D461B79F667E44A471D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345104, "uuid": "e994b1dc-43f2-4d48-afc4-b758f6f21db4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345104, "uuid": "a1a8583d-15f0-474c-a1f5-8a40e22f302b", "value": "6144:MLV6Bta6dtJmakIM5l6fA+eXcTTacsRy3Cj+T:MLV6BtpmkwuA+eXsaDCUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778345104, "uuid": "a81a00e0-48c0-4ab9-b0e7-3bea473c6858", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778345104, "uuid": "d6fb4129-4fda-42a6-bd5f-3ebdd7b2c7bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345104, "uuid": "d5b30768-bf94-4ec4-b5d3-a5aeb7ea7fb8", "value": "ggliaw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e54c42-4bb1-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1778336021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336021, "uuid": "aabd1da1-8a2d-4359-b0d3-6863b12b7a53", "comment": "Malware payload (Efimer)", "value": "d30e771fe5344b0487f0a0f83bb6d5c5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336021, "uuid": "5ffda704-feea-4660-9f00-2899bddfe239", "comment": "Malware payload (Efimer)", "value": "a20b3f76492a10e04a16ef30327d4cc75b602c6d98b0ffe6b1ff318517a1214a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336021, "uuid": "6ed4b68f-4fcf-433b-b77d-a95bfbede361", "comment": "Malware payload (Efimer)", "value": "7e107d524975a1717ee57c388b1b2800db8df65f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336021, "uuid": "4d6ee707-e58a-493b-9d49-0c313d8fe93d", "comment": "Malware payload (Efimer)", "value": "816ed70bb0c75b0275a0c850e024461269dec985a9d9d2ab2cd0668f1a30f92b44ea47804fdf4fa7120ae7321c77cc4b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336021, "uuid": "55caa2a5-dcf4-4b58-ac2d-67a0656ca686", "value": "T1AED6330DA1C1A1FDDFF7D2707FE213B568293CA056398C6E946CC7B2AC6B062950A45F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336021, "uuid": "28441800-ecae-4e3c-a494-9c5f5ae74871", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336021, "uuid": "f45d7512-e74c-4186-a662-806d64ca42c8", "value": "393216:ZkdMbTY6Rm6kzz1tXMCHWUjX0cuI3/PGTAI:ZMMBRyf1tXMb8XhH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778336021, "uuid": "078295b0-f404-4155-bd04-48ca0ffe2ad5", "value": 13865964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778336021, "uuid": "52c4dece-0427-42aa-a182-e0ab27ed232b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336021, "uuid": "7bb27098-6f37-42ae-89ad-b6c3319445e1", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c088d4-4bc5-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778344505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778344505, "uuid": "44617a43-6c83-43f2-9535-d801fd826060", "comment": "Malware payload (NanoCore)", "value": "adf482c15b8d845b96fd7a5a4c8f5fb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778344505, "uuid": "f9911fdc-2ee6-4b0c-94e9-32dd56f925e6", "comment": "Malware payload (NanoCore)", "value": "a2900dc080580e42d966628820b43de46f74397d89187b3072a2d8f9a0c93ba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778344505, "uuid": "0186c7f7-ebfc-4d01-82bc-df548173e73f", "comment": "Malware payload (NanoCore)", "value": "1a3592829d05facfe24faaa0a3fe1767a953c2c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778344505, "uuid": "ff7deb08-3174-4146-a4d2-e0024f4ca7f9", "comment": "Malware payload (NanoCore)", "value": "30134e6bfa203bc7df39c46e843cc399282f638b177a8e07e18b3305711a800c1318a1362e11650233b42b65ec0746e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778344505, "uuid": "5e704f19-7e47-4e2b-b114-4840765fa512", "value": "T18114CF6637A88A3FD2DE8679611202539379C2E399C3F3DE28D455B74B227E10B171D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778344505, "uuid": "104e6301-56d8-46c8-930d-8fd421d30ce9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778344505, "uuid": "8e0ab932-9899-476c-b016-961a9f00d3d4", "value": "6144:sLV6Bta6dtJmakIM5VNLiVdjyTMyIdWu6:sLV6BtpmkskjyIfMu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778344505, "uuid": "a4628823-b443-47e6-bfba-613a41527091", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778344505, "uuid": "692b5889-b6d3-423a-bd28-da26ed3a46e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778344505, "uuid": "e411a585-4d6a-4b9c-96ef-ebca1efc684d", "value": "1u888com.comnano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7251fff-4bb1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778336288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336288, "uuid": "0a9f5bf2-172b-4ea3-bb7d-f88f1c8c2576", "comment": "Malware payload", "value": "5dd93db455d445eced852a701616ba32", "object_relation": "md5", "Tag": [ { "name": "95-85-236-201", "colour": "#4BB16B", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336288, "uuid": "fdd6f408-2dbc-48d9-8840-f7d5a5bf01ce", "comment": "Malware payload", "value": "a3e7f07132a6b1b754dae11898ac19acc9cb307659fe4288d027512fd6a13388", "object_relation": "sha256", "Tag": [ { "name": "95-85-236-201", "colour": "#4BB16B", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336288, "uuid": "3633ce98-f1f4-43b0-abed-0ab6d4c62c2f", "comment": "Malware payload", "value": "0fb3e8c930c2e33ea89a28eaf98d99e3d47f1a8e", "object_relation": "sha1", "Tag": [ { "name": "95-85-236-201", "colour": "#4BB16B", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336288, "uuid": "fe3db250-f2ea-43e7-acfe-bd90fa890659", "comment": "Malware payload", "value": "e4dba42f33fa09eb1344c29e4bc18663433e22ac35a4f634ab65a918225ce02efd769f39db2e390d9cddb209b63cd08a", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-236-201", "colour": "#4BB16B", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336288, "uuid": "ddc1b0fd-e356-4d84-8787-76a7a55eea41", "value": "T189B6390BB97A24E8CADDC976C8E7682677247C8C833931430B996D30DF367C95A79358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336288, "uuid": "3115c75c-a791-41fb-8853-aedf97b4e1d1", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336288, "uuid": "1913dd1e-c09b-4a52-8d6b-e491c58df0bc", "value": "24576:NMbnlzH0hlJWNqxWYkQ/YDtU6JVm27TIJs9BQSltPnLjsebXYIlQ8vAM:NMblzH0hlJWPYkL17TIJqLPseDln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778336288, "uuid": "71650c03-c11c-4044-a318-cfd0f5efba66", "value": 10964616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778336288, "uuid": "79698e70-7854-412f-8dfd-cdcbaa3e5857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336288, "uuid": "af65a539-93c0-4365-a5e0-c7f85202ebc3", "value": "ww26A1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c38d27-4ba0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778328712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328712, "uuid": "0e3c1480-37b2-4068-9e1c-eb298f529206", "comment": "Malware payload (Mirai)", "value": "63aeea16f569c850c6f85347e42584e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328712, "uuid": "1c776021-bcfa-4696-8612-ac6f8f616674", "comment": "Malware payload (Mirai)", "value": "a49b591ae6edc150c43ffb91f8ec1f7cd2ee2cd7ea9be3f43ba16a71995c16ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328712, "uuid": "bc548793-c694-4620-9fe4-0fb646b360e7", "comment": "Malware payload (Mirai)", "value": "0c589adc1eca07ce8424bf415874eeae17fa5a9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328712, "uuid": "e17453fd-0538-4899-9633-d5d87506cd7d", "comment": "Malware payload (Mirai)", "value": "4ff4bce9dadde6b5a16ee9c741660d2389c18dadc5298240397783b39e08df17aa6894dea177e945b46e40a31270e665", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328712, "uuid": "fb6d6429-7c75-4bbe-9f2a-5614704b418a", "value": "T18503E157E08C523FE025D27618FEA9794861525E8858CFA37DD6285A8936820377CBF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328712, "uuid": "f63ae80e-7901-498a-90f8-c9014268c3dd", "value": "768:VV1FCagjC9vRdVOGawJFgxwciZeTMXXoMnmnnbcuyD7UEQRj9:VVeagjCJ1O6nciZ+Munouy8EyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778328712, "uuid": "eb74ae85-3363-4385-b755-b6be18b0cc8b", "value": 37896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778328712, "uuid": "c399c42e-f0c7-43aa-9d7e-7b26531136b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328712, "uuid": "ef288ec3-2a16-4bef-9448-527561afc755", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6658816-4bad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778334542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334542, "uuid": "cb1b0d2d-f08e-42bb-bf9d-01a3d4b758f2", "comment": "Malware payload", "value": "cd2ddf3d431f8ffd7144cfe7c2db2ae8", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334542, "uuid": "b8ca178d-78c1-4436-9a23-d85cb8b43cf1", "comment": "Malware payload", "value": "a6f872e22963edd9b4fb5833216b115abe3a57f5d646a8f675f98e1b8ac19669", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334542, "uuid": "4636c2e7-2660-4e90-be6a-b8b8090bfb90", "comment": "Malware payload", "value": "6a9629e0d7d5f4b9a81f6f805571caaddcbbc1ff", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334542, "uuid": "803fa0ea-fbcf-400b-ae67-3c0877dab87b", "comment": "Malware payload", "value": "e1ff404663d90749d41595dcc8bac8f6779ecdd371bb0a78336ccf3364b6173b1165205074592ec587576c2929423ff4", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334542, "uuid": "a0974d1f-cee7-4854-ab49-0e188cb0b2fe", "value": "T103873335D4FDE5D7D3F846FBB27524A31762A3B1895239037BEC8264E9C2A013622B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334542, "uuid": "bc7040df-0367-454a-a93e-254af1425c79", "value": "786432:VheiJla9caeLNVQqiJG0tarR6zCZFsdo9h0EsQo3:V49caSVQltS6mZSa9hWJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778334542, "uuid": "a11e4a45-3f87-48a3-801a-d2045615a05f", "value": 39574860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778334542, "uuid": "dc459a8e-ef89-477f-a0ca-f57f2e4dd713", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334542, "uuid": "49a93271-dcf9-41ee-aa05-bf7f9291989d", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacdeaa8-4bfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778368050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368050, "uuid": "41df7638-50d5-4c26-b2d5-7ce91e103925", "comment": "Malware payload", "value": "224b2fd7907b69744862e7ee66bb0a28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368050, "uuid": "2db79774-3f5b-4751-a48d-3c1dd2f00142", "comment": "Malware payload", "value": "a702b00fad953e4dbbf7ac7585811cd2f05934eccad798d731399e0024898f52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368050, "uuid": "6fe0b495-03c1-4f45-8615-00ecd4ca90b1", "comment": "Malware payload", "value": "9033fa14233169d5edeb034b41d1fac01e772692", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368050, "uuid": "9f29cbdd-aa3f-48b9-8a3c-2320f768c3fd", "comment": "Malware payload", "value": "da7029cc3bd31fa1b94899555ac8c1bbfb4be13bdd0a3f78824175c230abe5167ce8040672ed35c315927482192da22f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368050, "uuid": "49a03ee7-ae7d-4304-8ce4-44e394cfd9fc", "value": "T1AA762957B8A24982C4E43A77B8BE81C433631EB98B9716575D05FD383EBE1DA0E39344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368050, "uuid": "ae3a7724-4c42-4e61-bdda-ca645e725335", "value": "49152:KfZ7q8qJoUtcnpFD1ITvvcvgmvg53w047m1g894Wl/A5Eu:U7cJN+n/5Ib0vvvWJi8SWlKEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368050, "uuid": "06fa339a-3abf-496f-b75d-54ffe9226520", "value": 7471266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368050, "uuid": "9faa4e7a-17b6-4974-a505-55df2a51e403", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368050, "uuid": "2ca45e21-9834-4035-9b0e-a2fb4f69831e", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ccb819-4bfd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778368892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368892, "uuid": "710c88f0-3da4-4e47-8b7d-45eb86016603", "comment": "Malware payload (Mirai)", "value": "93aeb82a0c809e5fd2b4984b7f273368", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368892, "uuid": "7fa8b5a7-982c-427d-9a0b-543fd845a642", "comment": "Malware payload (Mirai)", "value": "a728ec777c4443d8f517fde61fcd6b8402997d85f1c076c9d3fc5ba71975f41b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368892, "uuid": "1773d25f-3f1c-40de-802d-6c621d56186c", "comment": "Malware payload (Mirai)", "value": "3e2b4620ae8a9a8e07e3a75520e10ccc063af767", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368892, "uuid": "2f88702d-5974-4f94-8177-410aa83e053f", "comment": "Malware payload (Mirai)", "value": "d264740805f7ac0ad168b10f2214bdd859be8966602ee22003443081f2cb88f5554826819be639f510e308faee9cca68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368892, "uuid": "b6120eb5-aa57-4ec2-bc61-e8342241f45f", "value": "T1E5363B17EC9586E8C0EAE23089629253BE717C495B3023D72F50F7392F72BD4AA79744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368892, "uuid": "dae55aa3-e719-430d-a841-75e04a54272c", "value": "49152:PD3PCIClAuQ8L12I7GbraWe5EBbSbZYZo8UxYh5a64O:mIClZQ7I7QaEY2hUZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368892, "uuid": "16669292-1820-41b0-b0da-eeb37bbf0fc3", "value": 4882432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368892, "uuid": "4e768820-ef84-4659-8686-49fff803d7cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368892, "uuid": "81342902-f056-4a09-a185-803ab869a8cb", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f8fab4-4b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778324203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324203, "uuid": "ddca8c81-4e57-4ddf-952f-617c2f095925", "comment": "Malware payload", "value": "94e48afa545d7d158ee2cbda2d2f215b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324203, "uuid": "9ab30086-81c0-43f0-9985-f5b6c669caae", "comment": "Malware payload", "value": "a8614ec9bc320861343c65a70595defe3d5b5b180eb91e7d9f38dd1c0cdd9e1f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324203, "uuid": "f54d3ef9-0177-4732-a01d-a34dfb5aca70", "comment": "Malware payload", "value": "6117ae549558cd77e4aa04c484a313fd3632c6da", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324203, "uuid": "f2db46fd-0ea7-4e69-bcd7-70a9073bc049", "comment": "Malware payload", "value": "dcd4881ddcf2380459197c6209fd8d0a1cb1d4cf1c79941e714ec423d18590156f37482b20a195ad1a172c9e5cb3325e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324203, "uuid": "7bc88b18-de21-4f94-8c4a-3cf43f09c5fa", "value": "T189926C0FB9518315D5C00474A5B2873FD6BA9476338454EFFBD88ACA1B682EAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324203, "uuid": "c6f126e0-3030-42fb-9fbe-aaa55931b8bf", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324203, "uuid": "00fd9d08-f8d3-464f-ad2b-09918755ada3", "value": "384:yIkjLVlvadxqSDO5wZT0vu98t2rFJ/Bgav8U9ciG:Sqx3640G9oJa0ULG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778324203, "uuid": "9a88545f-f606-43ca-9442-24ee7379757e", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778324203, "uuid": "6a147f05-1218-4214-8806-adab6fee4b77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324203, "uuid": "cb811d43-bbd3-4a9a-8781-d91aaf320d5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3e8569-4b9e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778328111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328111, "uuid": "1b403b41-9feb-4106-8638-a119ae1c2999", "comment": "Malware payload (Mirai)", "value": "117f633f487476aa19b2e5569e7d74fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328111, "uuid": "2a62879a-7bf8-4c35-86c7-80394a9c69e8", "comment": "Malware payload (Mirai)", "value": "a8c968f793844a02d328228ec796119210f261f8ff9c0cc71534e4cba040405b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328111, "uuid": "0be82290-7e4e-41d3-98f3-db0a4816e57c", "comment": "Malware payload (Mirai)", "value": "2e7598210ce2cdc28755d7d7313be9463530c089", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328111, "uuid": "60da400e-c906-4e27-8b16-c22e93eb5a04", "comment": "Malware payload (Mirai)", "value": "86044d0606ff75f3f3826928af8445f0c24b167b610b621e0ce1338e129066ede55283ab564ff016f9622e2f94e00f92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328111, "uuid": "30c3aded-8352-42d3-8d18-ea3cfe0dcd5e", "value": "T179E32B46F8815F16D1C112BAFE1D024E37231BB8E2DE72129D246F747B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328111, "uuid": "fe2b67e8-fe49-4b2e-9552-c8b94c5b79e8", "value": "3072:gUT0WidfrcP9dX80aG2jt7PWoDnhegrIjVR:xT0WidfrczXxaGIt7jegrIjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778328111, "uuid": "c96d778b-d517-4311-9931-4bfdffbea589", "value": 155292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778328111, "uuid": "472a1926-3311-48f1-953c-06c86fc5ab96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328111, "uuid": "97fdfae3-fd24-4e2c-80e0-38636ff649e9", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dedc904-4bae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778334769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334769, "uuid": "f1f52487-9f2f-4612-81aa-28555fea8b24", "comment": "Malware payload", "value": "b92d8cf46f2cefcada2f5e251c08287d", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334769, "uuid": "dc4113ef-b1bd-4f01-8d19-e1031134500d", "comment": "Malware payload", "value": "a8ca176c75dead887d6150013ed64d40808e71ebbd4dc179bb74ad88e7e1f0b2", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334769, "uuid": "9f8263ac-9ca5-4dd4-b5eb-d06d7c4a9c23", "comment": "Malware payload", "value": "7be19d89ed923d66b02d55aca8fa118f3886a270", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334769, "uuid": "7fdcb3d1-dce3-4374-8eda-3e57bd6e9683", "comment": "Malware payload", "value": "741208fc8c9841a012278bec9afbfc55d7b6222180b2f12ce6fe8962e5769b0409428c02341ec5c137082de6b04b2cae", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334769, "uuid": "8b6857ec-9271-44c8-b560-19886592b64c", "value": "T1E9E4D016EBA510F5E177C13CFA964906E7723C560B526ACF23940E8A1F2BAD84F3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334769, "uuid": "3ddccfd0-a691-4f1e-a372-2c2d449ea296", "value": "4bfc91f3e74bbb889bcf3811fa31cc44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334769, "uuid": "3f234884-254f-46b5-b19a-fec2ae8bb757", "value": "12288:thQeRT1Z2rCgZKzQsVcFVOouefKjqD+Sqt4DnlXlu6SjQT:jjR5N6KzQsVzfeyjqDEt4DnlXl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778334769, "uuid": "e5e5825e-03f5-4cce-9bda-dd47a2ff1f71", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778334769, "uuid": "7397cf39-093a-4582-8422-87ceb8689742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334769, "uuid": "a3b7e1f4-1b1b-415e-beb5-5a4be23aff72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717525b4-4bd4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778351123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351123, "uuid": "3c2c0d26-c77d-42ec-968c-0db6eaab508f", "comment": "Malware payload", "value": "4c3c3f861eb799a5c3dc972bd8862698", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351123, "uuid": "12670ddb-0225-47f3-bf4c-4ea38c02d504", "comment": "Malware payload", "value": "a8cec33ba9569c07b5552a511db640c7bed95b4fc0ae91e89b63751e40dba459", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351123, "uuid": "ca44fe44-33a2-4f4a-b8ca-e9b5994bcffd", "comment": "Malware payload", "value": "62b37453052fe5b75fc07599252ba40578d50eff", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351123, "uuid": "d8bff8a9-d0c5-4a82-97d4-8b33cc535124", "comment": "Malware payload", "value": "063fee126ecefa3ab36234e33224b80d4479523f5113b8823029ac363ccf1241b8b95b85e1447ed7b9df7536ab5f1f89", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351123, "uuid": "21d67627-4efc-4548-b997-ec14b75c6287", "value": "T16FB4D7DDBE72C46AE25371324110817B783DC988A209FF3715B48C9A896CDD94B62FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351123, "uuid": "d266fdfa-0fdf-4a09-b854-bb679c3171a7", "value": "6144:BqKaV1XIKAahCPijztcNMbOYUwq3IM+ZrV5la7TZPTmPnK8IELq:X3Ym8OYUw+buV5laZahIELq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778351123, "uuid": "6f4c588f-9aea-4d35-b92c-99c7a5c8157a", "value": 533473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778351123, "uuid": "ed6fcb3a-a57e-4b7a-82e8-9d138751adac", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351123, "uuid": "a0e4f713-ca65-4622-89a2-6399883db28d", "value": "kryptonite-cracked.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c8d84e-4b9e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778327810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327810, "uuid": "9992ae8d-d557-40b9-ad92-3b64bf3b569e", "comment": "Malware payload (Mirai)", "value": "eae80021c74783aae08a74fea2b8cd22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327810, "uuid": "4c9fcd18-e491-4411-a210-874e6b96b00f", "comment": "Malware payload (Mirai)", "value": "a987663d7fd01f5ef5be75710cade31a3b4dc49e907bf24d521514113cef0647", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327810, "uuid": "7f191a0c-adbf-46ee-95d6-2881c9ba5e4a", "comment": "Malware payload (Mirai)", "value": "1cbab2c3d113008aa968a46ce2f97cd2647a2265", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778327810, "uuid": "dae3838b-17e7-44bf-9a1d-f46a627a54af", "comment": "Malware payload (Mirai)", "value": "dfa9b6e0671e17889031d2c60bb9aab9311e460bcf188a2ca2f5c61e1158e390a360f21b11f378e1ec5597059f24c89d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778327810, "uuid": "bcff187b-982e-4872-85f8-a937f77024fa", "value": "T109E37DD2B402EDAFFC0A96B6449B0209B4A4B7517A530225B2E77C4FAD3B0D16C5FF46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778327810, "uuid": "d9507e47-6aa8-4f0d-bbe7-73d59cfd532c", "value": "1536:vrQbw6/7o7XqfUkUrUqqT26Hx556E7ROo/8A3JoOde+kNwHRWtvDC9NctWyJ+6rf:R76lx55H7ROo9pkGHRiXtWyJ+/ya7Cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778327810, "uuid": "2357fafc-2590-4d73-8cc2-5d9d75c97354", "value": 148348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778327810, "uuid": "66e4c581-5e4c-4174-8120-0d6adc890927", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778327810, "uuid": "3ebe25c3-7fa6-4d3f-88f5-21a46c8508a6", "value": "debug.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da2e535-4bdc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778354472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354472, "uuid": "294a1324-c44c-4979-861a-1745fa07c4bd", "comment": "Malware payload (Mirai)", "value": "56ba80e34924675a0b104c9074c17200", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354472, "uuid": "85222a6a-2575-408f-8dbd-bbf05942cbf2", "comment": "Malware payload (Mirai)", "value": "a9e45abed5f3058902aeddbef23f94227cac3a59f85cd1e72f7979118ac001b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354472, "uuid": "32e92ec6-e5b1-4852-9879-f400cf313b8e", "comment": "Malware payload (Mirai)", "value": "2d340e4e19ed4cd806ca09cca195bc9a9819b0b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354472, "uuid": "7bd40874-1a58-47d2-af47-1167a9625b8e", "comment": "Malware payload (Mirai)", "value": "7de3e67d0e90bcb9555ad6097308906d4b4a2a921adb9d3505322fd1756ba4ab83f4b4fa331570d3834fb3311ceccf41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354472, "uuid": "d631904a-f681-4d30-9d4a-dcde49f64efb", "value": "T147E36C523AC180FDC549D1B81AEFA136D9A9F0BD2368764F37C0EE261C4DD604E79B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354472, "uuid": "183cda8a-f3ff-4d12-ba9e-59cc2341ccb6", "value": "1536:+DQ7y+RLBIc6Qw/vvtIXOeRzZ6QJYFjq4/uXKkrQJ86Ydh4uIM2aqF33/3fJGelT:g+lB/GmnR4WoJ8Nh4uUaqFvf7lwR3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778354472, "uuid": "6af79db7-ffd9-493d-9508-2f38e00675cf", "value": 146456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778354472, "uuid": "3a0290f8-08af-45f4-a70d-d852298b8f2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354472, "uuid": "180aebac-27ba-41c8-8cbf-1f1c64381e71", "value": "debug.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacec1b2-4bd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778350414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350414, "uuid": "263ae1e4-1a8f-4f83-a4f1-0b7cf30a918f", "comment": "Malware payload (Mirai)", "value": "61e5fabad3d096f747e34ff12cab5643", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350414, "uuid": "75a002e5-450d-4c2d-b34e-c1d91a29ad43", "comment": "Malware payload (Mirai)", "value": "ab6b7580f784b24c74cd2e90be618aeb08cc69dc79bd1c1c53c2f6b79d3441b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350414, "uuid": "94b0e41e-b2fe-49e3-99a4-f48203bff706", "comment": "Malware payload (Mirai)", "value": "6266c4c00dc629b9260984558f7bf2aa9f39772e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350414, "uuid": "a17521eb-51fb-4355-a0c7-fc17e63ddd73", "comment": "Malware payload (Mirai)", "value": "d40f0e61e85017efb7b892ca641dd5301e502d8abe9665b7880f220bf1faef72f2aa630d180cf160066547b7a6ad60a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350414, "uuid": "0452e5dd-7011-42d4-a0ab-03e94839e182", "value": "T11DA30846BD428B03C6D225F6FB5F064C3B1657B9D6EB3242ED25AFA0274B4970E3B250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350414, "uuid": "7d7eab22-509b-4cad-8b52-60c1e89358f6", "value": "1536:nZU4J8cg8BkA7jFn88gkolp104AUwEFBeoRwMtYEGZ1rxX29XABifb23HbE95zRr:n+0F6qD1hDXbE9pdcj97pvekIK+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778350414, "uuid": "2522f891-a63d-4de2-a215-0eae476db090", "value": 98872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778350414, "uuid": "e56fd86d-75a1-4f8b-b66a-4771eb44083e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350414, "uuid": "170f3eda-ce7c-4310-8f96-ae6df2bae295", "value": "zyre.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8a1358-4bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778341939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778341939, "uuid": "d97e4229-baaf-44cd-85cf-c68e3968829c", "comment": "Malware payload (Mirai)", "value": "15a8a3f25df3d314e3b0ade2168989fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778341939, "uuid": "c2bd52e4-15b8-4a08-9b7e-cafdf6e05d74", "comment": "Malware payload (Mirai)", "value": "ac9187a61de085de5fdcdfe85dba8612ead2ea8a50c2e64f3efb4acdf8008199", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778341939, "uuid": "6c6a01e2-d340-4d8f-ba4e-26434288d7df", "comment": "Malware payload (Mirai)", "value": "a49c7f86ed42539d1cf7255e8f4ddd512b9713c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778341939, "uuid": "1313433c-8b7c-4a73-bc1a-aef9c671e9cc", "comment": "Malware payload (Mirai)", "value": "f79438d677cc6bcebce04ad5b297832e01611794da8c7d147175af0913dc97bd048b3fd47e2ffc5c1864970b8d42bafa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778341939, "uuid": "d855584d-f6d4-4aa7-a83f-00ce81706bbf", "value": "T157419FCBB2A424F3C405DD41F37424E4E1DDABC261F69EF8F5B98562185E20CF5B6AA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778341939, "uuid": "8ed54ae1-91e5-4d42-99b1-17fba6eff8ca", "value": "48:QPeJdUciTKBE2KPXIKPf2vI2vjKaqHWalr:QPebUcPBEH2KaqHWalr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778341939, "uuid": "0ca345e2-96cb-4e57-a82c-45318891faac", "value": 1924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778341939, "uuid": "cd86a1aa-364e-43be-9a91-00f3eb25fa85", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778341939, "uuid": "e8b623fe-1557-4252-bfa5-62e1ae945645", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e05cc3-4bb1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1778335908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778335908, "uuid": "cd8b7964-d474-4eb4-b823-afc20e972be6", "comment": "Malware payload (RemusStealer)", "value": "42f67eaf54cec25920ce4a4489d0d0b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778335908, "uuid": "9243cd34-9f99-48dd-ba94-cc4b08e40780", "comment": "Malware payload (RemusStealer)", "value": "addbbade404322f4beab57544058c5c24fef469c1fb2ab8c42477620ec8b6fb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778335908, "uuid": "dd8d0645-8ac7-46f4-9f44-be56708a2833", "comment": "Malware payload (RemusStealer)", "value": "82283c4c0b6a4c293db8b7574bb5ee81ad13c312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778335908, "uuid": "de93f5f4-57a7-43d1-85ab-bd1aae4bf607", "comment": "Malware payload (RemusStealer)", "value": "4b2499a823bf649e42a01c026c6922181b74449c24cfbc792396e3d312c96e77f7ac9827f548e15ef37da017b45f46ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "woodfez-biz", "colour": "#17D095", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778335908, "uuid": "626acbef-cefc-430a-80c0-9e716c6c30c3", "value": "T15B963913A99645A9D0A5E336C4ABD692AB19BC49C33477C32EE19EF06F307C11F39709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778335908, "uuid": "a8648797-9acf-40e3-9dac-57b458f9e22e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778335908, "uuid": "8305d11e-3974-4a4b-9ddf-819ed8cfb79a", "value": "24576:U0zskmZD9CguLNjr/5TGHEuGTmvAq4+w7qenx73MTpN4d52C90TWvj3vg4nheleH:U0AkMDtuLNhGHc6vAztXRcTpsgW73pG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778335908, "uuid": "436174d5-a33f-4f57-9bb8-657b78173239", "value": 9042056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778335908, "uuid": "036df35b-05d4-4071-b0b2-3c646832750e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778335908, "uuid": "ec0f7329-8af9-4b48-9e7f-53d2741514c1", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e381186a-4bd6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778352173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352173, "uuid": "27f32a08-5792-47d3-b3ed-7527f8fca5e5", "comment": "Malware payload", "value": "4cb9ab499d6632d1e34cc87424eee40b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352173, "uuid": "d6279966-eb26-4c90-be08-958ec80bcbf4", "comment": "Malware payload", "value": "ae409f3d835b583fd60657a894398589d3f712dcb72c85d8057fc81571d73cec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352173, "uuid": "d7a491c2-0924-4920-83b5-4cacb2f14398", "comment": "Malware payload", "value": "7d1946dbc0e6c7ea6b9237c8e90f1b0bf08afc8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352173, "uuid": "b15b041c-8ae4-422b-89a4-6339d1ae596d", "comment": "Malware payload", "value": "a7100fd7444b15ac1050404e1c52d3959326c67759a86b7fc294a0d70da4cc6e0ab844ba4be9117e2a47e364af0d2fa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352173, "uuid": "a3ebe194-844b-4717-acbd-7ee6b8985e7b", "value": "T108A7330AC3D00E9BF9DBE179DA63EC119BF3916B6BA791C66BB5445508070D0933FA2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352173, "uuid": "df872f4b-955e-47e7-9381-ddcb2a7c1783", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352173, "uuid": "afe18b51-78ad-4984-880b-a67e35910b9e", "value": "786432:t1JJzbWlA68XXCMDQ1hC1J0Ev98RlUOZDs795A/+6ppIRh7GoRaVV6XUgtAiXQPb:37zbWm6IXh01h2hvvOMPqppSGCBtlXQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778352173, "uuid": "832252f7-164a-4e1e-b4ec-84567ff204bd", "value": 46411862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778352173, "uuid": "5c104678-8896-46d9-ba65-56b01861a5a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352173, "uuid": "3b542fc0-d814-473d-938f-ccdeede33c50", "value": "sigma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd9c48d-4ba4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778330635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330635, "uuid": "39515777-c189-40e4-a216-e04ae8c4d16d", "comment": "Malware payload (Mirai)", "value": "401f0c2eaadb60bb2731d1f7e293eb0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330635, "uuid": "fcfab9d8-7155-4fc9-a4f2-0723d061bc54", "comment": "Malware payload (Mirai)", "value": "aef2e7ac270dac01d09a8d40c55ef79b41c9d3938a66a31de022a910ae784360", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330635, "uuid": "86e4c27e-9b5a-483c-8fbc-11d608d79b29", "comment": "Malware payload (Mirai)", "value": "519bd651d9c2c4d04ad501de03caaab46cafcd68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330635, "uuid": "9d612d2a-f022-4cc9-ae01-8788e4d67fc7", "comment": "Malware payload (Mirai)", "value": "247708def3c096b391d62f73a7b7b33408a2715fc1e994956fd83bbc0ba06ba878b5bd7971f52408cce528c5842d62a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330635, "uuid": "35a817a6-c9f9-45dc-84e9-1cad81417a1c", "value": "T12ED33A9AFD529E01C5C616BBBA6E128C372917B4D3DE3103DD110F68778682B0F3BA95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330635, "uuid": "87ae20d3-6637-4531-bc2d-70ff2d0233d3", "value": "3072:jCPXffbhXgjI2FeGY4NZN9LRVkFfjKYFuyBBi:jCPvfbhwUaY4DDRVkFWYFuyBBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778330635, "uuid": "9d98c191-1757-4ea6-9342-21b9cbee7621", "value": 138012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778330635, "uuid": "a4ae0696-401e-4ce6-b48f-ca06b108d16c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330635, "uuid": "901bf17f-5883-4a4f-b174-cf29190c8b9b", "value": "debug.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625c7eb0-4b9f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778328334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328334, "uuid": "9935537f-509a-4222-b185-4e9ccef58c7f", "comment": "Malware payload", "value": "13850fcaf3507d4c2d5f43467df0d1fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328334, "uuid": "5081a0e8-4688-43f0-ae02-019a5204313a", "comment": "Malware payload", "value": "aff759e88888584e76b99cf4129129b4cac029d56fbbbf695fea316ca47c58a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328334, "uuid": "288a6285-8bde-4559-9645-4c5a701a5f9e", "comment": "Malware payload", "value": "a2057178bacfaea758b63a7864ed66e6e28435e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328334, "uuid": "1a8ee352-d0bf-43c7-910e-ea7602e4d258", "comment": "Malware payload", "value": "0f2046f357634d0dc8954ff7505e96523444491f738cfdc5ac0561ca86fc12713166c0cb7e3a7adcbf0569f3fbee8d50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328334, "uuid": "b93238ca-ae2c-4f26-9faf-5255ed6d4e15", "value": "T160A47C55BA9699FCE02BC074824699237976784A0721BEEF039846353F56FF22F3DB04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328334, "uuid": "75fa8754-b7fe-473d-be60-03fed15c159e", "value": "554fc93516de17365fbf2bbdc657575f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328334, "uuid": "edd05ad8-e4dd-4289-9586-13f3e2990cdc", "value": "6144:TxITghRom7tv5cuYVJhpc2A0Pobo3DugcdTswXdqRoDUrgdqgCOtgTg:Tx7U5F8dwiTsUDUU4gCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778328334, "uuid": "0e8b36da-277f-422a-8f5d-4e4545f94f6b", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778328334, "uuid": "f9bff29f-655e-428a-b63b-04d0bd5def5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328334, "uuid": "3bbca073-4316-4ab3-9893-ef46fdc0a5de", "value": "2026.04.15-----\u6700\u65b0\u540d\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe7f323-4bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778368052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368052, "uuid": "06363287-a98b-4c5b-a6f9-e60625cba509", "comment": "Malware payload (Mirai)", "value": "8a7966ffe4d37dcf970173d21d6ecae2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368052, "uuid": "4a5d3ea4-df7d-46ec-8f7f-ec5dcf2c26cf", "comment": "Malware payload (Mirai)", "value": "b1f767660a8e5ba8cb953e9dc33bc4321ee86f0e0b9c5373b32cf1e6947ad347", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368052, "uuid": "438926b7-faae-4ede-be3d-1f405e8ea42e", "comment": "Malware payload (Mirai)", "value": "5845e21c394c6eb9e5c875c23bd61bec68cea9da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368052, "uuid": "b44c8809-c6a1-4b30-b590-b749ef09298c", "comment": "Malware payload (Mirai)", "value": "320cba558dd205e7c6cd25cfdcfa4280e6e9ccb1d808e93e6d989cb44042540e2995f272b71d44b1063a303ac9a1fd6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368052, "uuid": "b680ebb8-4f7a-4ca2-85c5-d56f6e05de12", "value": "T1A7763912FACB00F6E5031D3154BBA27F6B310D0A4B24DBD7EB447B29F93B6921936259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368052, "uuid": "61f5ac70-ce05-4000-8652-87b424ba5aa7", "value": "98304:08995kI5F4kzf7nzUmf+Rqiz7Bdwy557Ql11R0LiQEH:0wkAFZfpiqiz7NipH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368052, "uuid": "aba55c42-4ac0-4b81-a38b-d6fe93cc77fe", "value": 7454882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368052, "uuid": "daedc2f1-3394-4239-b45b-9fe863d5891e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368052, "uuid": "0cdf2986-34d0-4152-ac50-a1955e57150d", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98de173c-4bf0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778363215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778363215, "uuid": "939fc912-128a-4234-bbd0-a44071adb781", "comment": "Malware payload", "value": "b87899bbc5ea189d9f63d1c08337af34", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778363215, "uuid": "82acfeb1-7f2e-4f83-a8e6-b8c71a29c100", "comment": "Malware payload", "value": "b29a4f63841d2a91db750c586ad54a50bdf455e2604c5b163952be906ec54264", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778363215, "uuid": "0a180eed-29c7-48e4-a5b3-cc88ddbc2ec9", "comment": "Malware payload", "value": "4545708064b3557c97776965f23abaca097a7822", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778363215, "uuid": "a19ab87b-de60-4b85-b36f-543e30da69b8", "comment": "Malware payload", "value": "d662ab7101b862d957a1035fa97286ee68eef6997fd5f17fc770bac81e2d38b916ee595b728b1019a095eed46ab397ca", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778363215, "uuid": "5d574a22-ba14-435b-ad8a-a39504d5b0de", "value": "T109D57C03E69184BDD25DC274834BD672BA32BC8E0620B26F57E47A313E76B915B1E70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778363215, "uuid": "8c2d5c00-b130-445b-a165-bc63741cc545", "value": "89c24cef24082ab67cc9b3064c19ca20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778363215, "uuid": "c4820f62-6c8c-432b-9a65-56e11f4b40c8", "value": "49152:nU2h//SzbGWi9/uznckKgh7+6zqqrqzPHs4pxk653CN2xBGfl9ERsKx1SIU6iG:UuiGHyPbqs4pxkeZuwRfN+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778363215, "uuid": "c05f1eda-64c6-47a8-97c1-34782a486613", "value": 2911072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778363215, "uuid": "da497a73-98d3-4827-b610-f724f68112dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778363215, "uuid": "8f4e72f7-010d-463a-8546-840b5651a92a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b144b7-4bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778333417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333417, "uuid": "20c72905-1ad8-44e5-89ee-2bfaa7cff482", "comment": "Malware payload (Mirai)", "value": "eb32b728646a800b20a1096d817ff243", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333417, "uuid": "7c16c562-ee3c-483b-a618-f9296b902088", "comment": "Malware payload (Mirai)", "value": "b3791f906405d4fb859e423430e9ea74c9b672180bf2bfef339a0a01d3424eb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333417, "uuid": "897409e2-5481-4d71-92e7-102b57f47c45", "comment": "Malware payload (Mirai)", "value": "8690f6f6c27cfb0c17a1708b2372c50aa8ba5a72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333417, "uuid": "aba122d5-b42c-4bcd-bee2-74e006ee0f94", "comment": "Malware payload (Mirai)", "value": "514d19e4d2b1d1776fbaeabea719d7ff87715cc255bc391d0610ee41982865097d157b42d67f6a413ea621a3e3e913bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333417, "uuid": "47463c32-95c4-4bb1-ac07-c96e1c407f5e", "value": "T16C147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333417, "uuid": "51287434-c34e-4932-b94e-67f616ddbf61", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCR9UKG:IcY5JpMByVs9jSwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778333417, "uuid": "fcea29dc-f294-4d29-a6d7-47e5e84e2178", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778333417, "uuid": "b02e6fab-7433-4315-9c8f-0617b9a4d220", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333417, "uuid": "a7509bac-8337-42af-9b37-b98cb8a755a7", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236d74c6-4b68-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778304606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778304606, "uuid": "22ad1bc2-7fd1-4f3c-8409-c8bed4b993ac", "comment": "Malware payload (NanoCore)", "value": "4dfce0d9e93ea6fe4556132e1354145a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778304606, "uuid": "e82e99c9-413e-45d2-a21c-695b2d715171", "comment": "Malware payload (NanoCore)", "value": "b3a73f1e60eb11ca697316528c85c214e37b734452e8701619a3c3dd3d35be39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778304606, "uuid": "9594c869-732f-412d-bd38-6a3ddf5b4e8a", "comment": "Malware payload (NanoCore)", "value": "7065b180540da4862d547ac60511f9f5412dc9f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778304606, "uuid": "f20973ba-5d1c-48bf-9471-e4ebc4b2846d", "comment": "Malware payload (NanoCore)", "value": "8a4452d97f81aad1fbc0160d4dc5dde8c7df26a6c2b48b6580e95fbdd55bb058d8bec5c159d0d249f0b2e84d7cd28e68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778304606, "uuid": "adb62f93-84f5-45e9-ba6c-88adbf3c094f", "value": "T1C514CF6677A8492FE2DE867D601212529379C2E39CC3F3EE68D855B34F227E44A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778304606, "uuid": "ba10ad34-3fa4-413f-b601-fe74e5df5016", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778304606, "uuid": "1b07fcd4-56f8-4191-a9ce-ddd4da141dcd", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIxBwKNdlIhtRSE8KaDtyvLGVQf:sLV6Bta6dtJmakIM5aTw37ax4L2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778304606, "uuid": "cab1ead2-ceda-4f04-86dc-74cc2c4cabfe", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778304606, "uuid": "4092aa7f-462b-4d24-a5dc-890cf0584009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778304606, "uuid": "329c8d65-0889-48e4-b275-599236994a6e", "value": "m-u88.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fc46e6-4ba1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778329283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329283, "uuid": "71b9a2cc-0eef-4068-832e-7d067a7136c9", "comment": "Malware payload", "value": "131887c665b72508b3ac9f65fbc48167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329283, "uuid": "b65cb9ff-be27-4626-89cc-9ced30e1c3fc", "comment": "Malware payload", "value": "b4515bf64db1f69b091529e85863d1a4367eaf6647f1a699c2623ac5d1657aea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329283, "uuid": "9be0647f-c8b5-4ae6-9fb6-a0480a98576e", "comment": "Malware payload", "value": "b78a3aa647da2c3b629affaf390d5dc133e23858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329283, "uuid": "e81c9133-a4e2-4104-ad3c-e6502b5d3679", "comment": "Malware payload", "value": "4689af050786f3299fa33f2799a97428efde0d3adac3a035de31950bca669195d9653c7c132a09a50458d95928b4b83a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329283, "uuid": "2b6356d0-ac8f-4180-a8ab-85ce880be175", "value": "T18FF71916BB418ACAE076923494674F41E336E9714B7187A733BD262C5FEB3CC4EB6184", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329283, "uuid": "072c8fa4-7dbf-4c19-999b-a3cc707184c9", "value": "5b73a9ca3e4848b0eed5bd1463e47750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329283, "uuid": "d567d478-d009-4445-92b0-c3bffa8b40d4", "value": "393216:2I8D+c4ratGbpr4weyB3Zdp1uPGiSPWw1JBClYZdTckjXIJ0ro9iE:2D+Zatrw7Vfp1uVS+w16lYZBle0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778329283, "uuid": "0d82c198-1cbb-4844-91af-3c1100f42014", "value": 75869064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778329283, "uuid": "23a47490-6d2e-4246-9464-694788b01bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329283, "uuid": "58f5ad86-56b7-4af4-89d6-227b39fa4fab", "value": "inst.647838.x64.pc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beeb5e58-4b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778324195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324195, "uuid": "ffee7da0-bdee-46ee-bcdb-a3d78ecb38bf", "comment": "Malware payload", "value": "06a258076bd4480d91ba543078567a1b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324195, "uuid": "4c4fea81-b9ce-43fa-9ce6-e9bd65851092", "comment": "Malware payload", "value": "b54f2fece16eac2ac92829260ff0708773fbb60e5ab1eaea4e82546dc290688a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324195, "uuid": "a0758391-7bf5-4c54-8e5f-06bb52220d59", "comment": "Malware payload", "value": "8ab8045d3b8a24860694c8cb88b42542f6a68e0a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324195, "uuid": "1772d2a3-b221-445a-8de3-678c5d24fbfe", "comment": "Malware payload", "value": "520117dd3266f3ca7a2834cd432d9ac6364be3d35c329c2cc7eb04cb9710eb089ce8c31358a219ca8f2da1b3b37bbe55", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324195, "uuid": "b0efa347-3962-49a6-b2b9-a2eaeadb156d", "value": "T118926C0FB9518315D5C00474A5B2873FD6BA9476338454EFFBD88ACA1B682EAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324195, "uuid": "60ea94ac-4045-480d-ade7-20d82e50be82", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324195, "uuid": "ec0f52bc-8bf3-4292-9bd8-6990e0c9708d", "value": "384:xIkjLVlvadxqSDO5wtT0vu98t2rFJ/Bgav8U9c+G:dqx3600G9oJa0UPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778324195, "uuid": "64e86502-fce1-44d8-b86a-4abee066641c", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778324195, "uuid": "c78c59fb-88eb-43f1-be43-32518bc7c5b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324195, "uuid": "50d13167-7c63-43ef-bf43-ca6421b48d52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492f9432-4bb3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778336882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336882, "uuid": "8fd005e7-403d-4855-9005-56f9eb78783d", "comment": "Malware payload", "value": "a695d4d42d0b2da4b0bde3e76062b1b3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336882, "uuid": "ff5c1d89-53b2-4947-b2da-ff5fd9156ff0", "comment": "Malware payload", "value": "b6254d0e71f71279a692c4b59c81760bd6c830c40fe4054a09dcd677f4d74c22", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336882, "uuid": "52c18d82-4896-4f1f-b8b9-83aabffb0c0c", "comment": "Malware payload", "value": "6f70dd4d3082b033b400f98581efa8593dfaaaee", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778336882, "uuid": "8962a001-a819-446b-bf8d-14458e8659ef", "comment": "Malware payload", "value": "86f38da5d40fc6176c52679b600c945ed12b0ba490d89be4fd96f056a9e2ee624f46bc3286a8ff3d46122369bd458dda", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336882, "uuid": "7c0ab702-7a81-405f-a802-ca398593fe22", "value": "T1EC773340F1AAADF6EC37BA359065124453B8B4D11311E0973FE08239FC7BBF46626A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336882, "uuid": "55b8277b-bd95-4220-9436-fc25f8c68e38", "value": "ad510aa4318530074af11ba8249f6938", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336882, "uuid": "54d01768-1635-4731-8a83-b2369d7e8d40", "value": "786432:69n+6H3v28Dy05dP6PeVwnDlcUBnVCIjN9cB0XbbNTP:an+v8+05dP6WMlRBoeqB8FT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778336882, "uuid": "eacac0e1-39d6-4136-b11a-879937582805", "value": 34269664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778336882, "uuid": "5a735657-082f-4b9c-83fe-e8788d3c5f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778336882, "uuid": "aa3afb78-cd9c-4c55-bead-b2d3c863e1e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dba901d-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778331252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331252, "uuid": "15d51490-5e76-44a8-91f6-acd666dd515f", "comment": "Malware payload (Mirai)", "value": "11ab7971bc16a8e9e0af7d791d5c8a9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331252, "uuid": "23eda6f2-ab26-4b3d-af4c-6287efa69a25", "comment": "Malware payload (Mirai)", "value": "ba179aaf217f0a9899787eed7387a3f80ea5c717799573382164ebab003abb70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331252, "uuid": "69a202e2-01c1-4d50-9b2b-fc1ae8c812e6", "comment": "Malware payload (Mirai)", "value": "cae89d8ef483f9929107846392e142daea95d87f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331252, "uuid": "094fa663-c6b3-416c-b465-de15ba68136e", "comment": "Malware payload (Mirai)", "value": "45a06ced38ec7a079630eb2996c0d3a91f243466b073791cd166d531a36a4e3ce9b2c7dbc5ce403f0e2a6a10de71582a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331252, "uuid": "49142db8-5e18-4e34-b1e9-6d039b4692b7", "value": "T114D3B021E4006DD1EC2129F578BA97B80350EE740BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331252, "uuid": "21d68191-0d71-4873-bc23-9dbe0b0a7dc7", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xO:PiySSGp+PMmT7zMplY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331252, "uuid": "a212f29c-bf46-4eac-83f0-7898e4a02770", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331252, "uuid": "5df79877-b039-4a85-b963-5eb009c76c7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331252, "uuid": "74b392e4-44c0-4a28-9c94-1f86a6b5b1b1", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5634694-4ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778331963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331963, "uuid": "d757476a-90b0-4b47-ac12-0be31b2485d6", "comment": "Malware payload (Mirai)", "value": "a064c9ae18fc1c3941c4e47df36f3712", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331963, "uuid": "1e21043e-43ad-451e-95c8-6f7576f9a4a9", "comment": "Malware payload (Mirai)", "value": "ba2048de6e58963a4c705c2c63da845977f646c844717cde7fc1fb133e792c66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331963, "uuid": "3df2004d-2854-4156-bb5b-240a0712e3de", "comment": "Malware payload (Mirai)", "value": "0598de23f8f8b7150046283ae22595571ac5b8cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331963, "uuid": "d5cf672a-750c-4b25-a32c-bbd963e3fd3c", "comment": "Malware payload (Mirai)", "value": "7163694b69632ca7c2d491c15d3a382c597664201fb75a0b3caa0d1cd9eb6209b7334204edbe5e111e246ecb090d8737", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331963, "uuid": "b0a1f952-b20e-4a7d-a355-823a8e720d33", "value": "T1E85302F6A0D87DCDC2599374050B06033EC6A2B860A5A62BB6C4E6A94BF1354CFD8FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331963, "uuid": "cd784d3b-b32e-44ec-a1ed-68568d2951c6", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASRkNpwnLkg4azHV:CM5az1Fy0oPgdZX6hTo8RIwnLGazHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331963, "uuid": "131b142f-019a-464a-94d9-fedb84972071", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331963, "uuid": "5faf1ef7-2d9d-48a7-9d47-ce42485f021b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331963, "uuid": "be8581b6-fc6e-4e32-8b8e-2bbfca4d5d50", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca266259-4bd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778352560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352560, "uuid": "6b0df26c-70c1-4283-89af-f237aa1e8010", "comment": "Malware payload (Mirai)", "value": "0eb7b18d093304ee42ed7a356fdef082", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352560, "uuid": "7b3de916-6c3c-492d-837b-ddb34b7bd5e5", "comment": "Malware payload (Mirai)", "value": "ba3fa8fe211be8baf7282aef6fb60d6183decd2a41c3d9ac76a6a62a6d34ac23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352560, "uuid": "e7dbb1b8-16f8-461d-8722-141ec2645312", "comment": "Malware payload (Mirai)", "value": "38bc8252027853f9b5340ea72a8188914c82f938", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352560, "uuid": "a539ebff-cdc0-4924-8de6-8270e5f06471", "comment": "Malware payload (Mirai)", "value": "2ed00c95e92440e0ed8034138c42bcd815610599691b170437921272d943ab47c2d70a728d4d9a49f950c1416f37862b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352560, "uuid": "45517406-98a2-49fc-9c51-7ede63b4eee3", "value": "T1E9A319DEB8A24A2DC6D156B3762E978573B55374C3CB7203DC104EF8A68F10A4B36B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352560, "uuid": "6387cc30-90b9-4e62-b6a2-c632b27793e2", "value": "1536:5imPAS6hSeWnCoqtEoSBazza0S1qBsoArVqDUuDAIkdJwCIB:5x4S6hSfnG11zza06q6oArVPuwIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778352560, "uuid": "1631daa9-209f-4fc3-9846-d705049a803e", "value": 104740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778352560, "uuid": "3d2c7c11-dbd5-434f-ab5b-3ada0e2f0cd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352560, "uuid": "f05faa89-0e5c-44f6-a8ce-061c58ce5a35", "value": "debug.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6096ee-4bad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778334476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334476, "uuid": "9afdaf19-79b2-4c78-92d9-0515ebc849ba", "comment": "Malware payload", "value": "c26acc92b64f0bb227b380e460bd9269", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-4940", "colour": "#AAECF0", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334476, "uuid": "b34e1400-7751-457e-ae94-78e7f96d6c3f", "comment": "Malware payload", "value": "bd7cd896cb8aa81f0cf82cb1774b4bc881e45f4bf3ba52f6faba972990473a89", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-4940", "colour": "#AAECF0", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334476, "uuid": "43a1ac9a-50fa-4c8a-bf0c-5d882ff302ba", "comment": "Malware payload", "value": "e329cce939661a4a0ccef779853aa8e19bc4d162", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-4940", "colour": "#AAECF0", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334476, "uuid": "0e3089cd-71e7-4c4e-81b1-93c16de609c0", "comment": "Malware payload", "value": "66d475dbc7bbc481757844d87bf916e5614f5346a4e37f0e1adaf7850bc87d4d888418962d17c298d3a20b835067b670", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-4940", "colour": "#AAECF0", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334476, "uuid": "3dde69b9-5ad1-4be8-8140-4a8dd1b5181b", "value": "T12907336C0061A9F732C77585A992FCC7294ADC83F4967B78BA72710087A9C458FF41BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334476, "uuid": "7c1595d8-4bba-4daf-a917-9550631ee5e6", "value": "393216:k3RlakkQ2A8gzUy6yCrGBbepytTUtnVKU3gTY9GY2auqJDKTqijTM4K:AlaXA+n9G10ytaKUYY9sWaPMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778334476, "uuid": "8183e5c4-7f48-429c-8226-69f6e3557427", "value": 17290227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778334476, "uuid": "11086da7-31a4-41b7-927c-ddd50a258036", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334476, "uuid": "7ab80c40-824b-465a-ae21-b943813b3ee6", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fb899a-4b9f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778328293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328293, "uuid": "7b15b7df-323c-4245-b75a-48f8bdf149ec", "comment": "Malware payload (Mirai)", "value": "302c161d30d6185f568d2c8b73185d7c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328293, "uuid": "88e3d932-cb1e-4df1-866f-379ce78a76ca", "comment": "Malware payload (Mirai)", "value": "bee288e19bd82db0ffe4c2eb1d95d4c5ed63cd4640a75608e8c6006ae409c1b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328293, "uuid": "2ac9d3da-9831-4240-a4be-30e5a432cbdf", "comment": "Malware payload (Mirai)", "value": "40d81cd5871af96a34b2b4c4a5aab67d8f1a45bf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328293, "uuid": "6fad8104-80d2-4ce6-8179-29128eedcb84", "comment": "Malware payload (Mirai)", "value": "4806a9e22334dc6d1bbcb7a31c17360ccfba537652657e55766891a2f02910bf97263ddb267abe32f668dc6ee5fc2875", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328293, "uuid": "e4d46d45-3d17-4a7d-aaa7-cd5112796243", "value": "T17141E9CA00F25945CDA5CE04E7BBC9445900C59A3386FBEDDEFA08AB65C86443D5DF8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328293, "uuid": "789189af-c92b-444b-8227-77209aa58767", "value": "24:2ntDn8x/nQ0unGpneQeJIn1T15Egnqo6nIQINIIInU1KEnHQHMInBnn7H979Ym1C:25wKuef2NP6KIUbHe557J9Y+sTOP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778328293, "uuid": "58d24b11-04a4-403c-8c9d-c4835fc411b5", "value": 2283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778328293, "uuid": "b0e7c25a-1ff8-422b-be69-fe499ad4c0f3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328293, "uuid": "3c192004-8d78-4f6a-9cff-70cbdf709ce1", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c33ae1-4bdc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778354543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354543, "uuid": "e416e820-7db1-45c8-9e23-702e1fe7c018", "comment": "Malware payload (Mirai)", "value": "8710c3de60c287e3c2c52618fd31b4cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354543, "uuid": "2f0d3915-4633-439d-a1b1-e7ec4f414760", "comment": "Malware payload (Mirai)", "value": "bef216eb1579f257db9ec4251303143cb0388251ea252ba721250cc05a92bd95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354543, "uuid": "b3a60db6-d3f5-4ef9-9f67-33e2d4dd123b", "comment": "Malware payload (Mirai)", "value": "de594b4b29c3a8800667d7bd38673a20b0ed2b21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354543, "uuid": "8fd86dbe-18f6-4f7b-b349-4735a9ef5f91", "comment": "Malware payload (Mirai)", "value": "69d8e3d1b7057cd42f90f6214d80dc7daca7adae5b29a49c20f4c9fe5b3b48d70409f5210f0288eef44c69c97df40c1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354543, "uuid": "acde746b-9898-4c4d-92ab-76f2ba9f1fa9", "value": "T176E36C46773A0D43E1A31FF02B3B23E193FE918212E1B5817499DE1E40B6D7A5A47BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354543, "uuid": "ab157a5c-86b5-43d5-996a-015292cb25eb", "value": "3072:6sDx83+TGDotv4wNAQhPivab3Q/6MgiFOpdKHG1NuL0BJR:6Cx+2GDotb66MdFOpIHGXuL0BJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778354543, "uuid": "354209d2-e782-49a7-a057-296bf82dd7dc", "value": 149532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778354543, "uuid": "f06205cb-ffef-4d3e-8c05-9c38b6d5009f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354543, "uuid": "36397391-7005-4bf8-b5bf-eb7b261038ad", "value": "debug.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ed7f1d-4b96-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1778324495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324495, "uuid": "5d67d0d7-c15c-4316-8cb3-924b7294463f", "comment": "Malware payload (CoinMiner)", "value": "1b9ae40a3e866e82ffb133635a6fc6ed", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324495, "uuid": "9e700116-9d5c-43c5-82d8-0a6d6ebe0944", "comment": "Malware payload (CoinMiner)", "value": "bf3629eece10533f19eff8d6a0f6b71f8ccc12f5ca2516b0290a28bd41081918", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324495, "uuid": "4ea51d6e-6a1c-41e1-ae98-a97e99117bca", "comment": "Malware payload (CoinMiner)", "value": "402b1afa3a7bd020a0ad47a91e9f5d97a36f1fe0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324495, "uuid": "993fe8f8-7249-4e62-8851-ae1297f4fb84", "comment": "Malware payload (CoinMiner)", "value": "830987526037cf89182e0db68bdbf4159b835cabb242edd3b5931c3aafd5746d44dc7ddbae1eddbc4cfb0f3f42f80bff", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324495, "uuid": "f47e2db1-59f4-4e79-a130-540f7ded87b2", "value": "T11632F9287E854331E3A489F854394347653C2263E797E3DFF773A69E49963488840E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324495, "uuid": "4e519d0a-1325-47e1-afd6-73c5d31e4c30", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324495, "uuid": "791f37cd-0f22-47cf-abe9-f611743f4c5a", "value": "96:MOdfcooYz/9PYz/mUJocBat7dCPDlD42x+ZQvZlzGwwybPFJxGE9mZ2FFhxC7tCs:MtoPWYcBGOx+evZZbPFJxTEZmFhSCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778324495, "uuid": "bf978914-48c6-49cf-8ff4-0e18765e5f83", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778324495, "uuid": "028f52e6-ba64-4465-8350-a7d9dcaea5e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324495, "uuid": "df24e582-15d7-4571-be03-79d358644da0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403bfa13-4bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778342021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342021, "uuid": "27f258b1-55d9-4040-bbd5-0fef4b9c2117", "comment": "Malware payload (Mirai)", "value": "a602c03d6ae6af42e4d553ac22f27b77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342021, "uuid": "0c2bf4de-12d1-4b02-94da-cf792a36a014", "comment": "Malware payload (Mirai)", "value": "c0c083df66dfa6c2d9840f10abc30310c625713480c309268b1b29f9b1ba9524", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342021, "uuid": "068d5b37-ef8b-4a7b-b057-823e8cb8bd29", "comment": "Malware payload (Mirai)", "value": "93ae99875b7e83c1a1bbcbdaa97b195dce29c18e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342021, "uuid": "a3118494-54bf-45a8-b54b-57c02015b489", "comment": "Malware payload (Mirai)", "value": "1974e54554b60ab11105ba814cef508e1b14eef33198554b254d0d5b6edc44d78b0cc31f3a285eb514d2066cfcf5b571", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342021, "uuid": "b11d5cde-1204-48db-b203-10d813235c79", "value": "T1F8361A87B8D24A43C4E4367AB87D81C872A34EB99B97135A5D04FE3C3BBE1990E35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342021, "uuid": "ec453e69-07bc-4457-8c95-69b24446e864", "value": "49152:wux/+ioBE1Xuz7pEFPHrh91lXKY4Rd/ww6B7VUyizDXenlM1U:3x/+S1X/9HL1laY4RDm5izDXenlM1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778342021, "uuid": "a6832009-8eda-4ab8-8850-8d36f54b7355", "value": 4980888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778342021, "uuid": "da3677d2-64d7-4609-9ced-1b80c933582a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342021, "uuid": "adc9a350-2cbc-4095-863e-868b89885b71", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf8cd23-4b9e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778328161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328161, "uuid": "4b02b865-e281-4afb-9f46-3ff930fb67f4", "comment": "Malware payload (Mirai)", "value": "081cc216f32a46dbccaa59c41cc80bb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328161, "uuid": "c948803e-c7d7-4e01-8a83-ac0574f6de6f", "comment": "Malware payload (Mirai)", "value": "c1218e461f588ad9019dcf6eca8c8cfc4b2adc609c3209827523a3595a79add8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328161, "uuid": "c4cd6c36-c1be-4ae1-a0f5-d4329ba0aee2", "comment": "Malware payload (Mirai)", "value": "f1be2c06013c0682681de007f505f99e83c2232c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328161, "uuid": "e9136fe6-9f99-4361-a61d-d77385bfe8f7", "comment": "Malware payload (Mirai)", "value": "92d5cba92453f931715f078a5ec6a5c8bfafbe586a7c1a57c82133a51b348d6bce71a2ff20f91b2e9b1c7f1e5e2176fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328161, "uuid": "fb4b9e9d-a046-4a65-991d-0d87d726bbc0", "value": "T165E31945F8404F27C6D612BBFB5E428D3B2A17E8D2EE72039D255F20378A56B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328161, "uuid": "efeca7b3-e83d-495a-9541-a958fa150e23", "value": "3072:A8AKmxMXxKcd+v1489LO0x7X8Y0W8a0g4:A8XXhQN48o0xb8PW8a0g4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778328161, "uuid": "3dde0882-a2a0-4fde-b19d-698392fb4db9", "value": 145984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778328161, "uuid": "04d01051-66e6-4067-8335-fd23a42b2eb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328161, "uuid": "5fffe83f-501f-4447-ac8a-5d685b32df47", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae947ebd-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778331469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331469, "uuid": "88640665-5438-4fe3-a26b-9311006dccef", "comment": "Malware payload (Mirai)", "value": "85a77bad9c7d6d8fb1dfaa38687b9781", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331469, "uuid": "6a0028f3-af49-40d5-acd3-1f5621019a48", "comment": "Malware payload (Mirai)", "value": "c28b5a78ee6da585b5003aa0d97e2e9a79cf42bf044f4ff15643911717a0297a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331469, "uuid": "0cd3bbb2-ddd9-4968-b5e5-ebbfc6592f7e", "comment": "Malware payload (Mirai)", "value": "fac428b29b5aecec85e3b254f2f7266b3fe06cb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331469, "uuid": "cb55fb17-7eaf-451c-9c64-f7abd71677ce", "comment": "Malware payload (Mirai)", "value": "94bc0c915f52965f7b395d2f04e922c07f631e501c6047eecc6740e138300681a5f8bbf93f3c488d1f2296df9d9321dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331469, "uuid": "ebfaf7c1-9921-4c21-b729-822f040c3ac6", "value": "T176D35C0A78D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DD05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331469, "uuid": "96ff91d4-60be-4025-a45c-6fb17134e244", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQZ:yIRfe3xvvSrlvZZ7UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331469, "uuid": "ae33495a-60bd-4c2e-b2fd-e70b331610f3", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331469, "uuid": "579c306a-3263-4299-b2ab-5e122413e5a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331469, "uuid": "8320acef-55b5-43b2-a73f-32d9bab87100", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b65bc0-4ba5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778330977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330977, "uuid": "2bdda8ac-0cee-4def-8418-b80e700a7617", "comment": "Malware payload (Mirai)", "value": "527d951d04fd230de1302827d0379a93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330977, "uuid": "89310420-bf7b-4aec-82a2-109c29e9c147", "comment": "Malware payload (Mirai)", "value": "c3d348399e2c9259e51ef6d70f7d3d8e01ca62b252fdd62f7d82b94de444cf11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330977, "uuid": "193789c2-8d07-4d34-85f7-2734fff308ce", "comment": "Malware payload (Mirai)", "value": "5b0574a3eeeba765010a5da459880c65765dd3ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330977, "uuid": "c33962fa-cc77-4181-9bf5-c63fe52bae2d", "comment": "Malware payload (Mirai)", "value": "dde76c09979b5fd1e53cd4f1eec6761754142ba65b48ca66ab220a15b37d2bc1d5d0b12d4f2d62b48fd92abf5e6d7d5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330977, "uuid": "db687a09-e8bf-4969-80a4-c4d41054bc1a", "value": "T1B104E70ABB510FBBDCAFDE3702E90B0229CC545722A53B357674D528F54B64B1AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330977, "uuid": "bb89d585-7984-412b-a1cf-0b5c144fa74a", "value": "3072:1QRyCcoyEAj0TymG459FH4qFVAnSA7k93C7KFHv/:1QHcoypj0TymGOFYqTAn9e3C78Hv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778330977, "uuid": "47b93cd1-823b-4e47-b449-2c571bd8f22e", "value": 189964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778330977, "uuid": "58a55c78-c499-4904-9143-af9a2f22d59f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330977, "uuid": "257e3687-5516-41e2-b8ba-6631954435fd", "value": "micro.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734060fc-4bc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778345113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345113, "uuid": "420a39fc-93c4-4c4d-8f0c-8c00f7f54482", "comment": "Malware payload (Mirai)", "value": "5872b2b086753f48da17d0f69a818169", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345113, "uuid": "b00b62d0-973c-4148-86a2-d529520b1233", "comment": "Malware payload (Mirai)", "value": "c592617e12d131d98f8258da1cbe33b427bdb165e6986b5e79f8dda65af610ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345113, "uuid": "19c5075a-e013-4bf7-b437-346499c111e9", "comment": "Malware payload (Mirai)", "value": "efcdb0de936e50421333fb25f9e8d6fdd2f2618c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345113, "uuid": "57cec2a0-44b2-45ed-b173-5336e397379a", "comment": "Malware payload (Mirai)", "value": "67a8a55df4f65cd3390a0f9293157ccf766e4284a14f4ccaf01855e6adc3e6b93e10a9fc2ea557d888d01c453b999c28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345113, "uuid": "640719cb-e6ff-47ab-9547-d729cf3dd22a", "value": "T1A3C36C02773D0E43E2A21EF03B3B27E553EEA59221B5F541385DAF5E80B5E364946EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345113, "uuid": "7c291d1f-0d35-4242-bc96-e24a44892c33", "value": "1536:Bx5EZTrarCWSCu5U6JEvA9ljKsDsNrsvTY73z2blYHy6guV6f0qa6DJygHAvrXDM:riT/O6JEvA3IC87DOybV2aK0dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778345113, "uuid": "5eff3fa2-6a7d-4d62-b584-cea6a10ea409", "value": 126084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778345113, "uuid": "e2806b4b-ad49-4ae6-a148-1e926376c087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345113, "uuid": "4a9a1283-d055-4fff-8d13-b6e13d57528f", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a094ed8a-4bd2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778350343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350343, "uuid": "578357dd-b406-4537-aaf6-d2dcd7ce80a3", "comment": "Malware payload (Mirai)", "value": "73b05ae8e8ade925e63b42a202fe1743", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350343, "uuid": "4c109867-bf1a-4fd7-9259-6ccf7fa11728", "comment": "Malware payload (Mirai)", "value": "cc4f3228870752041a94b3b4c1d73e3ad8212c87ec7011bd1f8cb1b6f4572fa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350343, "uuid": "bbac4bf5-0403-418b-8dea-0005e7d54811", "comment": "Malware payload (Mirai)", "value": "28bfaee4e27aecdacb904dc47137d012d7e99e89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350343, "uuid": "359a8793-669b-4d98-8578-1d5c2ea7838b", "comment": "Malware payload (Mirai)", "value": "a2c779a3120088f2b110365905fdc97c9d99a2bdeb59f500a96363f437953a7a8cc09e748d26ebc527fa7e5718fe25fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350343, "uuid": "932aedaf-4f1d-4272-a870-4cc5881e826f", "value": "T1C6933B43B7050F43D2672DF03A7B2BE457E9FE9125B09588795AFE8683308B22542FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350343, "uuid": "4be22b54-0cb4-447c-988e-32237b4a4112", "value": "1536:kYo70DopLcAe7ohFzLTrc+z5xjs0m8epxumeTkGpTKXMAaSLXgwOSl96Apd:klI8FtUohtx+wTEMvbZA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778350343, "uuid": "b475e995-8c67-4f51-ae4d-42dc63b36640", "value": 96800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778350343, "uuid": "64145331-a173-4513-947a-c01494d64824", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350343, "uuid": "18ec25ac-337f-464a-b2b1-0a6772673ce2", "value": "zyre.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b129bd5-4bc1-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778343005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343005, "uuid": "53dd644c-aa45-4c3e-b68b-142dfffe36f7", "comment": "Malware payload (NanoCore)", "value": "15cb431be1e7eb37abe69f6f4a72194a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343005, "uuid": "9782c0b8-d5e0-4095-ba2c-4289ce459527", "comment": "Malware payload (NanoCore)", "value": "cc6f82015fc2e26a65da84db2dc0e41cc63f5ca735150a5ad55b9f474f0673f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343005, "uuid": "aed42ebe-acc2-4a98-9521-1692df5cd048", "comment": "Malware payload (NanoCore)", "value": "c8bb167dcd83152f988def51f0e1184e4a49813a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343005, "uuid": "a54cc2f6-ad25-472f-9a89-d02a6d5f50ab", "comment": "Malware payload (NanoCore)", "value": "23f5b58df63c1fd7fb258ae7387434cce3b515c5243a234063d7f31da256c42231cc8eaf9e1b2674874229401989275e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343005, "uuid": "0f4d91a4-6811-413a-8a71-2320eba61d59", "value": "T12F14CF5677A88A2FE2CE86B9711212128779C2E399C3F3DE58D464F74F227E106071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343005, "uuid": "f2fcb536-79a2-41af-8433-a8d018069e33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343005, "uuid": "11b884f6-e2a8-48b8-a95c-af134fe9e0ad", "value": "6144:sLV6Bta6dtJmakIM5y0cFHkf8wa3PNMGdw:sLV6BtpmkVrH3wKlMGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778343005, "uuid": "df471c05-d567-47d8-ad44-89ed3c13cbab", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778343005, "uuid": "de547511-da2e-4c47-a9a1-be909e742a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343005, "uuid": "21b6886b-1aa0-40c5-9b2d-4cbf3c8abeac", "value": "j88t2.orgxliaw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ca6a20-4bcf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778349016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349016, "uuid": "c7fe41fa-e449-4496-8e09-c0cef93e66d0", "comment": "Malware payload (Mirai)", "value": "24adfd5e65273bd47214e7ee700c12f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349016, "uuid": "829c8714-12e0-4809-bb74-b192c14f0f87", "comment": "Malware payload (Mirai)", "value": "cd29b756db2cd160e01b50513d02af3dcc94e1262c845bcb8ab838fb27a0b3a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349016, "uuid": "e107c531-e883-4698-9f99-75baffb008d3", "comment": "Malware payload (Mirai)", "value": "517a7cfe584f2bccefe2258b462ce0130fcda367", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349016, "uuid": "23e862e5-3646-4852-9844-c9dfd232f93a", "comment": "Malware payload (Mirai)", "value": "ec9458bc45c5b414792e44b551a1acbc85ba54248a6f88507bf2d53a9e47a2452539576347e88feab39408aedef49970", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349016, "uuid": "6212319a-6985-428e-bf0e-22b28473f4cf", "value": "T1B6C35B96BA8084FDC589E0741AEFA172C4B1F1BD52787A9A33C0FF263C4DD405A3A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349016, "uuid": "458e7a0a-5bac-45b8-a67a-6d9167d8e12a", "value": "3072:w3tFc3j53TmBON2ntThPtp912kkMm1/QNt7ZVG+iej8wpl:w9e3j5jr2tFV3oYN1rGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778349016, "uuid": "0184de0b-f34e-4bdd-b361-5d562c60ddb2", "value": 125976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778349016, "uuid": "38470911-7867-4bc7-b0de-47edefdac213", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349016, "uuid": "37dfcb79-6e4c-41ee-815d-266f734d01d2", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc7e62d-4bfd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778368887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368887, "uuid": "16e31032-be8e-4668-8507-779db67cbdfc", "comment": "Malware payload (Mirai)", "value": "b756d677f029fc9b3a47f7b68c630f7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368887, "uuid": "6565f7f9-c832-40cd-a1f7-1a4ed6d20803", "comment": "Malware payload (Mirai)", "value": "cda61b3a387c7a76bd5e51674d5f421bf9a029aa6da74c1be653ec22c088b12c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368887, "uuid": "3b0ca5bb-f46a-488a-9fc7-067ce4e3fc93", "comment": "Malware payload (Mirai)", "value": "3bf16ab021e006d16db8f30127baa3d3089b663f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368887, "uuid": "19d3932b-2e05-4ad8-8b3a-73652537c440", "comment": "Malware payload (Mirai)", "value": "b373b31c5ae0addeb069f6b5167f76bb97bec6fc916139159f44be635e149d165a6cdb78a8c269e8afe08b9811f1f8d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368887, "uuid": "b983e9ae-ea24-4ffe-ab74-4f54eb9a8c0e", "value": "T11D360897B8824983C4E43676B8BE80C433A35EB99B9753576D04FE3C3ABE1990E35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368887, "uuid": "0e276f3a-7634-4c93-874a-3a9aaefb912d", "value": "24576:a63ApvHDOjZgNx2vOrfxiFpo7tGjzZlaH1Ob8W7YDRaV4NC8kJDhYC7fnjmbLOX+:aNy0DRaV4PkJolTNsJ7nJvOyT65obz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368887, "uuid": "fd02a5ba-0445-4c92-b915-f54df45c480d", "value": 4915200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368887, "uuid": "e82adcd4-0236-4b97-96c7-540dc52fce46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368887, "uuid": "6889d685-6751-4c6d-8e5a-ce0d63e2521e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c1e407-4bf5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778365413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778365413, "uuid": "e3c31891-143b-42b0-8236-411cceb27668", "comment": "Malware payload", "value": "fb9813b45e6d24d24ac465b731e235b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778365413, "uuid": "942c200c-a808-4906-9108-075f17c4bdeb", "comment": "Malware payload", "value": "cec69af3b27cd7611aae3d7004a7acf44a5e5fb692524eff72a1b6053239ff94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778365413, "uuid": "421f8098-681d-4e4d-876f-30a7d24fbd58", "comment": "Malware payload", "value": "bc21c8530a0bb6259aa619b6378f06e9e6f3059d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778365413, "uuid": "adc8e223-6c24-45f8-9177-6b2cd83a90f1", "comment": "Malware payload", "value": "8613b1729f9061cb325f5152f8dbc482facb00d7b4918ee84a03723bd6f1d5a21233fd83dff6812f0b0bd3b38ee3123b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778365413, "uuid": "9076106c-66cc-4e8a-bfce-d356cb3881c0", "value": "T13B86FA1AD9754B6AD021E03CC863630894BA74D9FF2293E74BB8FE15659DBD008BB13D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778365413, "uuid": "02a4c306-c61f-4054-862a-2a32ede1da31", "value": "412c31f0a743f689d79feead4c90902b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778365413, "uuid": "9497bdbd-7e9c-49c5-9155-e8a7c0c2a551", "value": "49152:QK0PimqNVLw6VstV9TG0wvUo817VWBJJ4B4Mwnyd1vViXH3+FP/Ke4IpEoq8m:QKxrgYPUyjo4WMn30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778365413, "uuid": "a55826d7-9ca4-4317-a42e-a8151b753207", "value": 7836672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778365413, "uuid": "92c33d61-c48c-4694-ab2b-26164271f668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778365413, "uuid": "55be062b-f7f4-4af3-b26e-6f3f678aec82", "value": "SecuriteInfo.com.Variant.Midie.179810.13425318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efa8cb6-4bd9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778353347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778353347, "uuid": "e22f1bc1-b6d8-4154-aa67-e284017d41b9", "comment": "Malware payload", "value": "61b62ec2fb9e0c32f184f881beaa7a3f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778353347, "uuid": "e4ae24ad-7c1e-405b-b561-f67777ed39b9", "comment": "Malware payload", "value": "d258d46b63fa004b6bb2b66d3c2370b1c1bcb8849f5c70d99abad17f354c849a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778353347, "uuid": "ea80e1ed-581d-49a1-871c-cf86b6739f17", "comment": "Malware payload", "value": "550600eefa7c63ca15a2a48dc76c848c0c5d31a5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778353347, "uuid": "882aa375-2b36-427d-a4be-38cd54a5503d", "comment": "Malware payload", "value": "14c1169972318477dede5c36cee0f68a59c786f00b4cb8746ce20cf368477fc203cfdf87d0d7e0ed2523ac74fd859b2a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778353347, "uuid": "f8c31c11-1c4a-4fe4-9231-06d8e14039c1", "value": "T136136D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C55A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778353347, "uuid": "543134b2-b801-4cfc-b60a-0b91787c9ffa", "value": "768:bls9NyXsZztCy9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b6HusZmcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778353347, "uuid": "382d05c4-448a-4de7-9419-3aa457fdffc3", "value": 45425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778353347, "uuid": "f54918cc-47c8-4da3-ad1f-243af1df73b0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778353347, "uuid": "441d1d4a-f5dd-4c84-b695-73d03c51fa7d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c153b907-4b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778324199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324199, "uuid": "e0a10b70-b2fc-44d9-97da-08d0004208da", "comment": "Malware payload", "value": "4264d9a976eaeb29eb4969fdee1bebea", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324199, "uuid": "b2997ba0-b86f-43a2-8231-b41c90a4ea5f", "comment": "Malware payload", "value": "d2986c236599b5a5224af277acdcc63e61baf951686b7c939e3483db032bc5a0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324199, "uuid": "18e775bd-ed16-4673-839d-e2fe38623aef", "comment": "Malware payload", "value": "8a75bb0b337890708e052e530547c3ff8b3f9032", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324199, "uuid": "6fd175a0-c4bf-4b6a-9290-e1caafca04eb", "comment": "Malware payload", "value": "00d97e2f5045917c448f397d2cd72ab3ad9f970568cf7917ec7d29f1fe5a5d6fb64433161c3028d380472b44e8c4f632", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324199, "uuid": "5becd361-0100-441d-ba4d-992e9a354cb0", "value": "T135927C0FB9518315D5C00474A5B2873FD6BA9476338454EFFBD88ACA1B682EAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324199, "uuid": "238cb776-1e62-42bb-a500-d2ebe4800df2", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324199, "uuid": "52b8446e-5fde-4b66-b165-21ea13134758", "value": "384:lXIkjLVlvadxqSDO5wtT0vu98t2rFJ/Bgav8U9cEG:lHqx3600G9oJa0U5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778324199, "uuid": "d27e409d-32c0-4c83-8df1-ef9493ed1ea1", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778324199, "uuid": "f2418ce8-9bad-420c-8058-29542144fa37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324199, "uuid": "0da20676-19fc-4b08-bf5d-49d3770e5a52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76298bf9-4ba0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778328797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328797, "uuid": "ad4aa409-0ef8-40ea-989a-164b34fecb14", "comment": "Malware payload", "value": "d41610018b41d0349575565e023232a6", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328797, "uuid": "6a3630c4-13ef-44a2-b7da-9e2422b6c750", "comment": "Malware payload", "value": "d31bbb3f1575d4250efd542beda8b055fd91dac2b97a3261a407f47d961caf24", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328797, "uuid": "9bd7ee0b-972e-4ea9-93d6-779791bac402", "comment": "Malware payload", "value": "147521e16473d9221fa0a6fbf6365c858fca3674", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328797, "uuid": "128112bc-bc29-4669-aea4-ef0ca1644635", "comment": "Malware payload", "value": "103f15fc85189e1537398e9555f6b4f5acbc94bfe53d42fe15511d541960af10897972d24e9f0631de029412e25c4655", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328797, "uuid": "2286a4f9-0884-4d54-af59-a50af13a13f6", "value": "T143034905B788C021E1650471A957CFF14B65AC21EE995A27B3803F6FFE333D2993A61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328797, "uuid": "b4ea18bd-65ab-4645-a50c-48b8fb182d55", "value": "dd866be2d0359864b917bc3219b47b93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328797, "uuid": "ae4b7db0-b2d4-4e14-b08f-82a9f89d00ad", "value": "768:ZWpkh4rbV5JXF4/sRC2a1QwrHTb3LBG068GP:kZXFYsFa9rHc/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778328797, "uuid": "c512b4c1-931e-4bfe-a8d5-c772fe639066", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778328797, "uuid": "5a1dd05d-5ab9-4ec0-b14b-a3e8a54b383a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328797, "uuid": "5390c6af-d832-4a5f-9ed1-fe6578885b2f", "value": "Excel 02-WPS setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6278c8-4b8a-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778319305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778319305, "uuid": "bcaf4e7d-1e97-4185-ac80-37fcef00ecb7", "comment": "Malware payload (NanoCore)", "value": "5c073d0225ba4e9642179aaf3bf9e9d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778319305, "uuid": "f6b20b8e-7d05-412f-af56-964b37175024", "comment": "Malware payload (NanoCore)", "value": "d4e6409a8cb4c6fee2be053a96b5d999357100545b580d459dd7ddde9f7de329", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778319305, "uuid": "d2069f27-becf-48b4-bbf4-a87b21ba5ddc", "comment": "Malware payload (NanoCore)", "value": "c0a6cc6f194c2d9961dd052d386eb0c8d3871039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778319305, "uuid": "50476733-25af-424e-878b-7e2b485b7e9b", "comment": "Malware payload (NanoCore)", "value": "051ec96762de11f76d92ee97ccfee6405e3ad1d3b3755cf665901fbdb4e0110c018fd31b20f1fe6eb399b426b07be50d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778319305, "uuid": "6401a80a-bfe0-423a-bd01-cd1248252785", "value": "T16D14CF5677A88A2FE2DE86B9711251128379C2E399C3F3DE58D454F78F227E106071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778319305, "uuid": "33f31e02-d6f7-4b04-9a03-72758fba5fa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778319305, "uuid": "350aaa38-bf48-44e3-94f1-e88632f32763", "value": "6144:MLV6Bta6dtJmakIM5a0cFHkf8wa3PNMGd2:MLV6BtpmkJrH3wKlMG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778319305, "uuid": "9fd5129d-7fe2-44ee-ba36-9c34210b4faf", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778319305, "uuid": "6cdf9135-2e46-4a65-a43e-679dcc5f25f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778319305, "uuid": "3a51668d-1124-4e45-bead-94378d26ebed", "value": "1anano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225ba259-4bc7-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778345407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345407, "uuid": "6ddefbf8-54c5-40b9-a166-2413f6ad7597", "comment": "Malware payload (NanoCore)", "value": "2644c80c6aaf522c0778fa617d8c2f39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345407, "uuid": "ebaa516a-9b05-44f1-9d86-df2675f737b0", "comment": "Malware payload (NanoCore)", "value": "d51bd3a2a27271e8c3b5e1219af41df42d75368f562db131827becebe69dead0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345407, "uuid": "25206361-1dad-4b08-ba02-c8b56ad3ac96", "comment": "Malware payload (NanoCore)", "value": "bd1696a0531dab5c724ec28cf2b6528c6423c050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345407, "uuid": "7d0155fd-715d-4eb4-8966-26a0ab7cfc6e", "comment": "Malware payload (NanoCore)", "value": "4dd5feb1ba54df1b5862d19a07e8020d4c0038e456da642a55aad664fe985916ab0570d25b764464526430cbf7c93941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345407, "uuid": "4a5818a8-5dae-4e54-9aa1-7595f237cb43", "value": "T13414CF6637A88A3FD2DE86B9611202539379C2E799C3F3DE28D455B74B227E00B171D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345407, "uuid": "7f1acd6d-5266-4486-9c7e-2a23bbe5ca8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345407, "uuid": "fc5ef43a-b46e-4e7c-9300-54605b76ec42", "value": "6144:sLV6Bta6dtJmakIM5RNLiVdjyTMyIdWuk:sLV6BtpmkokjyIfMuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778345407, "uuid": "7a8c583d-bc6a-45c9-a53d-2646306b7be1", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778345407, "uuid": "eed600e3-8853-430e-82eb-85c6b0aa66e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345407, "uuid": "6899c091-1e6a-48ad-a96e-fa9cb124ae74", "value": "kno77.it.comliaw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c3864d-4bdb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778354185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354185, "uuid": "16527f26-f789-4895-bd19-383553d68fd4", "comment": "Malware payload", "value": "42d8e15c5bd8477152b082e02a53a8b8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354185, "uuid": "b49f9462-fc0b-4a4c-a831-82071bf88c5f", "comment": "Malware payload", "value": "d54a6dafa3e4d332aee833d6a96f5a74f0047e37f43dac72a669d6a4a0b9820f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354185, "uuid": "14abfddb-d03f-4c83-8a8b-049146391e35", "comment": "Malware payload", "value": "3184cb8cf39fdd48d253350cd3b4584edf38d5f2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354185, "uuid": "47c9487b-cc11-4b13-9dec-b3e5b7c4cd8d", "comment": "Malware payload", "value": "f1e60d61e7a4aedf32f1940f1c17358762278b940e43e097afebbfb47d5d3565d8bb3ead2ea726de42c3dd5149bea18a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354185, "uuid": "5f85b348-23c5-475d-b54d-f171e2d0eb18", "value": "T1BD22C049AD2EED739C23522EC319A05CC2FD0EEF0DCBA6E44B4A1D12AD27D25270257C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354185, "uuid": "761a9e9e-0eb5-4080-8685-c348d496153b", "value": "192:YgKHsHJM8dIjKPxdut9Wq5SlDGyajFB4PFVZVTadT65Q8SkjQU697F:YgKHevdOJ5SVGyasX28pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778354185, "uuid": "5ad38e09-5273-40b4-a788-37052b6037de", "value": 10381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778354185, "uuid": "5274362e-385c-44a3-8a23-e430eac5b22e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354185, "uuid": "ffd3975d-8cb7-471b-a271-29c15695bd26", "value": "photo-757585888.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762eec5f-4ba4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778330515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330515, "uuid": "82cdad2f-b6f4-4afc-80c6-04dc2463c310", "comment": "Malware payload", "value": "8476a20eea0b06c2fa82d3b071065273", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330515, "uuid": "35cd628f-6f41-4021-bb2f-9db108bfb985", "comment": "Malware payload", "value": "da3e33a90d8ff7cd82acedc614ba503cdf5f4d3bcffe08c112b09c07c3172eff", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330515, "uuid": "23c510de-575d-4ba2-b827-09b8267bb881", "comment": "Malware payload", "value": "917c21bd622576f1f835ff88cbf5cdc98bdd79e5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778330515, "uuid": "1ad96b2a-d96a-419e-b382-ba8f3428e3a0", "comment": "Malware payload", "value": "03329795bb28cd6a09f0cbd0b99e28fe94c6cd3f2a1bba923caa9ef4b53c0d3166cffa7d794ba0ca947c007538f12046", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330515, "uuid": "d9684358-8eb4-4991-a223-1c61dfd772b2", "value": "T1EA137D6956817C24AE99883B1C7E2F0CB9A983E1310851EDBFCB3CF58C5969CD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330515, "uuid": "5b256f14-49f2-42f5-9405-bbe5bc130cf7", "value": "768:bq+R9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bq+aco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778330515, "uuid": "4218f6fa-6701-48bf-8079-88d62676c157", "value": 45436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778330515, "uuid": "ca0b5d03-535f-4ae8-bdc5-89f343868d54", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778330515, "uuid": "90a66ca3-68f1-492a-be73-53e2b24cac02", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a64f11c-4bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778342011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342011, "uuid": "cd62867e-da5f-4eae-b4a8-7f98f7d16c19", "comment": "Malware payload (Mirai)", "value": "b210b07bc80e7ba268ae714915972210", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342011, "uuid": "74759519-14d6-4093-9c59-44c8cae7794e", "comment": "Malware payload (Mirai)", "value": "db5da0eb5c2c845a56cd6a00005d343942e2b2e50b1de71ae297b860c7986832", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342011, "uuid": "61a2fbd4-617f-41de-8750-a63e35fd3d4b", "comment": "Malware payload (Mirai)", "value": "f0471bc8716a5eba5ed55706851fcced654356cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342011, "uuid": "bb4d051b-9553-4468-a76b-bde32785f4fe", "comment": "Malware payload (Mirai)", "value": "ef94bd46ee5fff715f3a755997c5b249609d44990d6b6cab46bf256261cd3b824de436c3896d35489811c8396184b8d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342011, "uuid": "ae58f611-e729-4f1e-b87b-d4f809665153", "value": "T10F360997B8D14A43C4E4367AB8BD81C833A34EB99B9713566D05FE3C3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342011, "uuid": "b3f7d347-5790-45a0-b335-88374b87ffa6", "value": "24576:+jVWSxWAHVW1jajGiq4h9qY+qv9vYwdlBREOxF2QYi/piR3n6TAAs8tUzKAuUlNN:2559Id2QET/bY+Ay8SWPMJyB28wAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778342011, "uuid": "e24701aa-b048-4f8e-bf33-e259c94208ee", "value": 4915352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778342011, "uuid": "a332838f-a764-4a96-a153-ea985fab23b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342011, "uuid": "6d7e5c2c-54b8-4319-9c0b-eda175dfd674", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de22f27d-4bfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778368056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368056, "uuid": "675b8a9f-d34a-427a-a7b3-d6f007140ed7", "comment": "Malware payload", "value": "28dc9627af38414ac35e921485fb65d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368056, "uuid": "553a1aaa-5077-4129-8f9a-67d73ee8eba4", "comment": "Malware payload", "value": "db9bdb4b741ad62d7695d23c00b3429d81e7d2958395060aac5a931200a88be3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368056, "uuid": "fb8b0762-28bf-49d4-8e12-e554f1852a19", "comment": "Malware payload", "value": "a2f773558a2821dab9f4321c0e9adf47df6ac091", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368056, "uuid": "2b38f325-dbe5-454e-b926-eb2b9d8a6e3e", "comment": "Malware payload", "value": "ca9ccbce522355283d4cf56da927e0d405d220b7382bca77c58aa638e40a9d9dfdd75837faf3a11b8c01ae810f4ac387", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368056, "uuid": "11304ec6-0249-4f62-9cf2-f545aa91c37f", "value": "T103767D81F748A125D94A0B7288630F70B7512D46C1E58D9F830AFB2F16B26F7696FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368056, "uuid": "00dfb992-8374-4190-88e3-95c23b9533b1", "value": "49152:RbHdXiv7y4Y8RSTOQRjLuPW2RcuwLd/YPKQx18R97Phs+7JhByEUFZcGHHIt5Ek:Gv/UCQRjaPDYJQ31IFHnonIjEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368056, "uuid": "e17cad29-e574-4f62-83e5-6d6ad2c51bf6", "value": 7536802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368056, "uuid": "e2344a42-41a5-45a6-91c4-3172152fffa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368056, "uuid": "fc0ebe2e-0d5a-41c2-aac5-43cd7b3ded48", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88181322-4ba1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778329257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329257, "uuid": "78961ac8-2ef6-4973-9933-20d00731bd4c", "comment": "Malware payload (Mirai)", "value": "83de3087be0e697ccaa42ff96a4b321d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329257, "uuid": "22640b7c-0449-4541-9b88-9d679d531474", "comment": "Malware payload (Mirai)", "value": "dc69f46c71578898dfa020086b1161a85e83b1a4630abcefad0e225304e631e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329257, "uuid": "d782fba2-50d4-4b4d-9b89-27ca26729549", "comment": "Malware payload (Mirai)", "value": "3336450dce42e42a82f12fa2e3389e3d3fc51838", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329257, "uuid": "4aa1df1a-b3c5-4703-8545-ee38d58f906f", "comment": "Malware payload (Mirai)", "value": "9a7151ff368341e45dc975f91ef5be59d2fb727da414d61d271eb2cbe02714b5512882237389f6e97a60380032cc9d0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329257, "uuid": "7c3992dd-0092-4ef0-8b1b-5e3fe3889e34", "value": "T185530286E91191B1E13331379AC409817366E2BCE6C63D8A751E03ACFD2B2825FFB591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329257, "uuid": "46453eae-0e38-4faa-a38c-730711c98a0f", "value": "1536:p/+jlx/FbjQDGd+qay76a8tlGBUnt/9LwI1oL2S+o1whiP/:p0llRjQCd+dymGQ99LwI1W9tP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778329257, "uuid": "68aecbb4-8f2f-4756-8365-920b69db3e71", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778329257, "uuid": "56b061d5-aec5-4b26-9a7d-bfe312e0731d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329257, "uuid": "0d1285a0-5452-439c-8d23-d56ce7ff64bc", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34fddaa-4bae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778334886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334886, "uuid": "604a6a40-cc04-4082-8765-fa8a63923cb1", "comment": "Malware payload", "value": "36ca27f62f18df086a340eef0912c66b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334886, "uuid": "c9bbe82f-7f1f-4ce2-9340-9c2703e3a9c4", "comment": "Malware payload", "value": "de2a5f2bd7cedf2de614730b966f13104ce3d02d5127f6d4acf4d6890c3b23c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334886, "uuid": "63ea598d-f080-4d90-9df1-8cadcf8cf7af", "comment": "Malware payload", "value": "033517f4d75e709681091fb0cf706b450b9f500c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334886, "uuid": "11aa8725-5fef-4b84-8dcc-8e931166b4c8", "comment": "Malware payload", "value": "1c8489ddb0a211b005cb84ef8e39ef85567719862c997f3ad0b65971d11fdbe04c6e757b9552e119c29aba66579b9314", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334886, "uuid": "5512094f-cbd8-4c67-b839-703595a2a2ad", "value": "T1F9E6AE6D73522179C4A7E57B2C6A602B8936BA021122860EE7CCED1FCF327D06D16777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334886, "uuid": "db96de40-504d-44df-8d1b-32629b26db88", "value": "bfbff861d27f35a91d19a5a58e3fb3ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334886, "uuid": "ed135243-2f9e-4749-9e38-39416c6eafda", "value": "98304:GMWj/8OkTLdsC5ssd1+PkLuwW5wgqP4mtVEhrcpHIbxsGR0PlFfzw0GR07GR00lY:GCLuwVPzn+ZNTzRO8//EeRho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778334886, "uuid": "5e11f5b4-b1b0-4b53-832d-cafd617c96c8", "value": 14432272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778334886, "uuid": "cbf1b9f9-54ac-45c2-b15f-4c8dab39bbab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334886, "uuid": "7fd86253-b4d9-454f-a6f9-b0a16101416a", "value": "libvlccore.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d16793-4bc2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778343607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343607, "uuid": "d1970863-000f-4c87-a2e8-34ca0de6e5d6", "comment": "Malware payload", "value": "b55951be5d91fb04682b73340ac50885", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343607, "uuid": "84b0f6cb-992b-4fad-ae62-3f13343e51ea", "comment": "Malware payload", "value": "de560f54deb9e7f1ca4930836b78b4d470add3886b8fd41cf8295c43c034075e", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343607, "uuid": "0557d255-9e02-4e89-a12d-4e96918c69d1", "comment": "Malware payload", "value": "a01ac6635b18a9773a36332e8617b030ec1e2873", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778343607, "uuid": "ebd4c690-5f09-421c-9546-0ba6ae59c971", "comment": "Malware payload", "value": "6e264d03db5b42a572f47f4a97f611c890624943b98c1a8fa6dd9d01abb6529d8965410a6ae10f9bc44e44c92bed3d10", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343607, "uuid": "526f9aab-3705-4c3d-bc99-7e21f0ed83ad", "value": "T1AF178C1762E501D8D57AC0388B279517EBB1BC1A1330ABDF16A0A6562FB3BF01D7E325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343607, "uuid": "f35541a3-2f71-43bc-b7dc-0d8aec664656", "value": "9bc2c620b7c66ab1d6a3d71b0ec7d288", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343607, "uuid": "5050436d-6ca0-4de1-8ab6-f08df51310dd", "value": "393216:w5WHh2WS1z7AInuYlK6yygKFdu9CwJsv6t6c:wOeHU5yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778343607, "uuid": "f3456ab6-be68-460f-8c62-9282b28ef922", "value": 19408144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778343607, "uuid": "724f92d2-2651-4eb6-b245-d3146eb7eaa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778343607, "uuid": "e1d56430-d8e9-4928-b675-8ac222b88d31", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5f2c73-4b9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778326871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326871, "uuid": "e02aada3-487a-4ec3-9dcf-88f560d7e896", "comment": "Malware payload", "value": "754c31634f1fa20bb665fc66e589a631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326871, "uuid": "218f117c-a70b-4454-a7f4-df2c427d9c99", "comment": "Malware payload", "value": "de6469b14f8aa4f5dd95465b83dcaed70025aec980b1d7110b7a23b3e1d93ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326871, "uuid": "406cec6d-367a-4823-ab89-b476a8afe795", "comment": "Malware payload", "value": "20a9405406cfb7b251356c76b5e6d130ce73a534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778326871, "uuid": "3e9855d0-4c14-47ab-827a-a208efc4ad60", "comment": "Malware payload", "value": "8353f97bad150b4dcfbcabb40da6833e51889f88e712df0b66c08f6f2b75d2361b2314002b05a756a91daef7ee11e3f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326871, "uuid": "5de31836-f46d-4de7-b788-b432dd546b60", "value": "T13166334B5A9B89F2D722FBB0C891E01D734AFB02C8564D5A778916C85F879221CBFF05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326871, "uuid": "03033b11-17ee-44f3-8a78-70d7a2a5f252", "value": "3971c19402f843347b6e0787a2558143", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326871, "uuid": "9b22fada-ed12-487a-b8da-778af6425db0", "value": "196608:jR4etbH1BteadWfjKyhufNCL2rnqPnVwr0:jRtj1BttdWfjruxmnVwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778326871, "uuid": "0a81ba3f-f852-4996-9cb8-26273e8631dd", "value": 7084032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778326871, "uuid": "b349bdde-982d-4786-adf9-77bcaaf0c618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778326871, "uuid": "e4e95bfd-27ef-4de1-a53c-d9f55f09a089", "value": "KANADA SOFTWARE CRACKED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52a3b84-4bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778333734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333734, "uuid": "49394dbe-f9ee-4682-8b22-0f10617e99ac", "comment": "Malware payload (Mirai)", "value": "3b74e8b96c7d2347519e5d6960cda197", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333734, "uuid": "d4ec75a2-972e-4d54-a063-a48726115923", "comment": "Malware payload (Mirai)", "value": "de860ef37ee47533eec06c5dd9f5939d8368d168bac1ebad58feed22b3d14375", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333734, "uuid": "ca87c890-d00c-4c9f-ab23-d9dd9fcc559a", "comment": "Malware payload (Mirai)", "value": "7b4ca0522e9823caf16a849e873b222188eb3a52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778333734, "uuid": "33fb48d0-0739-4180-8950-818d3c2bf5f9", "comment": "Malware payload (Mirai)", "value": "0eb842dfa93de276a7d4c966695adba0e01a5f1eb70aed99b1dda11dc7c50d56456e25b0d393016685817f2560413cf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333734, "uuid": "e8c9fcda-d68d-451a-836b-ab730eb8df00", "value": "T1686302CF6EB02F26D0D861B2703915D9CD3A9CCAD643C69D87E1D7960B388365088B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333734, "uuid": "c8b672d1-b3e7-4995-9268-3a729788794c", "value": "1536:NaxZLmYKVDNSl2y08yumeJyGYVmIMG+hNO:NaxZLmYKX+t08jmeJhYT+hNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778333734, "uuid": "565f6c13-c92a-4aa2-81ee-ebe1d0f4d381", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778333734, "uuid": "0cf3501e-48d7-4c32-888c-9269cb8c82f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778333734, "uuid": "46e54604-f3d4-430f-a036-bdd9ab8db538", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc0cbba-4bd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778349322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349322, "uuid": "ba477413-13fb-4466-a127-42452ee454ad", "comment": "Malware payload (Mirai)", "value": "7bf959c34ab282095c0466f073e00671", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349322, "uuid": "05ee6ade-387e-44b3-93a6-5870f2de53c6", "comment": "Malware payload (Mirai)", "value": "e0f596512dc825eeddfafe880c37247d66910c0a18da344332578cf241c966b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349322, "uuid": "af163d01-e969-478b-97f2-2a2aa9bc0f0b", "comment": "Malware payload (Mirai)", "value": "718ebbc592d2b3385c14765d660f85fdc9d8d365", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778349322, "uuid": "b42d79fb-87f4-4cfe-bbd7-4190f4d3b659", "comment": "Malware payload (Mirai)", "value": "344de3077c26e95f4a820be018a48031b186f6784080e818153f98620205eeea01e486becc8306f15f4c4cf6bcdfbb67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349322, "uuid": "06790e71-2870-4380-8955-9bd8ca0101d1", "value": "T1C9C34BC1B54B80F6E84B9C3060A7F23FCBB0D57980E5C259EFC99E35DA5B945522238E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349322, "uuid": "352d7ec7-9a27-4a38-aebb-4660ee794c7f", "value": "1536:iMfjmF8ywLEq4txgea3+L2yckHfC76/YxWUa5rvUdLinIAXsSyAvrXDwr:iOjg8NEdPDa3ztCfxvb5LUxqIAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778349322, "uuid": "bfde3082-ac10-4008-8d0f-4c4b967dde0c", "value": 124716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778349322, "uuid": "733ef126-1df4-4b18-b31c-6ece82b1b61f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778349322, "uuid": "2c32a931-c151-45cc-a217-72d054f8dced", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd72e3b-4ba0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778328759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328759, "uuid": "64c263fb-54c8-4ac4-8bcf-fe38458c3b77", "comment": "Malware payload (Mirai)", "value": "5c5303324b263d75815ca896ce1d26ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328759, "uuid": "63169f76-5f4b-42db-8cf0-89aff4525cd1", "comment": "Malware payload (Mirai)", "value": "e2285a3fa04cf14a856116e26b4358d864b7f23d510601037d57a1d96289f2dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328759, "uuid": "33b18645-c6a2-495c-8e0e-0a3e1f9d1439", "comment": "Malware payload (Mirai)", "value": "27ee52bd7014c61716eebdac76abea89c4071ff5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328759, "uuid": "7b93942c-e36a-466e-a424-950e649303ac", "comment": "Malware payload (Mirai)", "value": "44568957719d6bd227eac7fbb40825ecca7338b5538527c563ab3dc4ed4af632953073384a943f9e2092e9e9e28eb6bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328759, "uuid": "93c09872-c509-443c-b99c-88bbfd82a0bd", "value": "T119934BC9F643E8F9EC430171103BEB739A33E9BA1219DA46C3A89A32DD62511D51BB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328759, "uuid": "2c143efe-7ca6-462d-bd28-1155f668c9ba", "value": "1536:ZFEiHrJnY2FK+276rBY6FKJSCFP31bj/pD/VcrplWjSrYvVV:7EYJnY2FK+2+NY6FK08P1zprVApcuKVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778328759, "uuid": "3d82ed65-8651-430b-8106-2e8a805a8612", "value": 92552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778328759, "uuid": "5f0e7eb2-578b-4603-8ed0-fbff55fa6df0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328759, "uuid": "0a4215e7-5c4d-49dc-a0af-6484eb3dc64c", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e01b80-4b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778324183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324183, "uuid": "e3b04be4-e2a3-4fd3-a24b-2436c1b95a68", "comment": "Malware payload", "value": "2fea38810cfaacfb8d5da1f029d113b3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324183, "uuid": "145742a1-9208-4247-883b-9a94ed509e42", "comment": "Malware payload", "value": "e2c67139ffbf59d8ed1e3a8767747f1ce486b0b22988b42a3840afd986655b66", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324183, "uuid": "bc0fe2c8-670f-43a6-90e5-3c8cd2af2f6d", "comment": "Malware payload", "value": "a9ea97810b190fd3dc56dc065cadc59015c7312e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324183, "uuid": "fd0a7931-565f-4023-bf17-b0bddf4a6286", "comment": "Malware payload", "value": "489726f271da73a0ea7f7fc99a00f5c6767a8a3feaca1a7313907d491bf42b4b14e6a564191b5769c4c83f777906ab73", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324183, "uuid": "87156355-aa0e-4cd3-97ee-e2f6e569e75e", "value": "T15C927C0FB9518315D5C00474A5B2873FD6BA9476338454EFFBD88ACA1B682EAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324183, "uuid": "9e6691c8-9508-4b8a-b71f-7573c0bc1daa", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324183, "uuid": "f8e17ece-c624-4646-bf5f-f5157ebd77ad", "value": "384:fIkjLVlvadxqSDO5wZT0vu98t2rFJ/Bgav8U9cDG:vqx3640G9oJa0U+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778324183, "uuid": "09e0a657-2912-4d90-aced-043db67b6d26", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778324183, "uuid": "ec60930c-e315-4fcf-b8f4-f0e5f4a2a776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324183, "uuid": "242acadf-3813-4b2d-a53a-ba5f317d95dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3bad8ed-4bc7-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778345704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345704, "uuid": "1c7927fb-c4a0-485a-a92e-174a70b8f2eb", "comment": "Malware payload (NanoCore)", "value": "f8a1eb5e82e55d91d45198ed7ac3e281", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345704, "uuid": "b6d41341-1d2f-4bc6-acef-fb9008c6d884", "comment": "Malware payload (NanoCore)", "value": "e3bd37b96a42a34b2274dc1b216862f8d1aaf8b9cd327541b4bb825ca864bb31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345704, "uuid": "f00d2808-bf52-4801-94af-0600b642a4cf", "comment": "Malware payload (NanoCore)", "value": "c6493c19f3ee149c0ec744b8854d90727d23b770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778345704, "uuid": "0abebc8b-c884-4cd1-a612-8ff42018f759", "comment": "Malware payload (NanoCore)", "value": "4b161b22678ecb3db1d855438ad6ad9d3e44856157ded4648f751a0e1ffe44cc956c2ae1262ae11114ffec83fc2db926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345704, "uuid": "f32e1b89-60a5-48e4-be2f-a166d6e594e2", "value": "T11314CF6537E8492FE3DE8678701242028379C2E398D3F3EE28D461B69F667E44A471D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345704, "uuid": "c1854566-d819-48b4-a5cf-cc7825604e4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345704, "uuid": "1df1b1bd-213e-437c-ba21-63f65ab5fa61", "value": "6144:sLV6Bta6dtJmakIM5i6fA+eXcTTacsRy3Cj+g:sLV6BtpmkbuA+eXsaDCUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778345704, "uuid": "fcec70d9-c86b-4572-ae51-02b7c303fbce", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778345704, "uuid": "a67975ea-cfbb-48dc-a128-4782ce190c97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778345704, "uuid": "6548f8d7-2814-4f03-a107-4de892beb411", "value": "mrs.it.comliaw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddb60a9-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778331441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331441, "uuid": "8a157f4a-3951-4efc-8459-4717c9e63d39", "comment": "Malware payload (Mirai)", "value": "169dc07586bb8c7a3ac7ac8bb15c963e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331441, "uuid": "e26f8e73-5b34-415c-8362-20789887c8ee", "comment": "Malware payload (Mirai)", "value": "e5be5078e60338325fdfbffe6a209c6c1bcc55004c310f39c8ab90c867e68786", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331441, "uuid": "a41b9797-8f69-4f20-9514-a65c14a9c2b6", "comment": "Malware payload (Mirai)", "value": "12ae4e81293f1d44f98600b4772b28d5dbff2629", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331441, "uuid": "e1fab310-46d3-4ea9-91fe-dbf340309c29", "comment": "Malware payload (Mirai)", "value": "1b8856a6c9d85f2c275c346fa9bdc3629e3efdd3504d4e6851a70e391040629e8592289d26752135990060e225b5db86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331441, "uuid": "ae769cc2-be7b-4195-b02d-066f098dfcf1", "value": "T14353024169A8E83ACEE2D4390F3841EA46DC99E8A4D2501F43CD7DF88905D78FADD6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331441, "uuid": "2abf319c-490b-44d1-b1ad-c325b5b58c47", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/VPVMkoqqAQJ:MaHJgMo8FwOA4zUFGUO3UhbkqQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331441, "uuid": "f0b7a211-de1a-43d7-87e3-019acfa2fa2f", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331441, "uuid": "78250d82-386e-4539-ac61-825fbe399ef4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331441, "uuid": "397cbec4-e689-453e-a44f-3ba068d60bfe", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e470426-4bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778342018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342018, "uuid": "61ef2f5e-b493-46dc-9ea3-b90a1c099933", "comment": "Malware payload (Mirai)", "value": "79bdc070f61e4711da3a3d60cc228bbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342018, "uuid": "f7876d29-5c5b-42f6-a015-7c22fb4a8d7a", "comment": "Malware payload (Mirai)", "value": "e74186ebda56409d62132988f1bb973aa52bd35608f360ed3f1c2bed9aafbb52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342018, "uuid": "e9f785e3-2f77-4923-b3a8-d0645d7babc8", "comment": "Malware payload (Mirai)", "value": "1760dce6b470b13b12d8179f60bf05cfb5400f8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342018, "uuid": "e441e65c-2a16-42fd-b854-947c5a938d07", "comment": "Malware payload (Mirai)", "value": "83cd0ae2bc0bd627260d0dfcf30062f3cc718bb40b1d7e6cfe8d766e0027625e4d8cd4c9811c5730489319af8ebe2086", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342018, "uuid": "363fca40-0b83-4a6b-9350-c5e030b53c44", "value": "T1EE46FA15AC843BE7C02C9B7494EACE5623745D144AF24A362694FFACBC762387F4789C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342018, "uuid": "41829427-22a8-4cb3-94bd-a80a12529631", "value": "24576:jZd8DI+mz9x9sx5Rxprkglm1R1Q0UDAnG6Xi2NWdK7lHsI2SbbSKD0HpiKiEfdib:UxxYUUbKYJL6n/aj2buvKDLrIjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778342018, "uuid": "3ba6750a-c8c4-4583-af90-59accb62ee03", "value": 5570743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778342018, "uuid": "6788cfa4-543f-41a9-8efd-9f8454d024c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342018, "uuid": "02c31bb2-fa3d-48f0-81b6-67b52a50ee80", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d64b450-4bd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778352915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352915, "uuid": "18fabc1e-3360-4081-a4e7-576336975e3c", "comment": "Malware payload (Mirai)", "value": "429c579819d6358adf39683460027957", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352915, "uuid": "766ee351-0328-436a-b9cb-8954261d9cd2", "comment": "Malware payload (Mirai)", "value": "e8d41a16630d834b37dca2ac06fffd8a61cd721e4cefa09c19ebd4c3199ccf05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352915, "uuid": "86ebef91-f875-4038-b145-d8f614b0504b", "comment": "Malware payload (Mirai)", "value": "264c4932f04303bd7e9a957d23c3824ee3e9a250", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352915, "uuid": "e3c454f7-913d-46b7-8a83-92d42b1b4d10", "comment": "Malware payload (Mirai)", "value": "c688370f5018f2dea4566eac85f787ca2a50a4ce43d2d5d35cf3670743bd7d761f2ad1a010bd4f3b678c00cd6465012d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352915, "uuid": "6c8558b7-eaec-45b9-b69d-b2e7bd987761", "value": "T100C3F702BF614FABD82FDD7345EA0B12388C6D5626B52B75B934ED18B71A1C706E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352915, "uuid": "959325ca-a759-4952-8de0-ed8e24f2856d", "value": "1536:EXqafQYb1rFtRn/zGGZ6qEMZvhCDRW5FTVg4nedXzcrA+TyTVcdqmthUlEHq:Cq+QYFn/zblNV1e5x+Dhjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778352915, "uuid": "2d8c585c-aa8d-459b-a16d-e532606fdb42", "value": 120920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778352915, "uuid": "3714d4b1-8019-4697-8d00-85552eba91fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352915, "uuid": "3134874b-8f4a-438c-8211-14c69f7d0275", "value": "zyre.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c028e874-4bd3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778350825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350825, "uuid": "58705066-3188-4f7f-893b-52b8c77b8061", "comment": "Malware payload (Mirai)", "value": "6eb73d71725fcf49a3302b3d4c1cedd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350825, "uuid": "b984393a-20fc-40e8-aa0a-d650ff21c932", "comment": "Malware payload (Mirai)", "value": "e8e2f40cb86972e80bed1cd9805290f9347cd0ab1491ca0cd607dffacb8d2739", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350825, "uuid": "3e354f0a-ebe2-497a-bc1e-3087aee00bd2", "comment": "Malware payload (Mirai)", "value": "0d8aa2b46b12d4767d3ecb4d9e58fb74c94ef3dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778350825, "uuid": "520ad729-bedb-4809-9546-beac5bf38aa3", "comment": "Malware payload (Mirai)", "value": "4afff9c1a9b5595d536aa897540a7eab65f828fbf636bfca34112b2dbc6aa5dbecc22b4b6317f6403244ae597473e944", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350825, "uuid": "56e80f9c-7829-43d6-b538-ff41e06d53d6", "value": "T1EFA33927BE724E27C4C2A1F552F30731E5B1ABAE1C78851ABD612DC86F641D03256BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350825, "uuid": "f64180b1-13cf-4f05-9e0e-283a6aa2100f", "value": "1536:VbFrpqUTxUtbd+D18eCNtaY9oD5st2Uzuq5EYY8KYLs:HpqUTxcyOYEo9zUjSIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778350825, "uuid": "fd59ba0a-f775-482e-b3ac-12b19cbc97c3", "value": 103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778350825, "uuid": "1955ad3c-b056-46f1-8ca2-a6bfbf270e68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778350825, "uuid": "a3019876-28e9-4ff5-ae0f-b1998cf8c2a2", "value": "zyre.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b68b48d-4ba9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778332644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332644, "uuid": "428dfefe-dbed-4c84-8bff-494eabf919bb", "comment": "Malware payload (Mirai)", "value": "a814e8db8cd3943bfe590ee3ac21e260", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332644, "uuid": "7c7db3cc-aba5-4845-8f66-8ea913dfa209", "comment": "Malware payload (Mirai)", "value": "e998ebd8528e31522a857e4c5b5e4270cd12682183128aa0d4c7d96385f842e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332644, "uuid": "21c5ad0d-9363-48e1-b503-fcf7b699637e", "comment": "Malware payload (Mirai)", "value": "53ccc054791cdefb43f14a12262674a415ecf791", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778332644, "uuid": "0de4e25a-62eb-40ff-b2f0-4818f54154a1", "comment": "Malware payload (Mirai)", "value": "ca3783ff290096e30ec2bb6b749ca9f7786f32dac2f49472ba7d8031b27d35675802c8592e27e3561883741cfd17b034", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332644, "uuid": "2bb53a85-651d-475f-8788-14484e5bf228", "value": "T1A24302202A84CDCEC68AC63121919F69E6B44783490369C6F7177AF3CF4E389B886CD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332644, "uuid": "0a4b419a-3e23-4811-bc80-6c3a34cc65a2", "value": "768:U3fkFPTWk7px9YNKFPPBH2koWsZ2uJDu96oeNGKFRjQAgvwF5TqkQJgGlzDpbuR8:Uvk5TWxqhoW8XDube9jQxvw1QVJuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778332644, "uuid": "699866c6-aae3-43b4-b24d-300344d3d561", "value": 56284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778332644, "uuid": "3e8fdc8a-30eb-4d69-af5c-8387ee5b04b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778332644, "uuid": "aabb968c-8800-4bcf-841f-f9c52ca89d1c", "value": "micro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3aaf42-4be5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778358496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778358496, "uuid": "36526df1-e519-4d35-b0c7-2f690180a80f", "comment": "Malware payload", "value": "3ace0e1ea9b765c78e23f6a93f2693b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778358496, "uuid": "4a9fdef9-656e-4bf0-98e2-86f0dc3f122c", "comment": "Malware payload", "value": "e9e5875e4328be32613d3d9f0ac92dee26f34c9751fe3f3a06901e3c191383bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778358496, "uuid": "9f453748-750c-4bbd-91bd-e850b9aa6bae", "comment": "Malware payload", "value": "96469dfd8c7eee635b1d7f87322bd5ae14e5c8ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778358496, "uuid": "a6e00cfc-7bf1-48fb-8434-6cb8df99f916", "comment": "Malware payload", "value": "803ab2637828e1a31d2b7d195fbf4114b4cefc6ca7fd3c574ac62dad3e1c01f75fd31ba4ee98b09604ec02eac7f87217", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778358496, "uuid": "13cc2600-cafc-4287-87f6-d1f42a760624", "value": "T15D6423203B634624C7E1F42F29D9BE97F24CE31250C05F9FEED9EA5492CAEED6412542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778358496, "uuid": "ce46a0fc-017b-4e4e-a3f0-f9777f9a187e", "value": "6144:4HuVlQa4NhQvBeYmNO8kj+iYqlI5ibOrKDX2r1h9jRjvz4nk0a2rE2f:4My72eYm9DCDfKr1h9jRP4ndf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778358496, "uuid": "0c18c759-0ad4-4234-bca0-f276f9939ec1", "value": 328392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778358496, "uuid": "f5137db5-3d74-4482-929a-34f2f106777c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778358496, "uuid": "46c679d0-d61a-4689-b646-ecf3bccb3310", "value": "avx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9afb6a1-4bfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778368048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368048, "uuid": "3589bd13-0870-47f5-b28e-1ded20872ae1", "comment": "Malware payload", "value": "74a80a6c75c0a6bfcd46af9b4b9330bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368048, "uuid": "08904b58-736f-409f-b172-fbf7cb16e5df", "comment": "Malware payload", "value": "ead2b70788df7c71a50fa204ab0c5db80963f2366f4bcf70aba99bfb031ab849", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368048, "uuid": "0f7aee93-a10c-4ea3-8263-1fcf72d6e930", "comment": "Malware payload", "value": "2b1937837319bc670b00e405f6c33959a54f0c22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368048, "uuid": "b60f011c-9644-445d-96fe-d8a1e7517f30", "comment": "Malware payload", "value": "c3518bee496441194318d6f5072fa210f8b8014f04e9983db43354c971769db028acf422ea284c4b04b85b15e1da3b3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368048, "uuid": "06d8a4f4-eaba-430e-95f4-fad4a9ac4068", "value": "T16F762957B9924942C4E43A77B8BE81C433630EBD9B8716579D05EE383EBE1DA0E39740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368048, "uuid": "b7c1b56b-d171-45c1-bfa0-7ccd140544ea", "value": "49152:uj4YFzE6VnFZ2y+I7fdNaFBaR12N/hqCHvmOznhmJ4PGQ5Ez:o06VnFZ2VI7fdNwBaRwZPmWnhlEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368048, "uuid": "3a97dc43-fdf8-49cd-8ae5-06f95bef4b18", "value": 7471266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368048, "uuid": "a2ec93d1-8574-410a-a41e-bf0362969497", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368048, "uuid": "b6d1e532-2fb9-48c4-b6f3-2674a5268e16", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd3058f-4bfd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778368886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368886, "uuid": "f20e5c67-b665-483f-9ae7-7da56b284e34", "comment": "Malware payload (Mirai)", "value": "75e9fe72d572c6e9b74639bdc108ec40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368886, "uuid": "1dbf2f97-5337-45cd-9eab-374b5d2f2066", "comment": "Malware payload (Mirai)", "value": "ebf34459b8f6f2cb01ffb6ee69addee09e8efb104b2bda8eef239fad57d9e0a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368886, "uuid": "ea594a7d-80f8-4319-857b-59866ce0d281", "comment": "Malware payload (Mirai)", "value": "7271ea2b04384a7d68311812cb420f8f3794bcfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368886, "uuid": "8cd667f5-dae7-4b96-a447-6f0d4cf5291a", "comment": "Malware payload (Mirai)", "value": "c15868d64e6baafed9a6681d29c3525e46b66d2ddf8320c4bae7d16dacd172a292d78a7c5d0233ebdd06a1e7e9a01365", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368886, "uuid": "cc306537-dc4d-421f-b228-464abe041d97", "value": "T10F364A9CFC2EE452DD88BAB46BA10197B735BC09DF52C7222614B76D78F33949F12260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368886, "uuid": "8c99a2f4-1314-46b2-9772-90ef3b31efcc", "value": "49152:CayW6noCfpPttVqM9u5E6Kocc6ZfGjP3nBhD:ByW4oCfpPttEM9kE4ccSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368886, "uuid": "5e01da75-c6ac-4528-8157-06d6d3c121fc", "value": 5111808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368886, "uuid": "25516844-38ed-474f-8ce5-eda9fa44372d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368886, "uuid": "d5ef1d50-1b5f-4cb7-9249-559ea9161a88", "value": "android_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a539bd0c-4ba1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778329305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329305, "uuid": "205bd025-d400-4bec-8709-c38b341b00b3", "comment": "Malware payload (Mirai)", "value": "1748064b8dc93ef03d588a2e250e96dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329305, "uuid": "8235635e-ffd1-46e4-bd9f-e8f9eb3ffb7d", "comment": "Malware payload (Mirai)", "value": "ed2103382969276f484ab124322501935655369f830afc0ec07c513118d4ecd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329305, "uuid": "441cc604-5141-48bd-8c82-38a44ec9d673", "comment": "Malware payload (Mirai)", "value": "7f1e4c8b1a1888bf625e9ef0c3a311671a1b36fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329305, "uuid": "e17ab5d3-b989-4f05-a16c-9eccecd130fb", "comment": "Malware payload (Mirai)", "value": "2265e73ccc35bf6eae7e6f21a8737fce1172627285d8dc4348be01dff8e3e2b121230416618447ae563daaede94be9de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329305, "uuid": "ab88c333-d2b5-4f0e-9f17-250ea22a56d0", "value": "T1B2044C46FB804A17C4D61379BAAF42453323D7A493EB73069928AFF43F8375E0E52A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329305, "uuid": "bec000b9-b3bc-42a8-a537-e5c35b249239", "value": "3072:Sky2yQoABtVqkm+aaa3ovs1NJ14ABf69j1pL3JL/KXp3Z8D:o2yQoABL3Haaa3ovs1b1N69j1pLZL/KQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778329305, "uuid": "55b3a8e6-302b-4f93-b01c-3cadbf72d228", "value": 173684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778329305, "uuid": "8909edb0-e08d-46ca-91d9-84af5336a7be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329305, "uuid": "544e64bd-81db-456a-a5f8-097f371989f0", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75d43fc-4b95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778324289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324289, "uuid": "5f1cec70-cde2-45fd-afbf-6fc0a7901332", "comment": "Malware payload", "value": "7a68e5d2736e645313b483da78c79a8a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324289, "uuid": "7d4d5105-554a-475c-bf3c-2091fe69eee3", "comment": "Malware payload", "value": "ef1a98fbf1e9caef21ba99048f87faf6e862af848bca0de7f555b9a268b7ac4c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324289, "uuid": "f6bf0a95-adb8-4b9e-874f-a30b1d6b10a1", "comment": "Malware payload", "value": "bf9f4b74c79a55c907ed8a631b8bf94e5ec505a5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778324289, "uuid": "fff00974-e431-432c-9abf-09769a70bef1", "comment": "Malware payload", "value": "d48e0aac4ebfd7ad761345682998a3ae40e5c123109cd8e9272a5f27f85f0904f7bbe53ece84712caca14066c12681c1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324289, "uuid": "2919b143-5fbd-4b63-9bcb-9e6df98bfec1", "value": "T193925B0FB9514319D5C00474A1B2873BD67A9876338054EFFBD8C9CA1B682EAF83225F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324289, "uuid": "0eefb72d-a5a4-4d7d-9ac4-58877121b323", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324289, "uuid": "85a5157b-9382-4dfa-9523-a7bfb7b00a34", "value": "384:bIkjrVlvadxKyjO5wxTv0vu98t2rFJ/BAav8U9c3G:rKx3a4v0G9opa0UyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778324289, "uuid": "37780f64-d3d9-44f9-9f90-7c2c4653d9e0", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778324289, "uuid": "22358d76-8cf0-4f4c-9454-1d369b96e92c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778324289, "uuid": "17b449f4-e73a-438b-92fd-bde04c4ac82d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0c697b-4bfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778368054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368054, "uuid": "00bf93e6-f1b5-48a4-9675-765aafba2241", "comment": "Malware payload", "value": "62468777981945684cc79639689b33f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368054, "uuid": "4892ed37-aa99-4a75-ae95-e1af89e056fe", "comment": "Malware payload", "value": "ef572750ce1a32fa8a15d188b5203a827f11ff387159c275cec8fddd73482228", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368054, "uuid": "f2e085b7-199e-43df-9f5f-9c89b2ef5480", "comment": "Malware payload", "value": "99dc5f324d82c7045c29d653bef9ead29d7dc602", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778368054, "uuid": "ddbcf00a-03f2-4b37-8160-7db8d1126271", "comment": "Malware payload", "value": "49687908ba03e206d29a74ab11ca60220974f936d595bcf6d0701edbb845187a5430a5dc93a3e4cd8a5c417db7fd596a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368054, "uuid": "67ac095c-b2a5-4400-b17e-b3629a3060ec", "value": "T1A68628536A28E70EE628213098B6CAD46B290CD505D7A957F382F70CF9F306D496EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368054, "uuid": "8ecec300-d889-4a3d-9e5d-bafbd665d4ff", "value": "49152:fJzHTPLoZ9g1yoTbLoqWU1haQLAr6t6wqLkNzsLXJrIW+sJkzymdHd/KYYB53Yhi:Ef6jN1TfnIjEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778368054, "uuid": "42afbff2-fbb6-421f-843b-8c2b1e3c5cd1", "value": 8388801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778368054, "uuid": "d6b34dfa-4a89-4ae0-b1b2-6d7dc22bfff1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778368054, "uuid": "85290471-1e61-412e-b211-9a58f3c3b5ee", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d8153b-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778331185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331185, "uuid": "3e6881d8-07ac-4566-bc05-d82f504965e0", "comment": "Malware payload", "value": "b65f52372df14b4bc6e4c1ff1e233c06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331185, "uuid": "81ddf5e1-908c-4bc7-bc90-377c24a01a95", "comment": "Malware payload", "value": "ef772daa190afc71db925257b20abd2ac0d06bc2e55abd7bc8083df41d9c5ae9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331185, "uuid": "b3847151-c594-40b9-92bf-50af25ff6e9b", "comment": "Malware payload", "value": "c7454b490981a6935e72ef73f31d537623edda65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331185, "uuid": "ef9e493c-1fc1-4e68-9718-acd99bda5350", "comment": "Malware payload", "value": "64f926d1675b74e3a991ea0e721a61a3cd78ebaf17c3112d4e3e80bc02d92d54eef1d245454a0013ddcf4d27e9783c6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331185, "uuid": "294003f4-c7b1-49e2-80f0-896eb824d128", "value": "T13F34E322DDC81813C4B96D762BEBF96DD2982F01ACFB4ABA9D2451D5C5E3237B183740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331185, "uuid": "970bd1dc-ee41-4a44-8b68-dd29c177b6a8", "value": "3072:8Kayqyf0Xt0/GogndrRtiQM6kSX7tCXD1VJRlQXMQ0/EkPWSxktrXTn:8KadQoqvQdrvo6bX4/J/JQ0/b+SkBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331185, "uuid": "a18fca01-afdd-4fc2-b179-f1ca1f86eeb8", "value": 245089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331185, "uuid": "68717eed-457e-417b-96ff-f5ed5da9c376", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331185, "uuid": "bda352dd-b87a-4c0d-b402-e07ca86f816b", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5317122a-4ba6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778331315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331315, "uuid": "437848a9-59f2-455e-8159-6dd9ed52761d", "comment": "Malware payload", "value": "0b7ccbe048deb7a639651ac5dd70beda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331315, "uuid": "c2d8e204-8f05-4a81-aad4-9cea18843747", "comment": "Malware payload", "value": "f144feb936517ef8f3c187acd9f7b9649d559c2e46bfe8f47a1b46b202d2df45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331315, "uuid": "a6308c20-71cf-4294-9feb-870690621d61", "comment": "Malware payload", "value": "8340ec2e65546041e4ad29c99955ae956a113f34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778331315, "uuid": "abec2301-4a8e-4c72-a1a9-a72c4168d4ff", "comment": "Malware payload", "value": "cef1ab2a9fda651fa95361cde1b18bcccb1a688130d7772c24168f16d04c1836a4362595cc412d8e842d5c99d0a424ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331315, "uuid": "1c155ef1-69e0-4733-92e5-e70d6245cc1b", "value": "T1E2D3D1C9E3DE394FC6A50936B8A3F2207D6EF15065D62954721DB95121EEEBF2B08802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331315, "uuid": "b9c46586-8ec5-421b-8129-79601a733414", "value": "1536:H8fhtmWIbbFpkAQrNCFY3zGMkosMGmdUjqvBcL2DC8BblDnTOoD2cIrdSXF3:H8fgRphoxjCosmTpcL2DNItkF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778331315, "uuid": "496776fe-63bb-42d5-9725-b4dfa0567455", "value": 133444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778331315, "uuid": "57a5754f-9752-49c3-a669-82686a5ee001", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778331315, "uuid": "e8cd2bdd-85d9-46df-9f34-4e4e4309645b", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d75789-4bd5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778351728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351728, "uuid": "8b5c5ea7-981e-424f-9696-0255779e3c6b", "comment": "Malware payload (Mirai)", "value": "6dae7dd1002aee2dcb7e189d8b3dbc50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351728, "uuid": "f539f6e9-c63e-480a-8bcb-9dc17ab4f5db", "comment": "Malware payload (Mirai)", "value": "f15e3d2d7feb913f89df38b40294ef00c1bb8a5539be75fe7161a71ea7ae1822", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351728, "uuid": "a1dbd947-5d1b-4c11-a2e1-3a07d7ba62ef", "comment": "Malware payload (Mirai)", "value": "e7c48736951516911a9d40a8b488866f759c49f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351728, "uuid": "293f8282-37dc-4541-9e51-5a15c7abad08", "comment": "Malware payload (Mirai)", "value": "56c4137ff37402a975858aa6d68b86cdb26bafa34898affae492414a7efefa4358d4bd825f6aa9997a0eaf3bb5f60028", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351728, "uuid": "81a6fd64-a68d-45ab-b7f6-e2781067e1c8", "value": "T19C447E137B484DFFC92EC7B15EEBA3208A13F0350B27A79B37546A952F4B1985E94318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351728, "uuid": "0aacd996-e15a-4df8-a97a-692bb5610820", "value": "3072:DpdLyu35RUn1ulERw3cRBPZZJgBjbkxZ+f0W3YehOwh+U1p4hjLMVZVhePVrp:fbUn1KcdSg+vhOS6jLMVZVhePVrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778351728, "uuid": "edcb9b29-971e-4488-b12a-ac061f20af69", "value": 261372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778351728, "uuid": "0cf83398-13a6-4bf9-a69c-381b7472d5a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351728, "uuid": "15be0a92-d9c3-4c07-9fe9-7085c5021c6a", "value": "zyre.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad6dabb-4bdb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778354172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354172, "uuid": "7cfebc5e-37bd-4658-94dc-8de60f14644f", "comment": "Malware payload (Mirai)", "value": "1905ff60d599b8913bb76b31e700f2be", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354172, "uuid": "4b7fda9b-d56f-4dc9-9fe6-996b293467a4", "comment": "Malware payload (Mirai)", "value": "f1e725b1b62d441789449986da7604590a0acd5a8b306fb12faa54cfdf627656", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354172, "uuid": "f82a85a7-8cca-4644-831c-abd4c6b8ca83", "comment": "Malware payload (Mirai)", "value": "62baf23e1dc0f99ad4be349f97c7f37c7020573c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778354172, "uuid": "d50598ae-d2f4-4a2d-b74b-4e74b5bddb06", "comment": "Malware payload (Mirai)", "value": "34701905757c874d5de80068919713da95ce5eea3e420557c746346d5fe899c16467f28ab6395ddd068915b055780af2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354172, "uuid": "17b156f9-1d4d-4478-b548-b867bbe2f7e3", "value": "T1CC01F7D13774217036EF9CE65A336C9CB48D94773D865CFC3C65E8EA0595E10A0824ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354172, "uuid": "bf18e749-43c4-481e-9c2e-a091ec85aab8", "value": "12:YkF1kcClZF70SsxHFWxHFnxHFWnTu0FS7PFM5gF6HanTu0FSdPFMDgF6HGA1LRPb:ZDkH/FbsxHFWxHFnxHFWTDFMPFM5gF6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778354172, "uuid": "4e49e099-8d4f-452d-af62-8de9bdc1fb03", "value": 744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778354172, "uuid": "1a385b95-d211-46ac-9503-6203a7da39b8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778354172, "uuid": "eeb546ba-165d-4173-84a2-9a841d04e632", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d5788f-4b9f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778328372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328372, "uuid": "8070dc72-c5a4-4149-ac7c-74b00fe65ed8", "comment": "Malware payload (ValleyRAT)", "value": "8c03767c3aee70dfe3f26ea26a47fbf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328372, "uuid": "abfc891d-a745-4730-a6a3-3b382a52a7a7", "comment": "Malware payload (ValleyRAT)", "value": "f30e228cbd02c855f3e0c0afa3ed6ff510a3bc98d5e7e0a4aca7c2ce2a794fec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328372, "uuid": "6822cd46-3654-42d2-8973-93e196ca0846", "comment": "Malware payload (ValleyRAT)", "value": "4158cfd753378fbd0f131d933382a3b3bcbf829f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778328372, "uuid": "6717d465-5c6c-4eab-afbe-ef130517374e", "comment": "Malware payload (ValleyRAT)", "value": "b625451db666f51a57317581ecb52201d252523c2c4fac6cf4885c7141c96ab58687bbc8a6ea96e285d94f6bc23a4ee5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328372, "uuid": "66270ced-a158-4aa5-9409-4577a3d64d57", "value": "T170F4E717FB75E1A5D25AC4B862621B63B6347C0C6224A333CFA9CB617B20F18CD9E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328372, "uuid": "11c2f66a-5b54-400e-806a-25f7e5167633", "value": "88964abb1ae69d582d0f0b22d62fa582", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328372, "uuid": "b86bdcff-06f4-432f-a468-1b9350916a35", "value": "6144:YHVdC5cLOlJMsygrz02PfjOb4g8YEkhDDXG+O66CqSknf/ZBwse8kA2fDzEBZxJ5:QfLerwumD/yRkDgH09JbPkmsZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778328372, "uuid": "0041faba-f5e1-4926-95b8-1da738b3ad74", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778328372, "uuid": "974c66c5-3a34-4602-8cb3-6954cf1705f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778328372, "uuid": "22d754b7-d500-4dae-be6c-32e1beb21184", "value": "2026\u5e74\u7b2c\u4e00\u6279\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38727eae-4bbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778342008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342008, "uuid": "3a96b83c-563e-4fab-a8a5-46e003b78c0b", "comment": "Malware payload (Mirai)", "value": "ee8c9433935d4c68cbd7469b215f19e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342008, "uuid": "84a5b216-55eb-4224-b737-64153302081f", "comment": "Malware payload (Mirai)", "value": "f5a7696239b801496743753f8066775f68793e81b5d4eceb15f701950774733d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342008, "uuid": "7b844cb6-6a2f-49ca-8d26-a80587bf96a8", "comment": "Malware payload (Mirai)", "value": "e82e07e32d6b928841333f8d4bb8edc66eed2ff2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778342008, "uuid": "3fdf2640-6e63-4eda-aa79-2718f9357e9e", "comment": "Malware payload (Mirai)", "value": "ae0f6fba24418fb6537867db35253a919ef4223f73b9b45e99b9eb716d422233dc2c741831dfb9712504d4ad21351e6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342008, "uuid": "3937103a-274a-43fd-985a-80f6367e8e15", "value": "T1B9360997B8D14A43C4E43676B8BD81C833A34EB99B9713666D04FE3C3ABE1990E35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342008, "uuid": "71cccf34-1c76-458c-908c-f2e8266309c5", "value": "24576:p1aBkWO3wadzwaH/9lRO8wi4HUFJAlR1anVX0ruJJeiP68sLNBojZw99oPpOiDtu:lvIhO/TvWdiSd9wwycveLlA1sn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778342008, "uuid": "66095d42-5b7b-44e9-bab3-c66a2da5ccd5", "value": 4915352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778342008, "uuid": "c8937d74-1b31-4016-9ac0-ca67927882f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778342008, "uuid": "e3894524-36ca-4c9c-84f8-7d3bb93a5751", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e04959-4ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778329706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329706, "uuid": "bf795872-34b0-4857-8f53-d9e1f4311212", "comment": "Malware payload (Mirai)", "value": "74663b773ab5bb8adb6d2d8fc3254c92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329706, "uuid": "d9df6207-1571-42ef-9e75-bf29edc29da9", "comment": "Malware payload (Mirai)", "value": "f62cfeb4b3a2d4e5b45ec706288ac2bf6da5218545ed93a567dda145be23f3a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329706, "uuid": "be74c8ee-ffec-449e-8e91-ed5b6e4adeff", "comment": "Malware payload (Mirai)", "value": "dde7f0754355211513202cc13584998ae72e40fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778329706, "uuid": "f86b2fd1-7cb4-4450-9f5e-34a9a8d5d1fc", "comment": "Malware payload (Mirai)", "value": "7cda4f95fc8378f88f93afca0f5d079db4bb90338c3a4ee344e89dd89987f88170ab122d971da484492f020a59cfc7f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329706, "uuid": "5c5b12a5-9173-4944-96f4-9c81cccce71c", "value": "T1FBB3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329706, "uuid": "e8c14c97-da40-4c95-95bb-58d1a809381c", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHz/8rSR:t3SrlGWnKTU83AQB5A5Liy36fbUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778329706, "uuid": "582f32af-63f2-4c04-89e6-c94b62761f27", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778329706, "uuid": "9c8727e7-37d8-4d15-aa5f-13d1f147a23f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778329706, "uuid": "9c5ee392-9f18-4210-b6ef-bdaf4ccffee1", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d950e82-4bad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778334339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334339, "uuid": "68b32a5d-dbde-41f2-b96e-e5d98d7b5afb", "comment": "Malware payload", "value": "56f1fceb595e62172f9dd69d89ed3ebe", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334339, "uuid": "1e1493d6-9122-4fa2-9cba-a45451500b65", "comment": "Malware payload", "value": "f8d9a4f1bc7c112702a45fe7335d1a0ebd569440ce0f842a4b34b440b8afdddd", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334339, "uuid": "099eacba-86f2-4690-8de5-50c8351ef6b1", "comment": "Malware payload", "value": "c57be4306748505c6253161edb832c0d324c15a7", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334339, "uuid": "4663ddaf-f795-4229-a8f8-10071aab5985", "comment": "Malware payload", "value": "d694278c4542183de6159077de0837140936d16c3c824726bf7ae1d787c4982aea9dc087d2ba22012bf93201d5d362be", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334339, "uuid": "054aec38-32e1-4df9-ae9c-d50b16bc08c8", "value": "T1A85733CCA30C366CD77FE4F694AA92C6D1D0E156B1F72869B838918D59D73803B087B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334339, "uuid": "608d30ea-e434-4fa4-b65f-63bbf677d48d", "value": "786432:vlaJ94fDjxN3D6DG5pnnUuwFjg6JrpkmBDv:vla7UxNz6Dypnp565imhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778334339, "uuid": "01d3b87c-fcaa-4881-8757-051678ddcf23", "value": 29402512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778334339, "uuid": "eca7cb59-1760-4657-ab01-f634aa58e4d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334339, "uuid": "ea555bef-d649-418a-b896-7fac72c3a749", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a08da0-4bf9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778367174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778367174, "uuid": "acbd076a-d60a-4282-8a59-e76a702e5eba", "comment": "Malware payload", "value": "98f592617fda0e116aba0bc467af5990", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778367174, "uuid": "e8f55db0-1ea5-4685-9dc4-dc4a66d36eb7", "comment": "Malware payload", "value": "f8f86a6158a9c3f6b09fbc7ff4c927f7918ada1d92ec0d1f817702031c73d55e", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778367174, "uuid": "445d01c2-c285-4205-881f-28c8135bf01e", "comment": "Malware payload", "value": "3db2fae89cf94e46a891189dd46625edff70398d", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778367174, "uuid": "07708017-a2f2-4004-b3d4-7a7bdb0af4e6", "comment": "Malware payload", "value": "d8cf2ead250b143815ce327141ea3dd33f2ae377e6cb5f67a7d38f3c63540c698b5ac1f2cb917692961d8d8322d7a5ac", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778367174, "uuid": "79ce68d9-4910-41e3-b501-c0afa9a44917", "value": "T159867E4DE8E7B041AD2198C31F9EE7F1091E6316B99A1C52357C020847D58FF6F8AE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778367174, "uuid": "bb96ac48-78ac-48d3-8dc1-954e34e52425", "value": "2ac0c4d3fec4c7e9ce9158815bb62c6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778367174, "uuid": "a0707546-4e48-48cc-b9a9-48ff2099d24a", "value": "49152:FuG0UK/yAURCTytXTiANwSV8v2TVuzVM40+0lhFiNw4fX6MxxviYe08kzvPLOlMe:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778367174, "uuid": "ecc49727-715b-4f96-9e01-2fb2f4d92b73", "value": 8129904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778367174, "uuid": "3100f61a-f88a-4397-8dec-d4018e285ae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778367174, "uuid": "e74295a9-64bc-438f-8945-7a290f62bd9f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77548d57-4bd4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778351133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351133, "uuid": "cdc8b227-b8c7-4b42-8eb9-2eb8612f4cf7", "comment": "Malware payload", "value": "508675b1a8ae1b2c1af18bca3cdafe75", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351133, "uuid": "2174b46f-add5-49c4-806d-b7dbcf3f2232", "comment": "Malware payload", "value": "fb4fdbe249a9c0fd6868d3b95fefa609ef6d7e6b18c25369bb38f2dccbc3b59e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351133, "uuid": "50cc0e8c-e850-4e9e-81ee-b528759f682e", "comment": "Malware payload", "value": "1d5c814fd13d55ce17179125092ccfd432cf7a29", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778351133, "uuid": "8629fb25-dfdd-40c0-8129-18e62e116c37", "comment": "Malware payload", "value": "26df337c92f1084bd3067962fd010e5a367ebee49a1eb750fa0bd74ba9006fadafcbc9e271141876b463b6cfb9dcb747", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351133, "uuid": "65982d8d-22ca-466d-914f-901431b06724", "value": "T191C4882DF9669434E1C3D1336A005137F83BC8C5A63EE93B6DF0A96D2D6CB958B019C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351133, "uuid": "4bd84551-d48e-4754-b7b2-7b28beea5a47", "value": "12288:9qn3ZEZwjHDblah1nzGprsYZDO2PPHmkFIborcK7n:0npuw/wwrsYZFGkFIbucK7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778351133, "uuid": "46e1df4c-c2cd-46d5-ab12-21ba0f917e69", "value": 546323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778351133, "uuid": "16df816e-8a65-4025-b6e6-1679717f3f9c", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778351133, "uuid": "67775817-36c6-4a34-aaba-374f776230e4", "value": "xenon-cracked.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cc330c-4bad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778334373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334373, "uuid": "23485c7d-390b-493f-ab60-703923fefa92", "comment": "Malware payload", "value": "c27d1d53227c6d8b34080519276e0602", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334373, "uuid": "31c30347-6f7f-429a-abb7-650024f25a7e", "comment": "Malware payload", "value": "fd981bd72d2ed2453a8385e2271bce730bf67b0f514ed3af885f42e31ec01720", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334373, "uuid": "8a5796c5-c984-408e-9803-a3156d05f53a", "comment": "Malware payload", "value": "fd57dc0c7a3b94485a53e4c675791b2ba261a2d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778334373, "uuid": "ce676178-8bb4-4b76-b404-0edb84b5d8ae", "comment": "Malware payload", "value": "4333795dd67597dbe9bcc3a71b96b7bfb7df6b603893124fc1ef488c88424ea6696939f458b2a645227a583ec2bd2c4e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334373, "uuid": "adcf365b-48fe-4fb9-a1d3-0f161a76b4e0", "value": "T1CB968D9D33622229C8A7F5BB3CAE405B4931BA161072920EE38CFD1B8B317E45D56777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334373, "uuid": "ca2d4166-d246-44fa-804c-d8fcddf3bf85", "value": "bfbff861d27f35a91d19a5a58e3fb3ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334373, "uuid": "4bd76566-4d1d-4c0b-85f1-ed9114aaa9d0", "value": "98304:/hMWj/8OzT8pHIbxsGR0PlFfzw0GR07GR00lFfzwh92ElPGR0PlFfzw3tNB6MzR5:/hLZNTzRO8//Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778334373, "uuid": "54f5f423-c46a-4fc2-a67b-bc1fc4e436ff", "value": 8847336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778334373, "uuid": "ebb67e1b-ca05-4149-aa1b-655366363b24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778334373, "uuid": "f129615d-33b4-4e7c-a586-ac826d3fb06c", "value": "libvlccore.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f397fc6-4bd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778352757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352757, "uuid": "0d27d2db-e18b-4511-894b-eecdf26b0bf5", "comment": "Malware payload (Mirai)", "value": "bc2b30c3ce0375dd4386d42dafaf8ed8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352757, "uuid": "08f04eff-0e70-468d-9422-5e804771c51a", "comment": "Malware payload (Mirai)", "value": "fe2acb7abf32bf9464793be09615fbcc824c2339eebb2f5fa235608cb792a242", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352757, "uuid": "b24699b2-6652-482e-8851-adc9ebe352b0", "comment": "Malware payload (Mirai)", "value": "e74955a5f3e64e43d769e3532bf1bc83cf6fc6cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778352757, "uuid": "cfaa940d-8860-4538-9d50-96361b7fe9f1", "comment": "Malware payload (Mirai)", "value": "d1246141e595cdd6869dfaab83d98998e11350a57e595c5715e56eacc4248b21591a91d1d2c30b52ca65dc5c82be5eb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352757, "uuid": "046f64d4-508d-4f4d-a4bc-8c9dc264febd", "value": "T193A31ADEB8A24A1DC6D256B7B62E578473B55374C3CB7203D8144FF8A28F10A4B36B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352757, "uuid": "f3128a25-e42f-4769-b505-6af9a628247a", "value": "1536:sZrNjSLF2AaNVCNOmBSYVWk7DvWSir/UuDAIkdJwCaBJ:MxjSLY5NV0vBx7ySiYuwaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778352757, "uuid": "e6dd3a4a-0415-4969-b72c-e94530ad3ed8", "value": 104932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778352757, "uuid": "a8d39000-4810-470f-8ab5-024ca7d1b64f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778352757, "uuid": "bd7e2ea9-65a7-48f2-b15b-c3d8d4bb8e0c", "value": "debug.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deafc068-4b92-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778322959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778322959, "uuid": "098cf9b4-5dbe-4023-ba95-3346f2231538", "comment": "Malware payload (Mirai)", "value": "c0913b226958548030deb605e7767119", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778322959, "uuid": "655e2769-8c2d-47ce-8241-7e0f49d6e15d", "comment": "Malware payload (Mirai)", "value": "ff6438403c893c8a35d04dfb5f21c9054ee72de7842ea63145a1c97c5e30e1cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778322959, "uuid": "ef647cff-62ea-461a-a720-71fa5a7056ef", "comment": "Malware payload (Mirai)", "value": "0cdc8fe845700f025ea54d65e2a9756ac04df528", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778322959, "uuid": "be44fbe2-8ae9-4d39-8d68-5ecee0135ff0", "comment": "Malware payload (Mirai)", "value": "efd40b39d31b57fa452d725604fed76dab11b175e8157bdbfafa49cbe3b593d0ef8fd2931675b84c55312dc2cfca0e34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778322959, "uuid": "00b7d101-9da2-4ddc-a2f7-f597c2d629f9", "value": "T1F873027221B6DE62D6B2883363473D5D7A33886A03B462BDBC79936FF487E11580C45A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778322959, "uuid": "7d234fe0-874d-425a-9426-842d06a7b8db", "value": "1536:38zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWm5X1Rorb:MzRnwP0bMQ2RijvDZZ1rYGhG135X1RSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778322959, "uuid": "6150b080-b3d6-428c-ad6c-1eee6e7e7820", "value": 74780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778322959, "uuid": "d4bce058-a95b-4716-b86d-6b2a7f9dbe76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778322959, "uuid": "d1996e5a-c04e-474a-a1fd-abae12c7d062", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }